langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-22 04:25:29 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

CSRF token is missing or invalid #20375

New Issue
Open
opened 2026-02-21 20:07:05 -05:00 by yindo · 9 comments
yindo commented 2026-02-21 20:07:05 -05:00
Owner
Copy Link
Copy Source

Originally created by @trannluongg on GitHub (Nov 18, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.9.2

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

CSRF token is missing or invalid.

Image Image

✔️ Expected Behavior

Running CSRF token

❌ Actual Behavior

No response

Originally created by @trannluongg on GitHub (Nov 18, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.9.2 ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce CSRF token is missing or invalid. <img width="749" height="158" alt="Image" src="https://github.com/user-attachments/assets/37087df5-f991-4227-9564-5ebe51e9b301" /> <img width="1234" height="363" alt="Image" src="https://github.com/user-attachments/assets/17535752-1551-42d7-80a4-6243fa5bf599" /> ### ✔️ Expected Behavior Running CSRF token ### ❌ Actual Behavior _No response_
yindo added the 🐞 bugstale labels 2026-02-21 20:07:05 -05:00
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 18, 2025):

The "CSRF token is missing or invalid" error in Dify v1.9.2 (self-hosted) is often caused by cookie or CORS misconfiguration, especially in setups where the frontend and backend run on different subdomains. Recent updates have made the CSRF cookie domain configurable and improved CORS header handling to ensure the CSRF token is properly sent and validated across subdomains.

To resolve this, check these points:

  • Set the COOKIE_DOMAIN environment variable in your .env files (both backend and frontend) to your base domain (e.g., example.com), without a leading dot. This ensures cookies (including CSRF tokens) are shared between subdomains. See the usage notes in the updated .env.example files for guidance.
  • Make sure your reverse proxy and CORS settings allow the X-CSRF-Token header and support credentials. The backend should include the CSRF token header in the allowed CORS headers for all relevant endpoints.
  • Ensure your frontend is reading and sending the correct CSRF cookie and header. The CSRF token should be present in both the cookie and the X-CSRF-Token header for authenticated requests.
  • If you are running on HTTPS, confirm that the secure flag is set for cookies.

These changes and fixes are included in recent merged pull requests, so upgrading to the latest version and reviewing your configuration should resolve the issue.
See details and code changes here:

If you update your configuration and/or upgrade, this should fix the CSRF token validation errors.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 18, 2025): <!-- Answer --> The "CSRF token is missing or invalid" error in Dify v1.9.2 (self-hosted) is often caused by cookie or CORS misconfiguration, especially in setups where the frontend and backend run on different subdomains. Recent updates have made the CSRF cookie domain configurable and improved CORS header handling to ensure the CSRF token is properly sent and validated across subdomains. To resolve this, check these points: - Set the `COOKIE_DOMAIN` environment variable in your `.env` files (both backend and frontend) to your base domain (e.g., `example.com`), without a leading dot. This ensures cookies (including CSRF tokens) are shared between subdomains. See the usage notes in the updated `.env.example` files for guidance. - Make sure your reverse proxy and CORS settings allow the `X-CSRF-Token` header and support credentials. The backend should include the CSRF token header in the allowed CORS headers for all relevant endpoints. - Ensure your frontend is reading and sending the correct CSRF cookie and header. The CSRF token should be present in both the cookie and the `X-CSRF-Token` header for authenticated requests. - If you are running on HTTPS, confirm that the `secure` flag is set for cookies. These changes and fixes are included in recent merged pull requests, so upgrading to the latest version and reviewing your configuration should resolve the issue. See details and code changes here: - [Configurable cookie domain for CSRF tokens](https://github.com/langgenius/dify/pull/27190) - [CORS header improvements for CSRF](https://github.com/langgenius/dify/pull/27133) - [Frontend and backend CSRF token alignment](https://github.com/langgenius/dify/pull/27190) If you update your configuration and/or upgrade, this should fix the CSRF token validation errors. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/00c835ac-7a52-4305-89c2-047aa055c79d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/00c835ac-7a52-4305-89c2-047aa055c79d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/00c835ac-7a52-4305-89c2-047aa055c79d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/00c835ac-7a52-4305-89c2-047aa055c79d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/00c835ac-7a52-4305-89c2-047aa055c79d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/00c835ac-7a52-4305-89c2-047aa055c79d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/00c835ac-7a52-4305-89c2-047aa055c79d?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28313)
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@yuanzhiwei commented on GitHub (Nov 18, 2025):

这个怎么解决啊， 我更新到最新版本还是有这个问题

@yuanzhiwei commented on GitHub (Nov 18, 2025): 这个怎么解决啊， 我更新到最新版本还是有这个问题
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@water-in-stone commented on GitHub (Nov 18, 2025):

Could you please provide a simple DSL for reproducing this issue?

@water-in-stone commented on GitHub (Nov 18, 2025): Could you please provide a simple DSL for reproducing this issue?
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@yuanzhiwei commented on GitHub (Nov 18, 2025):

Could you please provide a simple DSL for reproducing this issue?能否提供一个简单的 DSL 文件来重现这个问题？

After logging in, all interfaces in the project return 401 Unauthorized. https://github.com/langgenius/dify/issues/28371

@yuanzhiwei commented on GitHub (Nov 18, 2025): > Could you please provide a simple DSL for reproducing this issue?能否提供一个简单的 DSL 文件来重现这个问题？ After logging in, all interfaces in the project return 401 Unauthorized. https://github.com/langgenius/dify/issues/28371
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@yuanzhiwei commented on GitHub (Nov 18, 2025):

Could you please provide a simple DSL for reproducing this issue?能否提供一个简单的 DSL 文件来重现这个问题？

After logging in, all interfaces in the project return 401 Unauthorized. #28371

Fixed, ignore this.

