# CSRF warning thrown when logging in

**URL:** <https://datashield.discourse.group/t/csrf-warning-thrown-when-logging-in/481>\
**Category:** Beginner Support\
**Created:** [3 December 2021 14:44 UTC](https://datashield.discourse.group/t/csrf-warning-thrown-when-logging-in/481 "2021-12-03T14:44:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![felixw](https://avatars.discourse-cdn.com/v4/letter/f/59ef9b/32.png) [@felixw](https://datashield.discourse.group/u/felixw)\
**Post date:** [3 December 2021 14:44 UTC](https://datashield.discourse.group/t/csrf-warning-thrown-when-logging-in/481/1 "2021-12-03T14:44:35Z")

</div>

Dear community,

I set up a Opal and DataSHIELD installation with described sample docker compose file in the [docs](https://opaldoc.obiba.org/en/latest/admin/installation.html#docker-image-installation) as a starting point. Locally everything works fine. But when I use the same docker-compose file on a server in my VPN and try to authenticate at `http://MYSERVERDOMAIN:8080` from my local machine the log on is not succesful (the logon page, however, is displayed). In the logs of the opal server container if find the following entry:

`WARN org.obiba.opal.web.security.CSRFInterceptor - CSRF detection: Host=MYSERVERDOMAIN:8080, Referer=http://MYSERVERDOMAIN.charite.de:8080/ui/index.html`.

Although it is warning I assume this is the reason for the unsuccessful login. Is there any additional configuration necessary ?

Thanks in advance

Felix

---

<div class="post-metadata">

**Author:** ![alexwesterberg](https://avatars.discourse-cdn.com/v4/letter/a/9fc29f/32.png) [@alexwesterberg](https://datashield.discourse.group/u/alexwesterberg)\
**Post date:** [3 December 2021 14:47 UTC](https://datashield.discourse.group/t/csrf-warning-thrown-when-logging-in/481/2 "2021-12-03T14:47:27Z")

</div>

Hi Felix, as a first step towards troubleshooting this, could we check what version of Opal you are using? You can determine opal version from the logs generated by docker.

If the version is Opal 4.3, could you try accessing using https on port 8443.

Let me know how it goes!

Cheers, Alex

---

<div class="post-metadata">

**Author:** ![yannick](https://yyz2.discourse-cdn.com/free1/user_avatar/datashield.discourse.group/yannick/32/19_2.png) [@yannick](https://datashield.discourse.group/u/yannick)\
**Post date:** [3 December 2021 16:55 UTC](https://datashield.discourse.group/t/csrf-warning-thrown-when-logging-in/481/3 "2021-12-03T16:55:06Z")

</div>

Hi,

Since Opal 4.3 https connection through network is enforced and CSRF detection requires consistent Host and Referer headers. Accessing Opal through a reverse proxy can help.

Regards Yannick

---

<div class="post-metadata">

**Author:** ![felixw](https://avatars.discourse-cdn.com/v4/letter/f/59ef9b/32.png) [@felixw](https://datashield.discourse.group/u/felixw)\
**Post date:** [6 December 2021 09:57 UTC](https://datashield.discourse.group/t/csrf-warning-thrown-when-logging-in/481/4 "2021-12-06T09:57:01Z")

</div>

Thanks I used 8444 and worked.