I am creating a Chrome extension that allows the user to POST to the Django server.
Currently, I am using django-cors-headers with the setting:
CORS_ORIGIN_
Okay, here's a simple answer: don't do it server-side.
An extension with a host permission will ignore CORS headers and the request will be sent out regardless.