# CSRF on /login security alert from security scans

**URL:** <https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667>\
**Category:** Self-hosting\
**Created:** [December 19, 2018, 1:23pm UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667 "2018-12-19T13:23:42Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [December 19, 2018, 1:34pm UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667/2 "2018-12-19T13:34:27Z")

</div>

You mention that GitHub OAuth is not possible due to your firewall, so I’m not sure what the logs are supposed to be illustrating. The CSRF error on GitHub login would be expected if you have not configured it correctly.

> [@jlaura](#):
>
> All went well, except for a missing CSFR protection on /login

What do you mean by this? If you’re being told this by an automated security scanner, then it is very likely to be a false positive.

---

_[View the full topic](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667)._