# CSRF login error after upgrade to 2.5.0.beta4

**URL:** <https://meta.discourse.org/t/csrf-login-error-after-upgrade-to-2-5-0-beta4/150423>\
**Category:** Support\
**Created:** [May 5, 2020, 10:51am UTC](https://meta.discourse.org/t/csrf-login-error-after-upgrade-to-2-5-0-beta4/150423 "2020-05-05T10:51:49Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![Thomas\_Rother](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/thomas_rother/32/423597_2.png) [@Thomas\_Rother](https://meta.discourse.org/u/Thomas_Rother)\
**Post date:** [June 7, 2020, 7:11am UTC](https://meta.discourse.org/t/csrf-login-error-after-upgrade-to-2-5-0-beta4/150423/6 "2020-06-07T07:11:47Z")

</div>

Unfortunately the problem is still **not** solved here. Login fails with “unknown error” and upon each try I see this in the log:

```
root@develd:/var/discourse# tail -f /var/log/discourse-rails/production.log
Processing by SessionController#csrf as JSON
Completed 200 OK in 1ms (Views: 0.1ms | Allocations: 351)
Started POST "/session" for 127.0.0.1 at 2020-06-07 06:58:19 +0000
Processing by SessionController#create as */*
  Parameters: {"login"=>"admin", "password"=>"[FILTERED]", "second_factor_method"=>"1", "timezone"=>"Europe/Berlin"}
Can't verify CSRF token authenticity.
  Rendering text template
  Rendered text template (Duration: 0.0ms | Allocations: 1)
Filter chain halted as :verify_authenticity_token rendered or redirected
Completed 403 Forbidden in 2ms (Views: 0.8ms | ActiveRecord: 0.0ms | Allocations: 1100)
Started GET "/session/csrf" for 127.0.0.1 at 2020-06-07 07:00:45 +0000
Processing by SessionController#csrf as JSON
Completed 200 OK in 1ms (Views: 0.2ms | Allocations: 351)
Started POST "/session" for 127.0.0.1 at 2020-06-07 07:00:45 +0000
Processing by SessionController#create as */*
  Parameters: {"login"=>"admin", "password"=>"[FILTERED]", "second_factor_method"=>"1", "timezone"=>"Europe/Berlin"}
Can't verify CSRF token authenticity.
  Rendering text template
  Rendered text template (Duration: 0.0ms | Allocations: 1)
Filter chain halted as :verify_authenticity_token rendered or redirected
Completed 403 Forbidden in 2ms (Views: 0.9ms | Allocations: 1100)

```

The app.yml has

```
## Any custom commands to run after building
run:
  - exec: echo "Beginning of custom commands"
  ## If you want to set the 'From' email address for your first registration, uncomment and change:
  ## After getting the first signup email, re-comment the line. It only needs to run once.
  ## - exec: rails r "SiteSetting.notification_email='noreply-discourse@netzwissen.de'"
  - replace:
      filename: /etc/nginx/conf.d/discourse.conf
      from: "types {"
      to: |
        set_real_ip_from 127.0.0.0/24;
        real_ip_header X-Forwarded-For;
        real_ip_recursive on;
        types {
  - exec: echo "End of custom commands"

```

as it was recommended in [https://meta.discourse.org/t/haproxy-and-discourse-ip-issue/92387](https://meta.discourse.org/t/haproxy-and-discourse-ip-issue/92387)

---

_[View the full topic](https://meta.discourse.org/t/csrf-login-error-after-upgrade-to-2-5-0-beta4/150423)._