# Troubleshooting "BAD CSRF" error on initial site setup?

**URL:** <https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059>\
**Category:** Self-hosting\
**Created:** [September 12, 2018, 5:23pm UTC](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059 "2018-09-12T17:23:19Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![Lee\_Ars](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lee_ars/32/1597_2.png) [@Lee\_Ars](https://meta.discourse.org/u/Lee_Ars)\
**Post date:** [September 12, 2018, 9:50pm UTC](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059/16 "2018-09-12T21:50:16Z")

</div>

> [@Falco](#):
>
> And SSL termination happens at HAProxy, right? Is the HAProxy config the same for both sites? With same header injection?

Exact same—traffic for both sites is going through the same haproxy `frontend` and same `backend`. Not doing any header injection with haproxy—in fact, I’m using HAproxy in TCP mode so that I can pass traffic via `proxy-protocol-v2` to varnish, which lets me offer full HTTP/2 from the nginx reverse proxy at the bottom of the stack.

I do response header injection via varnish (hsts, referrer-policy, x-frame-options, x-content-type-options, a few others), and request header injection (like x-forwarded-protocol) with nginx.

edit - I totally understand the limits of free support—if this is going to turn complicated, I’ll bang on it a while on my own this weekend when I’ve got some spare time (and more importantly, some latitude to break things a bit). My hope was that this was going to be something really simple—and it still might be!—but I don’t want to be a pain.

---

_[View the full topic](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059)._