# Solved: Bad CSRF when trying to use HTTPS

**URL:** https://meta.discourse.org/t/solved-bad-csrf-when-trying-to-use-https/88116
**Category:** Self-hosting
**Created:** [May 22, 2018, 9:53am UTC](https://meta.discourse.org/t/solved-bad-csrf-when-trying-to-use-https/88116 "2018-05-22T09:53:26Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Miguel\_David](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@Miguel\_David](https://meta.discourse.org/u/Miguel_David)
#### Post date: [May 22, 2018, 9:53am UTC](https://meta.discourse.org/t/solved-bad-csrf-when-trying-to-use-https/88116/1 "2018-05-22T09:53:26Z")

</div>

I have setup discourse with the following stack:

- Cloudflare (free plan, SSL and CDN)
- AWS Application Load Balancer (not free, does termination of SSL)
- AWS EC2 t2.small server
- This guide [discourse/docs/INSTALL-cloud.md at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/master/docs/INSTALL-cloud.md)

I wanted the website to be https (who does http anymore?), but quickly banged my head against the wall.

Solutions I found:

- do NOT install [docker.io](http://docker.io) from the apt Ubuntu repositories as it is not supported
- do NOT add cloudflare template to app.yml
- remove the lines everybody is saying to add: `proxy_set_header X-Forwarded-Proto https;` or as per template `proxy_set_header X-Forwarded-Proto $thescheme;`

The reason for the last two is that I was getting a Bad CSRF and the reason was (probably) because proxy headers were being changed mid-stream.

I hope this helps somebody not avoid all the time I wasted with what should be a simple one container setup.

---

<div class="post-metadata">

### Author: ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 22, 2018, 9:55am UTC](https://meta.discourse.org/t/solved-bad-csrf-when-trying-to-use-https/88116/2 "2018-05-22T09:55:51Z")

</div>

> [@Miguel\_David](#):
>
> - do NOT install [docker.io](http://docker.io) from the apt Ubuntu repositories as it is not supported
> - do NOT add cloudflare template to app.yml
> - remove the lines everybody is saying to add: `proxy_set_header X-Forwarded-Proto https;` or as per template `proxy_set_header X-Forwarded-Proto $thescheme;`

Those aren’t solutions! those are workarounds with lethal conclusions!  
Be prepared for rate limit lockouts! 😉