# CSRF token verification failed trying to login after upgrading to 7.2.2 from 6.5.1

**URL:** https://community.zammad.org/t/csrf-token-verification-failed-trying-to-login-after-upgrading-to-7-2-2-from-6-5-1/21394
**Category:** Technical assistance
**Created:** [October 14, 2026, 11:06am UTC](https://community.zammad.org/t/csrf-token-verification-failed-trying-to-login-after-upgrading-to-7-2-2-from-6-5-1/21394 "2026-10-14T11:06:20Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![PaulH9009](https://community.zammad.org/letter_avatar_proxy/v4/letter/p/77aa72/32.png) [@PaulH9009](https://community.zammad.org/u/PaulH9009)
#### Post date: [October 14, 2026, 11:06am UTC](https://community.zammad.org/t/csrf-token-verification-failed-trying-to-login-after-upgrading-to-7-2-2-from-6-5-1/21394/1 "2026-10-14T11:06:20Z")

</div>

### Infos:

Version: 7.2  
Upgrade path:  
6.5.1 → 6.5.4 → 7.0 → 7.1 → 7.2  
Symptoms:

- Microsoft Office 365 login fails
- Local password login fails
- Security token verification failed
- ActionController::InvalidAuthenticityToken
- CSRF token verification failed  
Running in a docker container on an azure vm running Linux (ubuntu 24.04), was all working fine before upgrading, but cannot login now because of the CSRF token verification error.

- Used Zammad version:
- Used Zammad installation type: (source, package, docker-compose, …)
- Operating system:
- Browser + version:

### Expected behavior:

- 

### Actual behavior:

- 

### Steps to reproduce the behavior:

-

---

<div class="post-metadata">

### Author: ![PaulH9009](https://community.zammad.org/letter_avatar_proxy/v4/letter/p/77aa72/32.png) [@PaulH9009](https://community.zammad.org/u/PaulH9009)
#### Post date: [October 14, 2026, 2:12pm UTC](https://community.zammad.org/t/csrf-token-verification-failed-trying-to-login-after-upgrading-to-7-2-2-from-6-5-1/21394/2 "2026-10-14T14:12:08Z")

</div>

Also adding we have also added an Azure VPN Client in front of the VM, so the VM has no longer a public address but our DNS record has been changed to point to the private IP address. After chasing through with AI testing everything it seems to come down to no set\_cookie in the request headers and therefore this is causing the CSRF invalid issue. Bit stuck now and AI is just going round in circles.