# Fresh install 3.2.x: CSRF token verification failed
**URL:** https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080
**Category:** Technical assistance
**Created:** [September 11, 2019, 7:53am UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080 "2019-09-11T07:53:15Z")
**Posts on this page:** 10
**Page:** 3
### Author:  [@SimonO](https://community.zammad.org/u/SimonO)
#### Post date: [February 13, 2020, 12:28am UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/41 "2020-02-13T00:28:34Z")
I also have a fresh install on ubuntu with nginx.
Tried both: changing to “https” instead of “$scheme” and this fix with “map […] $real\_scheme”.
I still have the CSRF token failure.
Does anybody have an idea?
Thanks!
Simon
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [February 13, 2020, 7:01pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/42 "2020-02-13T19:01:31Z")
> [@SimonO](#):
>
> Does anybody have an idea?
No.
Please provide your configuration files.
My forecasting is really bad today.
---
### Author:  [@SimonO](https://community.zammad.org/u/SimonO)
#### Post date: [February 13, 2020, 10:09pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/43 "2020-02-13T22:09:55Z")
Okay, I tried different options of zammad.conf
First with “https” instead of “$scheme”:
> ```
> location /ws {
> proxy_http_version 1.1;
> proxy_set_header Upgrade $http_upgrade;
> proxy_set_header Connection "Upgrade";
> proxy_set_header CLIENT_IP $remote_addr;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
>
> proxy_set_header X-Forwarded-Proto https;
>
> proxy_read_timeout 86400;
> proxy_pass http://zammad-websocket;
> }
>
> location / {
> proxy_set_header Host $http_host;
> proxy_set_header CLIENT_IP $remote_addr;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
>
> proxy_set_header X-Forwarded-Proto https;
>
> proxy_read_timeout 300;
> proxy_pass http://zammad-railsserver;
>
> gzip on;
> gzip_types text/plain text/xml text/css image/svg+xml application/javascript applicat$
> gzip_proxied any;
> }
>
> ```
>
> }
Second with “$real scheme”: [look here](https://github.com/zammad/zammad/pull/2863/commits/15fe6785dc195c90243cced9f5660203964e76eb)
So this is somewhere:
> ```
> map $http_x_forwarded_proto $real_scheme {
> default $http_x_forwarded_proto;
> '' $scheme;
> }
>
> ```
And after that locations /
> ```
> location /ws {
> proxy_http_version 1.1;
> proxy_set_header Upgrade $http_upgrade;
> proxy_set_header Connection "Upgrade";
> proxy_set_header CLIENT_IP $remote_addr;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
>
> proxy_set_header X-Forwarded-Proto $real_scheme;
>
> proxy_read_timeout 86400;
> proxy_pass http://zammad-websocket;
> }
>
> location / {
> proxy_set_header Host $http_host;
> proxy_set_header CLIENT_IP $remote_addr;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
>
> proxy_set_header X-Forwarded-Proto $real_scheme;
>
> proxy_read_timeout 300;
> proxy_pass http://zammad-railsserver;
>
> gzip on;
> gzip_types text/plain text/xml text/css image/svg+xml application/javascript applicat$
> gzip_proxied any;
> }
>
> ```
>
> }
Third with letsencypt [as instructed here (german)](https://www.howtoforge.de/anleitung/so-richten-sie-das-zammad-ticketing-system-unter-ubuntu-1604-ein/)
> #
>
> # this is the nginx config for zammad
>
> #
>
> upstream zammad {
> server localhost:3000;
> }
>
> upstream zammad-websocket {
> server localhost:6042;
> }
>
> # Added - Automatically redirect HTTP to HTTPS Nginx
>
> server {
> listen 80;
> server\_name kontakt.“domain”.de;
> return 301 https://$host$request\_uri;
> }
>
> # Added - HTTPS configuration for Zammad
>
> server {
> listen 443 http2 ssl;
>
> ssl\_certificate /etc/letsencrypt/live/kontakt.“domain”.de//fullchain.pem;
> ssl\_certificate\_key /etc/letsencrypt/live/kontakt.“domain”.de/privkey.pem;
> ssl\_protocols TLSv1 TLSv1.1 TLSv1.2;
> ssl\_prefer\_server\_ciphers on;
> ssl\_ciphers “EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH”;
> ssl\_ecdh\_curve secp384r1;
> ssl\_session\_cache shared:SSL:10m;
> ssl\_session\_tickets off;
> ssl\_stapling on;
> ssl\_stapling\_verify on;
> resolver 8.8.8.8 8.8.4.4 valid=300s;
> resolver\_timeout 5s;
> add\_header Strict-Transport-Security “max-age=63072000; includeSubdomains”;
> add\_header X-Frame-Options DENY;
> add\_header X-Content-Type-Options nosniff;
>
> # replace ‘localhost’ with your fqdn/domain name if you want to use zammad from remote
>
> server\_name kontakt.“domain”.de;
>
> root /opt/zammad/public;
>
> access\_log /var/log/nginx/zammad.access.log;
> error\_log /var/log/nginx/zammad.error.log;
>
> client\_max\_body\_size 50M;
>
> location ~ ^/(assets/|robots.txt|humans.txt|favicon.ico) {
> expires max;
> }
>
> location /ws {
> proxy\_http\_version 1.1;
> proxy\_set\_header Upgrade $http\_upgrade;
> proxy\_set\_header Connection “Upgrade”;
> proxy\_set\_header CLIENT\_IP $remote\_addr;
> proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;
> proxy\_read\_timeout 86400;
> proxy\_pass [http://zammad-websocket](http://zammad-websocket);
> }
>
> location / {
> proxy\_set\_header Host $http\_host;
> proxy\_set\_header CLIENT\_IP $remote\_addr;
> proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;
> proxy\_read\_timeout 180;
> proxy\_pass [http://zammad](http://zammad);
>
> gzip on;
> gzip\_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
> gzip\_proxied any;
> }
> }
Thanks for any help!
