diff --git a/cms/envs/common.py b/cms/envs/common.py
index 896f5c473f..1cbd2bf001 100644
--- a/cms/envs/common.py
+++ b/cms/envs/common.py
@@ -252,6 +252,7 @@ MAKO_TEMPLATES['main'] = [
     COMMON_ROOT / 'templates',
     COMMON_ROOT / 'djangoapps' / 'pipeline_mako' / 'templates',
     COMMON_ROOT / 'static',  # required to statically include common Underscore templates
+    OPENEDX_ROOT / 'core' / 'djangoapps' / 'cors_csrf' / 'templates',
     OPENEDX_ROOT / 'core' / 'djangoapps' / 'dark_lang' / 'templates',
     CMS_ROOT / 'djangoapps' / 'pipeline_js' / 'templates',
 ]
diff --git a/common/djangoapps/enrollment/views.py b/common/djangoapps/enrollment/views.py
index 05da454dd2..ec84e5ee8c 100644
--- a/common/djangoapps/enrollment/views.py
+++ b/common/djangoapps/enrollment/views.py
@@ -18,8 +18,8 @@ from rest_framework.throttling import UserRateThrottle
 from rest_framework.views import APIView
 from opaque_keys.edx.keys import CourseKey
 from embargo import api as embargo_api
-from cors_csrf.authentication import SessionAuthenticationCrossDomainCsrf
-from cors_csrf.decorators import ensure_csrf_cookie_cross_domain
+from openedx.core.djangoapps.cors_csrf.authentication import SessionAuthenticationCrossDomainCsrf
+from openedx.core.djangoapps.cors_csrf.decorators import ensure_csrf_cookie_cross_domain
 from openedx.core.lib.api.authentication import (
     SessionAuthenticationAllowInactiveUser,
     OAuth2AuthenticationAllowInactiveUser,
diff --git a/lms/envs/common.py b/lms/envs/common.py
index c356863f74..61a8501e06 100644
--- a/lms/envs/common.py
+++ b/lms/envs/common.py
@@ -471,6 +471,7 @@ MAKO_TEMPLATES['main'] = [
     COMMON_ROOT / 'templates',
     COMMON_ROOT / 'lib' / 'capa' / 'capa' / 'templates',
     COMMON_ROOT / 'djangoapps' / 'pipeline_mako' / 'templates',
+    OPENEDX_ROOT / 'core' / 'djangoapps' / 'cors_csrf' / 'templates',
     OPENEDX_ROOT / 'core' / 'djangoapps' / 'dark_lang' / 'templates',
 ]
 
@@ -1129,8 +1130,8 @@ MIDDLEWARE_CLASSES = (
 
     # CORS and CSRF
     'corsheaders.middleware.CorsMiddleware',
-    'cors_csrf.middleware.CorsCSRFMiddleware',
-    'cors_csrf.middleware.CsrfCrossDomainCookieMiddleware',
+    'openedx.core.djangoapps.cors_csrf.middleware.CorsCSRFMiddleware',
+    'openedx.core.djangoapps.cors_csrf.middleware.CsrfCrossDomainCookieMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
 
     'splash.middleware.SplashMiddleware',
@@ -2072,7 +2073,7 @@ INSTALLED_APPS = (
 
     # CORS and cross-domain CSRF
     'corsheaders',
-    'cors_csrf',
+    'openedx.core.djangoapps.cors_csrf',
 
     'commerce',
 
diff --git a/lms/urls.py b/lms/urls.py
index e879ceaccc..3b10c680e6 100644
--- a/lms/urls.py
+++ b/lms/urls.py
@@ -884,7 +884,7 @@ urlpatterns += (
 
 # XDomain proxy
 urlpatterns += (
-    url(r'^xdomain_proxy.html$', 'cors_csrf.views.xdomain_proxy', name='xdomain_proxy'),
+    url(r'^xdomain_proxy.html$', 'openedx.core.djangoapps.cors_csrf.views.xdomain_proxy', name='xdomain_proxy'),
 )
 
 # Custom courses on edX (CCX) URLs
diff --git a/common/djangoapps/cors_csrf/__init__.py b/openedx/core/djangoapps/cors_csrf/__init__.py
similarity index 100%
rename from common/djangoapps/cors_csrf/__init__.py
rename to openedx/core/djangoapps/cors_csrf/__init__.py
diff --git a/common/djangoapps/cors_csrf/admin.py b/openedx/core/djangoapps/cors_csrf/admin.py
similarity index 62%
rename from common/djangoapps/cors_csrf/admin.py
rename to openedx/core/djangoapps/cors_csrf/admin.py
index b7e4153a39..7aa4233f32 100644
--- a/common/djangoapps/cors_csrf/admin.py
+++ b/openedx/core/djangoapps/cors_csrf/admin.py
@@ -1,7 +1,11 @@
-"""Manage cross-domain configuration. """
+"""
+Manage cross-domain configuration.
+"""
+
 from django.contrib import admin
 from config_models.admin import ConfigurationModelAdmin
-from cors_csrf.models import XDomainProxyConfiguration
+
+from .models import XDomainProxyConfiguration
 
