at 2017-01-27 19:16:46 +0000
Processing by SessionController#create as */*
Parameters: {"login"=>"username", "password"=>"[FILTERED]"}
Can't verify CSRF token authenticity
Rendered text template (0.0ms)
Filter chain halted as :verify_authenticity_token rendered or redirected
```
It has been like this for a few days, I think since updating to 1.7.0. I’ve installed the 1.7.1 fix but it didn’t help. Trying now with the 1.7.2, but by the looks of the diff, this issue isn’t fixed there.
edit: Yep, no change with 1.7.2.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 27, 2017, 8:34pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/3 "2017-01-27T20:34:36Z")
This is usually because you are doing an internal proxy but not setting the https forwarding headers in your proxy.
(If your site is https)
---
### Author:  [@Frey](https://meta.discourse.org/u/Frey)
#### Post date: [January 27, 2017, 8:34pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/4 "2017-01-27T20:34:38Z")
yeah, I also have seen CSRF-related errors in the console.
---
### Author:  [@Frey](https://meta.discourse.org/u/Frey)
#### Post date: [January 27, 2017, 8:35pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/5 "2017-01-27T20:35:20Z")
I’ve enabled force https, but got CSRF error when tried to disable it.
---
### Author:  [@Maakuth](https://meta.discourse.org/u/Maakuth)
#### Post date: [January 27, 2017, 9:05pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/6 "2017-01-27T21:05:59Z")
> [@codinghorror](#):
>
> This is usually because you are doing an internal proxy but not setting the https forwarding headers in your proxy.
Oh, indeed! This was fixed by adding to my Apache proxy configuration:
```plaintext
RequestHeader set X-Forwarded-Proto "https"
```
Thanks a lot for help. Quite interesting that this only begun to happen in the 1.7 series.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 28, 2017, 12:53am UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/7 "2017-01-28T00:53:03Z")
> [@Maakuth](#):
>
> Quite interesting that this only begun to happen in the 1.7 series.
We didn’t had secure cookies before so that wasn’t a problem.
---
### Author:  [@Frey](https://meta.discourse.org/u/Frey)
#### Post date: [January 28, 2017, 6:11am UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/8 "2017-01-28T06:11:25Z")
> [@Frey](#):
>
> I’ve enabled force https, but got CSRF error when tried to disable it.
Just in case anybody got in the same situation:
1. SSH to server
2. `cd /var/discourse`
3. `./launcher enter app`
4. `rails c`
5. `SiteSetting.force_https = false`
6, 7, 8. `exit`
---
### Author:  [@cloudunicorn](https://meta.discourse.org/u/cloudunicorn)
#### Post date: [February 15, 2018, 3:00pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/9 "2018-02-15T15:00:53Z")
> [@Frey](#):
>
> SiteSetting.force\_https = false
My users just started seeing “403 Unknown Error” when trying to log in. I followed these instructions - but I’m now getting an error in the admin settings: " \* Your website is using SSL. But `[force_https](https://movermaker.com/admin/site_settings/category/all_results?filter=force_https)` is not yet enabled in your site settings."
I am using the Digital Ocean app setup with nothing custom, and ‘v2.0.0.beta2 +170’. Is this because I’m using a beta version?
---
### Author:  [@cloudunicorn](https://meta.discourse.org/u/cloudunicorn)
#### Post date: [February 23, 2018, 5:49pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/10 "2018-02-23T17:49:04Z")
Not fun, this is still happening to users - getting “Unknown Error” when trying to log in, and **403 Forbidden** error when trying to reset password. I’m now on current Discourse.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 24, 2018, 12:32am UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/11 "2018-02-24T00:32:33Z")
Yet again, as said upstream ↑
> [@codinghorror](#):
>
> This is usually because you are doing an internal proxy but not setting the proper https forwarding headers in your proxy. (If your site is https)
---
### Author:  [@cloudunicorn](https://meta.discourse.org/u/cloudunicorn)
#### Post date: [February 24, 2018, 4:48pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/12 "2018-02-24T16:48:33Z")
Hm, k. No idea what that means. So Digital Ocean one-click install has this issue…
This appears to be the suggested fix:
> [@Frey](#):
>
> SSH to server
> cd /var/discourse
> ./launcher enter app
> rails c
>
> SiteSetting.force\_https = false
>
> 6, 7, 8. exit
I did that, but users kept having the same issue. How do I check if I am ‘doing an internal proxy’? We’re using Cloudflare + Digital Ocean.
---
### Author:  [@ryanerwin](https://meta.discourse.org/u/ryanerwin)
#### Post date: [April 24, 2018, 8:33am UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/13 "2018-04-24T08:33:29Z")
> [@Frey](#):
>
> SiteSetting.force\_https = false
Thanks @Frey. I has having the same problem with a restore I did from one server to another.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 8, 2024, 12:37pm UTC](https://meta.discourse.org/t/users-cant-sign-in-due-to-403-error/56449/14 "2024-06-08T12:37:30Z")
This topic was automatically closed after 2689 days. New replies are no longer allowed.