Simon
---
### Author:  [@SimonO](https://community.zammad.org/u/SimonO)
#### Post date: [February 16, 2020, 5:48pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/44 "2020-02-16T17:48:19Z")
I just set up a new server (Ubuntu on a AWS EC2 Instance) and used the last zammd.conf from above (with letsencypt).
Result is the same: I could do the initial Setup and login twice.
But at the third login I get the CSRF error.
Strange…
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [February 17, 2020, 2:01pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/45 "2020-02-17T14:01:20Z")
> [@SimonO](#):
>
> location /ws {
> proxy\_http\_version 1.1;
> proxy\_set\_header Upgrade $http\_upgrade;
> proxy\_set\_header Connection “Upgrade”;
> proxy\_set\_header CLIENT\_IP $remote\_addr;
> proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;
> proxy\_read\_timeout 86400;
> proxy\_pass [http://zammad-websocket](http://zammad-websocket);
> }
>
> location / {
> proxy\_set\_header Host $http\_host;
> proxy\_set\_header CLIENT\_IP $remote\_addr;
> proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;
> proxy\_read\_timeout 180;
> proxy\_pass [http://zammad](http://zammad);
>
> gzip on;
> gzip\_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
> gzip\_proxied any;
> }
If you tried it with exactly these directives it can’t work, as the scheme is completely missing…!
You’re missing `proxy_set_header X-Forwarded-Proto https;` in both directives.
As described here (point 2.1.2): [Zammad 3.2 is available](https://community.zammad.org/t/zammad-3-2-is-available/3656)
---
### Author:  [@SimonO](https://community.zammad.org/u/SimonO)
#### Post date: [February 17, 2020, 4:17pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/46 "2020-02-17T16:17:25Z")
Thank you!
For now it is working, let’s see how long it will take for the next CSRF failure :-/
What I tried before:
Using Apache2 instead of nginx.
Worked perfect, until I did a snapshot so that I could try some stuff without loosing all my work.
After running the snapshot (that was working before) on a new instance, I got the CSRF error again.
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [February 18, 2020, 1:51pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/47 "2020-02-18T13:51:10Z")
> [@SimonO](#):
>
> After running the snapshot (that was working before) on a new instance, I got the CSRF error again.
the “on a new instance part” is proberbly your issue.
But honestly, black box so that’s absolute fishing in the dark.
---
### Author:  [@csaeum](https://community.zammad.org/u/csaeum)
#### Post date: [March 4, 2020, 2:18pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/48 "2020-03-04T14:18:58Z")
Hello i just got the mistake
use Zammad under Docker but with traffic for subdomain and LetsEnCrypt.
Which headers do you have to add to fix the error?
Have ever tried “X-Forwarded-Proto: https” but the error remains.
If I still need some, I don’t want to touch the container myself, so I’m looking for the right Traefik settings
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [March 4, 2020, 5:50pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/49 "2020-03-04T17:50:09Z")
You’ve already posted your own thread:
> [@Docker Treafik - csrf token validation failed](https://community.zammad.org/t/docker-treafik-csrf-token-validation-failed/4144):
>
> Hello I am running Zammad with Docker. In order to be able to use the domain and LetsEnCrypt I have this running with Traefik. Now I get everything displayed well and when I log in for the first time everything works. After an initial logout, I can no longer log in. He then always reports “csrf token validation failed”
Please don’t push your issues with several posts in several places with hoping someone will help you faster that way.
Please don’t get me wrong, but this draws people busy on the same topic more than needed.
I thus will lock this thread to ensure that’s not happening. 🙂
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [March 4, 2020, 5:50pm UTC](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080/50 "2020-03-04T17:50:15Z")
[Previous page](https://community.zammad.org/t/fresh-install-3-2-x-csrf-token-verification-failed/3080.md?page=2)