 
 admin.site.register(XDomainProxyConfiguration, ConfigurationModelAdmin)
diff --git a/common/djangoapps/cors_csrf/authentication.py b/openedx/core/djangoapps/cors_csrf/authentication.py
similarity index 87%
rename from common/djangoapps/cors_csrf/authentication.py
rename to openedx/core/djangoapps/cors_csrf/authentication.py
index 723ec8eed1..6083fee5d3 100644
--- a/common/djangoapps/cors_csrf/authentication.py
+++ b/openedx/core/djangoapps/cors_csrf/authentication.py
@@ -1,6 +1,10 @@
-"""Django Rest Framework Authentication classes for cross-domain end-points."""
+"""
+Django Rest Framework Authentication classes for cross-domain end-points.
+"""
+
 from rest_framework import authentication
-from cors_csrf.helpers import is_cross_domain_request_allowed, skip_cross_domain_referer_check
+
+from .helpers import is_cross_domain_request_allowed, skip_cross_domain_referer_check
 
 
 class SessionAuthenticationCrossDomainCsrf(authentication.SessionAuthentication):
diff --git a/common/djangoapps/cors_csrf/decorators.py b/openedx/core/djangoapps/cors_csrf/decorators.py
similarity index 100%
rename from common/djangoapps/cors_csrf/decorators.py
rename to openedx/core/djangoapps/cors_csrf/decorators.py
diff --git a/common/djangoapps/cors_csrf/helpers.py b/openedx/core/djangoapps/cors_csrf/helpers.py
similarity index 100%
rename from common/djangoapps/cors_csrf/helpers.py
rename to openedx/core/djangoapps/cors_csrf/helpers.py
diff --git a/common/djangoapps/cors_csrf/middleware.py b/openedx/core/djangoapps/cors_csrf/middleware.py
similarity index 98%
rename from common/djangoapps/cors_csrf/middleware.py
rename to openedx/core/djangoapps/cors_csrf/middleware.py
index dfd554d9dc..ac03243133 100644
--- a/common/djangoapps/cors_csrf/middleware.py
+++ b/openedx/core/djangoapps/cors_csrf/middleware.py
@@ -48,7 +48,7 @@ from django.conf import settings
 from django.middleware.csrf import CsrfViewMiddleware
 from django.core.exceptions import MiddlewareNotUsed, ImproperlyConfigured
 
-from cors_csrf.helpers import is_cross_domain_request_allowed, skip_cross_domain_referer_check
+from .helpers import is_cross_domain_request_allowed, skip_cross_domain_referer_check
 
 log = logging.getLogger(__name__)
 
diff --git a/common/djangoapps/cors_csrf/migrations/0001_initial.py b/openedx/core/djangoapps/cors_csrf/migrations/0001_initial.py
similarity index 100%
rename from common/djangoapps/cors_csrf/migrations/0001_initial.py
rename to openedx/core/djangoapps/cors_csrf/migrations/0001_initial.py
diff --git a/common/djangoapps/cors_csrf/migrations/__init__.py b/openedx/core/djangoapps/cors_csrf/migrations/__init__.py
similarity index 100%
rename from common/djangoapps/cors_csrf/migrations/__init__.py
rename to openedx/core/djangoapps/cors_csrf/migrations/__init__.py
diff --git a/common/djangoapps/cors_csrf/models.py b/openedx/core/djangoapps/cors_csrf/models.py
similarity index 74%
rename from common/djangoapps/cors_csrf/models.py
rename to openedx/core/djangoapps/cors_csrf/models.py
index 61a39046bd..1274f4f17a 100644
--- a/common/djangoapps/cors_csrf/models.py
+++ b/openedx/core/djangoapps/cors_csrf/models.py
@@ -7,7 +7,7 @@ from config_models.models import ConfigurationModel
 class XDomainProxyConfiguration(ConfigurationModel):
     """Cross-domain proxy configuration.
 
-    See `cors_csrf.views.xdomain_proxy` for an explanation of how this works.
+    See `openedx.core.djangoapps.cors_csrf.views.xdomain_proxy` for an explanation of how this works.
 