@yuanzhiwei commented on GitHub (Nov 18, 2025): > > Could you please provide a simple DSL for reproducing this issue?能否提供一个简单的 DSL 文件来重现这个问题？ > > After logging in, all interfaces in the project return 401 Unauthorized. [#28371](https://github.com/langgenius/dify/issues/28371) Fixed, ignore this.
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@xsxs89757 commented on GitHub (Nov 19, 2025):

您能否提供一个简单的 DSL 来重现此问题？能否提供一个简单的 DSL 文件来解决此问题？

登录后，项目中的所有接口都返回 401 未授权错误。#28371

已修复，请忽略此信息。

how to fix？

@xsxs89757 commented on GitHub (Nov 19, 2025): > > > 您能否提供一个简单的 DSL 来重现此问题？能否提供一个简单的 DSL 文件来解决此问题？ > > > > > > 登录后，项目中的所有接口都返回 401 未授权错误。[#28371](https://github.com/langgenius/dify/issues/28371) > > 已修复，请忽略此信息。 how to fix？
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jan 16, 2026):

Hi, @trannluongg. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported a "CSRF token is missing or invalid" error in Dify v1.9.2 self-hosted.
  • The issue was linked to cookie domain or CORS misconfigurations.
  • I recommended setting the COOKIE_DOMAIN environment variable and ensuring proper CORS headers and cookie flags.
  • Recent pull requests addressed these configuration issues.
  • The problem was resolved by applying these fixes.

Next Steps:

  • Please confirm if this issue is still relevant with the latest version of Dify by commenting here.
  • If no further updates are provided, this issue will be automatically closed in 15 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Jan 16, 2026): Hi, @trannluongg. I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary:** - You reported a "CSRF token is missing or invalid" error in Dify v1.9.2 self-hosted. - The issue was linked to cookie domain or CORS misconfigurations. - I recommended setting the COOKIE_DOMAIN environment variable and ensuring proper CORS headers and cookie flags. - Recent pull requests addressed these configuration issues. - The problem was resolved by applying these fixes. **Next Steps:** - Please confirm if this issue is still relevant with the latest version of Dify by commenting here. - If no further updates are provided, this issue will be automatically closed in 15 days. Thank you for your understanding and contribution!
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@avincheung commented on GitHub (Jan 19, 2026):

您能否提供一个简单的 DSL 来重现此问题？能否提供一个简单的 DSL 文件来解决此问题？

登录后，项目中的所有接口都返回 401 未授权错误。#28371

已修复，请忽略此信息。

how to fix？

Record my settings to avoid 401 errors:
I'm hosting Dify on a subdomain. Below is my configuration:

CONSOLE_API_URL=https://sub.domain.com/
CONSOLE_WEB_URL=https://sub.domain.com/
SERVICE_API_URL=
TRIGGER_URL=http://localhost/
APP_API_URL=
APP_WEB_URL=

COOKIE_DOMAIN=sub.domain.com
NEXT_PUBLIC_COOKIE_DOMAIN=1

@avincheung commented on GitHub (Jan 19, 2026): > > > > 您能否提供一个简单的 DSL 来重现此问题？能否提供一个简单的 DSL 文件来解决此问题？ > > > > > > > > > 登录后，项目中的所有接口都返回 401 未授权错误。[#28371](https://github.com/langgenius/dify/issues/28371) > > > > > > 已修复，请忽略此信息。 > > how to fix？ Record my settings to avoid 401 errors: I'm hosting Dify on a subdomain. Below is my configuration: CONSOLE_API_URL=https://sub.domain.com/ CONSOLE_WEB_URL=https://sub.domain.com/ SERVICE_API_URL= TRIGGER_URL=http://localhost/ APP_API_URL= APP_WEB_URL= COOKIE_DOMAIN=sub.domain.com NEXT_PUBLIC_COOKIE_DOMAIN=1
yindo commented 2026-02-21 20:07:06 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Feb 20, 2026):

Hi, @trannluongg. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported a "CSRF token is missing or invalid" error in Dify v1.9.2 self-hosted.
  • The error was likely caused by cookie domain or CORS misconfigurations.
  • I provided guidance to set the COOKIE_DOMAIN environment variable and configure CORS headers and cookie flags properly.
  • Recent PRs improved CSRF handling across subdomains, which helped resolve the issue.
  • I asked you to confirm if the problem still persists after applying these fixes.

Next Steps:

  • Please let me know if this issue is still relevant with the latest version of Dify by commenting here.
  • Otherwise, this issue will be automatically closed in 15 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Feb 20, 2026): Hi, @trannluongg. I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary:** - You reported a "CSRF token is missing or invalid" error in Dify v1.9.2 self-hosted. - The error was likely caused by cookie domain or CORS misconfigurations. - I provided guidance to set the COOKIE_DOMAIN environment variable and configure CORS headers and cookie flags properly. - Recent PRs improved CSRF handling across subdomains, which helped resolve the issue. - I asked you to confirm if the problem still persists after applying these fixes. **Next Steps:** - Please let me know if this issue is still relevant with the latest version of Dify by commenting here. - Otherwise, this issue will be automatically closed in 15 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label stale 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#20375
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?