Finally the Hosts and Extra hosts bit both work

.env.template

@@ -16,6 +16,6 @@ DATABASE_URL = ""
 HOST_URL = "*"
 
 #If you decide to add multiple websites as whitelisted (for example, domain name shenanigans)
-#CSRF_TRUSTED_EXTRA = "https://myus-prod.fly.dev"
-CSRF_TRUSTED_EXTRA = ""
+#HOSTS_URL_EXTRA = "myus-prod.fly.dev"
+HOSTS_URL_EXTRA = ""
 

myus/settings.py

@@ -28,18 +28,25 @@
 DEBUG = False
 
 host_url = os.getenv("HOST_URL")
-ALLOWED_HOSTS = [host_url]
+extra_hosts_url = os.getenv("HOSTS_URL_EXTRA")
 
-if os.getenv("CSRF_TRUSTED_EXTRA"):
-    CSRF_TRUSTED_ORIGINS = ["https://" + host_url, os.getenv("CSRF_TRUSTED_EXTRA")]
+if extra_hosts_url:
     CSRF_TRUSTED_ORIGINS = [
         "https://" + host_url,
         "https://www." + host_url,
-        os.getenv("CSRF_TRUSTED_EXTRA"),
+        "https://" + extra_hosts_url,
+    ]
+    ALLOWED_HOSTS = [
+        host_url,
+        "www." + host_url,
+        extra_hosts_url,
     ]
 else:
-    CSRF_TRUSTED_ORIGINS = ["https://" + host_url]
     CSRF_TRUSTED_ORIGINS = ["https://" + host_url, "https://www." + host_url]
+    ALLOWED_HOSTS = [
+        host_url,
+        "www." + host_url,
+    ]
 
 # Application definition
 INSTALLED_APPS = [