# csrf Forbidden on install behind nginx reverse proxy **URL:** \ **Category:** AWX Project\ **Tags:** windows, awx\ **Created:** [May 19, 2023, 4:24pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012 "2023-05-19T16:24:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Nathaniel\_M\_GoodBloc](https://avatars.discourse-cdn.com/v4/letter/n/f04885/32.png) [@Nathaniel\_M\_GoodBloc](https://forum.ansible.com/u/Nathaniel_M_GoodBloc)\ **Post date:** [May 19, 2023, 4:24pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/1 "2023-05-19T16:24:21Z")
Thank you for looking at this. I am very new to kubes and awx. I Installed awx-operator from devel branch. When I go to log in now, I get a error “Error logging in.” kubectl logs -f deployments/awx-web -c awx-web 0.244.0.1 - - [19/May/2023:15:40:50 +0000] “GET /api/login/ HTTP/1.0” 200 5710 “[https://awx.myserver.com/](https://awx.myserver.com/)” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36” “-” [pid: 37|app: 0|req: 23/114] 10.244.0.1 () {64 vars in 1320 bytes} [Fri May 19 15:40:50 2023] GET /api/login/ =\> generated 5710 bytes in 176 msecs (HTTP/1.0 200) 10 headers in 460 bytes (1 switches on core 0) 2023-05-19 15:40:50,493 WARNING [0652b6c133e642d58498550ce562ebd3] django.security.csrf Forbidden (Origin checking failed - [https://awx.myserver.com](https://awx.myserver.com) does not match any trusted origins.): /api/login/ [pid: 37|app: 0|req: 24/115] 10.244.0.1 () {70 vars in 1475 bytes} [Fri May 19 15:40:50 2023] POST /api/login/ =\> generated 1019 bytes in 51 msecs (HTTP/1.0 403) 7 headers in 276 bytes (1 switches on core 0) 10.244.0.1 - - [19/May/2023:15:40:50 +0000] “POST /api/login/ HTTP/1.0” 403 1019 “[https://awx.myserver.com/](https://awx.myserver.com/)” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36” “-” I made a new user with password with “kubectl exec awx-operator-controller-manager-845fcfddfd-lm5kc – --container -it awx-manage createsuperuser” awx-operator 2.2.1. awx.yml — apiVersion: [awx.ansible.com/v1beta1](http://awx.ansible.com/v1beta1) kind: AWX metadata: name: awx spec: ingress\_type: ingress hostname: [awx.myserver.com](http://awx.myserver.com) csrf\_cookie\_secure: ‘False’ service\_type: nodeport On the host, nginx reverse proxy is installed with a certbot cert for [awx.myserver.com](http://awx.myserver.com). Can you help me with the reverse proxy setup? I’m sure it’s some easy TLS thing, but I can’t seem to get it right because of my unfamiliarity with the project. ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [May 19, 2023, 7:18pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/2 "2023-05-19T19:18:04Z")
there is a known issue around this. You might fix this by adding your proxy server name to the CSRF\_TRUSTED\_ORIGINS, e.g. CSRF\_TRUSTED\_ORIGINS = [‘[https://awx.myserver.com](https://awx.myserver.com)’] I tried passing that into extra\_settings via the operator but couldn’t figure out the write way to get it to render correctly 😕 We plan to add this as a setting in the API ---
**Author:** ![Nathaniel\_M\_GoodBloc](https://avatars.discourse-cdn.com/v4/letter/n/f04885/32.png) [@Nathaniel\_M\_GoodBloc](https://forum.ansible.com/u/Nathaniel_M_GoodBloc)\ **Post date:** [May 19, 2023, 7:43pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/3 "2023-05-19T19:43:44Z")
where do I add it? ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [May 19, 2023, 7:57pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/4 "2023-05-19T19:57:40Z")
it is a django setting generally the way to pass it is through the extra\_settings on the AWX spec [https://github.com/ansible/awx-operator#extra-settings](https://github.com/ansible/awx-operator#extra-settings) but because this list of strings it is tricky to get the exact syntax right ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [May 20, 2023, 1:00am UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/5 "2023-05-20T01:00:45Z")
okay you can it via extra settings like this extra\_settings: - setting: CSRF\_TRUSTED\_ORIGINS value: - [https://localhost:3001](https://localhost:3001) give that a shot ---
**Author:** ![Nathaniel\_M\_GoodBloc](https://avatars.discourse-cdn.com/v4/letter/n/f04885/32.png) [@Nathaniel\_M\_GoodBloc](https://forum.ansible.com/u/Nathaniel_M_GoodBloc)\ **Post date:** [May 23, 2023, 3:06pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/6 "2023-05-23T15:06:50Z")
Sadly, I’ve tried every way I can to add CSRF\_TRUSTED\_ORIGINS and can’t seem to get django to NOT error in this way. I don’t want awx-operator to handle my nginx. I have my own reverse proxy. ---
**Author:** ![Nathaniel\_M\_GoodBloc](https://avatars.discourse-cdn.com/v4/letter/n/f04885/32.png) [@Nathaniel\_M\_GoodBloc](https://forum.ansible.com/u/Nathaniel_M_GoodBloc)\ **Post date:** [May 23, 2023, 3:22pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/7 "2023-05-23T15:22:07Z")
I also get django.request Not Found: /.well-known/acme-challenge/A0DTIVLvld2sTIgGjhtOWfc4iIltKus2HYY-rRTsZH8 errors. ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [May 24, 2023, 7:43pm UTC](https://forum.ansible.com/t/csrf-forbidden-on-install-behind-nginx-reverse-proxy/38012/8 "2023-05-24T19:43:43Z")
_can’t seem to get django to NOT error in this way_ what errors are you seeing? here are some other users with the same problem, it seems passing the CSRF\_TRUSTED\_ORIGINS helped in their case [https://github.com/ansible/awx/issues/14024#issuecomment-1557919352](https://github.com/ansible/awx/issues/14024#issuecomment-1557919352)