# Getting CSRF error when logging in to AWX Operator

**URL:** <https://forum.ansible.com/t/getting-csrf-error-when-logging-in-to-awx-operator/5790>\
**Category:** Get Help\
**Tags:** kubernetes, awx-operator, awx\
**Created:** [May 13, 2024, 8:32pm UTC](https://forum.ansible.com/t/getting-csrf-error-when-logging-in-to-awx-operator/5790 "2024-05-13T20:32:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![virtualhobbit](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/virtualhobbit/32/2015_2.png) [@virtualhobbit](https://forum.ansible.com/u/virtualhobbit)\
**Post date:** [May 13, 2024, 8:32pm UTC](https://forum.ansible.com/t/getting-csrf-error-when-logging-in-to-awx-operator/5790/1 "2024-05-13T20:32:46Z")

</div>

I have exported my old 17.1.0 PostgreSQL database and deployed a fresh 2.16.1 AWX Operator. All task and web pods come up correctly, and the database migration container completes successfully.

I have retrieved my admin password from the awx-admin-password secret (it was the same one I configured), however, I am unable to login.

I see the following error in the awx-web pods:

2024-05-13 15:47:47,776 WARNING [95ff42d1d82648e0aa003d8c78e06a90] django.security.csrf Forbidden (CSRF token missing.): /api/login/

Does anyone know why this would happen?

Many thanks.

---

<div class="post-metadata">

**Author:** ![gundalow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gundalow/32/99_2.png) [@gundalow](https://forum.ansible.com/u/gundalow)\
**Post date:** [May 14, 2024, 9:19am UTC](https://forum.ansible.com/t/getting-csrf-error-when-logging-in-to-awx-operator/5790/2 "2024-05-14T09:19:07Z")

</div>

Hi,  
Older GitHub issue, but does [CORS errors after upgrading to AWX 22.3.0 · Issue #14024 · ansible/awx · GitHub](https://github.com/ansible/awx/issues/14024#issuecomment-1650090658) help?

---

<div class="post-metadata">

**Author:** ![virtualhobbit](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/virtualhobbit/32/2015_2.png) [@virtualhobbit](https://forum.ansible.com/u/virtualhobbit)\
**Post date:** [May 14, 2024, 1:48pm UTC](https://forum.ansible.com/t/getting-csrf-error-when-logging-in-to-awx-operator/5790/3 "2024-05-14T13:48:19Z")

</div>

Unfortunately not. Added the domain to the extra settings, redeployed and delete the web pods. No joy.

Exact error is:

2024-05-14 13:28:45,474 WARNING [3fc21d82e56f4f17bc3d9d58a58499be] django.security.csrf Forbidden (CSRF token missing.): /api/login/

---

<div class="post-metadata">

**Author:** ![virtualhobbit](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/virtualhobbit/32/2015_2.png) [@virtualhobbit](https://forum.ansible.com/u/virtualhobbit)\
**Post date:** [May 14, 2024, 7:03pm UTC](https://forum.ansible.com/t/getting-csrf-error-when-logging-in-to-awx-operator/5790/4 "2024-05-14T19:03:16Z")

</div>

[https://ansible.readthedocs.io/projects/awx-operator/en/latest/user-guide/advanced-configuration/csrf-cookie-secure-setting.html](https://ansible.readthedocs.io/projects/awx-operator/en/latest/user-guide/advanced-configuration/csrf-cookie-secure-setting.html)

Does anyone know if this turns CSRF checking off?

spec:  
csrf\_cookie\_secure: ‘False’

If so, after I add this to my AWX object and reapply, is there anything else I have to do to apply it?