# Can't Login to Discourse - CSRF Token Authenticity
**URL:** https://meta.discourse.org/t/cant-login-to-discourse-csrf-token-authenticity/54081
**Category:** Support
**Created:** [12월 11, 2016, 8:07오전 UTC](https://meta.discourse.org/t/cant-login-to-discourse-csrf-token-authenticity/54081 "2016-12-11T08:07:20Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@mbryantms](https://meta.discourse.org/u/mbryantms)
#### Post date: [12월 11, 2016, 8:07오전 UTC](https://meta.discourse.org/t/cant-login-to-discourse-csrf-token-authenticity/54081/1 "2016-12-11T08:07:20Z")
I began working towards installing the WP-Discourse plugin when I happened to logout and now I haven’t been able to log back in. I was working towards testing and unifying Wordpress and Discourse’s sign in systems. Unfortunately, now when I login currently, I get the following error in `log/production.log`
```plaintext
==> log/production.log <==
Started GET "/session/csrf?_=148144248215" for XX.XX.XX.XX at 2016-12-11 07:45:44 +0000
Processing by SessionController#csrf as */*
Parameters: {"_"=>"1481442183487"}
Completed 200 OK in 1ms (Views: 0.2ms | ActiveRecord: 0.0ms)
Started POST "/session" for XX.XX.XX.XX at 2016-12-11 07:45:44 +0000
Processing by SessionController#create as */*
Parameters: {"login"=>"username", "password"=>"[FILTERED]"}
Can't verify CSRF token authenticity
Rendered text template (0.0ms)
Filter chain halted as :verify_authenticity_token rendered or redirected
Completed 403 Forbidden in 9ms (Views: 3.4ms | ActiveRecord: 0.0ms)
```
_(I changed the csrf tokens in both areas above manually as I am fairly certain they aren’t security risks but didn’t want to take any chances with the real thing - the two areas above match in the production log)._
I have tried looking on this Discourse, StackOverflow, Google, Ruby on Rails support (b/c I believe it’s a Rails issue) and other areas and am not sure how I can restore login functionality.
Things I have tried:
1. Rebuilding app
2. Deleting browser cookies, cache data, etc.
3. Using another browser / InPrivate/Incognito browsers
4. Creating a new user, which gets the same error and can’t login
5. Admin rake command to recreate / create admin users
Online direction so far has been related to API mismatch and recommends pulling the API key through a web address json file and then using that to submit the request. This doesn’t seem related to logging in…but it definitely looks like something isn’t matching up.
Edit:
I tracked it down finally…this post threw me for a loop:
> [@Login - Can't verify CSRF token authenticity](https://meta.discourse.org/t/login-cant-verify-csrf-token-authenticity/41181):
>
> Hi, when I am logging in, sometimes I get this error. It would result in me unable to login at all. Any idea how does this error come from? This result in the inability to even login to discourse. I, [2016-03-17T17:05:20.078871 #4141] INFO -- : Started POST "/session" for 127.0.0.1 at 2016-03-17 17:05:20 +0800 I, [2016-03-17T17:05:20.134365 #4141] INFO -- : Processing by SessionController#create as \*/\* I, [2016-03-17T17:05:20.136184 #4141] INFO -- : Parameters: {"login"=\>"xx@gmail.com", "…
But it lead me to this post which actually solved it for me:
> [@403 Forbidden on Logins (started after update to latest version)](https://meta.discourse.org/t/403-forbidden-on-logins-started-after-update-to-latest-version/52800):
>
> as i wanted to try out the new android app i also thought it to be a great idea to update the board to the latest version. v1.7.0.beta7 +83. andi also updated to the latest docker\_manager version. the android client worked nicely, great work guys thumbsup but then i started to realize some odd behaviors. other users confirmed the problems. white_check_mark chrome (linux): i can still post and do everything (i won’t logout tho, it’s my last working login) no_entry opera (linux…
The resolution involved adding the following line to the nginx discourse config:
`proxy_set_header X-Forwarded-Proto https;`
Then after that it’s a simple:
```plaintext
sudo nginx -t
sudo systemctl reload nginx
```
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [6월 28, 2017, 2:20오전 UTC](https://meta.discourse.org/t/cant-login-to-discourse-csrf-token-authenticity/54081/2 "2017-06-28T02:20:01Z")