Django 4.0 (December 2021) changed the format of CSRF_TRUSTED_ORIGINS. Entries must now be full origins including the scheme, such as https://app.example.com, where previously a bare hostname or a leading-dot wildcard was accepted. Starting the project with the old format raises a system check error naming the setting and the offending value.
The reason is that the CSRF check now compares the request's Origin header, which always carries a scheme, rather than inferring from Referer alone. Subdomain wildcards are still possible, written as https://*.example.com.
The practical consequence appears behind a reverse proxy that terminates TLS. Django sees an http request and builds an origin that does not match your https entry, so form posts fail with CSRF verification failed. Origin checking failed. Fix that with SECURE_PROXY_SSL_HEADER set to the header your proxy actually sends, and make sure the proxy strips that header from client requests, otherwise a client can forge it. USE_X_FORWARDED_HOST is the matching setting when the proxy rewrites Host.