     """
 
@@ -17,3 +17,6 @@ class XDomainProxyConfiguration(ConfigurationModel):
             u"requests to this site.  Please list each domain on its own line."
         )
     )
+
+    def __unicode__(self):
+        return "XDomainProxyConfiguration()"
diff --git a/common/templates/cors_csrf/xdomain_proxy.html b/openedx/core/djangoapps/cors_csrf/templates/cors_csrf/xdomain_proxy.html
similarity index 100%
rename from common/templates/cors_csrf/xdomain_proxy.html
rename to openedx/core/djangoapps/cors_csrf/templates/cors_csrf/xdomain_proxy.html
diff --git a/common/djangoapps/cors_csrf/tests/__init__.py b/openedx/core/djangoapps/cors_csrf/tests/__init__.py
similarity index 100%
rename from common/djangoapps/cors_csrf/tests/__init__.py
rename to openedx/core/djangoapps/cors_csrf/tests/__init__.py
diff --git a/common/djangoapps/cors_csrf/tests/test_authentication.py b/openedx/core/djangoapps/cors_csrf/tests/test_authentication.py
similarity index 96%
rename from common/djangoapps/cors_csrf/tests/test_authentication.py
rename to openedx/core/djangoapps/cors_csrf/tests/test_authentication.py
index ea4587021a..5f9001ca10 100644
--- a/common/djangoapps/cors_csrf/tests/test_authentication.py
+++ b/openedx/core/djangoapps/cors_csrf/tests/test_authentication.py
@@ -8,7 +8,7 @@ from django.conf import settings
 
 from rest_framework.exceptions import PermissionDenied
 
-from cors_csrf.authentication import SessionAuthenticationCrossDomainCsrf
+from ..authentication import SessionAuthenticationCrossDomainCsrf
 
 
 class CrossDomainAuthTest(TestCase):
diff --git a/common/djangoapps/cors_csrf/tests/test_decorators.py b/openedx/core/djangoapps/cors_csrf/tests/test_decorators.py
similarity index 92%
rename from common/djangoapps/cors_csrf/tests/test_decorators.py
rename to openedx/core/djangoapps/cors_csrf/tests/test_decorators.py
index a9452158c2..8e2e1b86ab 100644
--- a/common/djangoapps/cors_csrf/tests/test_decorators.py
+++ b/openedx/core/djangoapps/cors_csrf/tests/test_decorators.py
@@ -3,7 +3,8 @@ import json
 import mock
 from django.http import HttpResponse
 from django.test import TestCase
-from cors_csrf.decorators import ensure_csrf_cookie_cross_domain
+
+from ..decorators import ensure_csrf_cookie_cross_domain
 
 
 def fake_view(request):
diff --git a/common/djangoapps/cors_csrf/tests/test_middleware.py b/openedx/core/djangoapps/cors_csrf/tests/test_middleware.py
similarity index 99%
rename from common/djangoapps/cors_csrf/tests/test_middleware.py
rename to openedx/core/djangoapps/cors_csrf/tests/test_middleware.py
index bfc4f0817f..9c6480ba92 100644
--- a/common/djangoapps/cors_csrf/tests/test_middleware.py
+++ b/openedx/core/djangoapps/cors_csrf/tests/test_middleware.py
@@ -11,7 +11,7 @@ from django.core.exceptions import MiddlewareNotUsed, ImproperlyConfigured
 from django.http import HttpResponse
 from django.middleware.csrf import CsrfViewMiddleware
 
-from cors_csrf.middleware import CorsCSRFMiddleware, CsrfCrossDomainCookieMiddleware
+from ..middleware import CorsCSRFMiddleware, CsrfCrossDomainCookieMiddleware
 
 
 SENTINEL = object()
diff --git a/common/djangoapps/cors_csrf/tests/test_views.py b/openedx/core/djangoapps/cors_csrf/tests/test_views.py
similarity index 97%
rename from common/djangoapps/cors_csrf/tests/test_views.py
rename to openedx/core/djangoapps/cors_csrf/tests/test_views.py
index c706096d71..f53a937702 100644
--- a/common/djangoapps/cors_csrf/tests/test_views.py
+++ b/openedx/core/djangoapps/cors_csrf/tests/test_views.py
@@ -1,13 +1,14 @@
 """Tests for cross-domain request views. """
+
+import ddt
 import json
 
 from django.test import TestCase
 from django.core.urlresolvers import reverse, NoReverseMatch
 
-import ddt
-
 from config_models.models import cache
-from cors_csrf.models import XDomainProxyConfiguration
+
+from ..models import XDomainProxyConfiguration
 
 
 @ddt.ddt
diff --git a/common/djangoapps/cors_csrf/views.py b/openedx/core/djangoapps/cors_csrf/views.py
similarity index 97%
rename from common/djangoapps/cors_csrf/views.py
rename to openedx/core/djangoapps/cors_csrf/views.py
index c0d7d221c7..17f794bbdc 100644
--- a/common/djangoapps/cors_csrf/views.py
+++ b/openedx/core/djangoapps/cors_csrf/views.py
@@ -5,7 +5,8 @@ from django.conf import settings
 from django.views.decorators.cache import cache_page
 from django.http import HttpResponseNotFound
 from edxmako.shortcuts import render_to_response
-from cors_csrf.models import XDomainProxyConfiguration
+
+from .models import XDomainProxyConfiguration
 
 
 log = logging.getLogger(__name__)