From b2d2df8deb3f3fdff48b451d2e748d0bdaf891fc Mon Sep 17 00:00:00 2001 From: Ralf Schmid Date: Mon, 14 Sep 2026 10:26:11 +0200 Subject: [PATCH] Follow-up #901 - Align CSRF troubleshooting with bundled webserver configs Commit 533acef6bd (zammad/zammad#6305) changed the recommended proxy setup: an outer proxy can overwrite X-Forwarded-Proto after Zammad's own Nginx sets it, so the bundled configs now blank Forwarded, X-Forwarded-Scheme and X-Forwarded-Ssl, and the Docker images take NGINX_SERVER_SCHEME=https. Update the 'CSRF Token Errors' troubleshooting section accordingly: describe both causes, add the three blanked headers to the Nginx variant, and point Docker Compose users to the HTTPS scenarios page that #901 already extended. --- getting-started/configure-webserver.rst | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/getting-started/configure-webserver.rst b/getting-started/configure-webserver.rst index ec38650b..08c9f9c4 100644 --- a/getting-started/configure-webserver.rst +++ b/getting-started/configure-webserver.rst @@ -321,20 +321,35 @@ the domain points to the right server: CSRF Token Errors ^^^^^^^^^^^^^^^^^ -If users cannot log in because of CSRF token errors, your webserver -chain may not pass the original connection type to Zammad. Tell the -proxy directly that the connection is HTTPS. +If users cannot log in because of CSRF token errors, the HTTPS scheme +doesn't arrive at Zammad correctly. Two causes are common: the proxy in +front of Zammad doesn't pass the original connection type at all, or an +additional proxy further up the chain overwrites the header afterwards. +Zammad's bundled webserver configuration shows the recommended setup. Nginx Within your virtual host configuration, locate ``proxy_set_header X-Forwarded-Proto`` and replace ``$scheme`` - with ``https``. + with ``https``. If Zammad sits behind another proxy (e.g. an + external load balancer), also blank the headers that such a proxy + can use to overwrite the scheme: + + .. code-block:: nginx + + proxy_set_header Forwarded ""; + proxy_set_header X-Forwarded-Scheme ""; + proxy_set_header X-Forwarded-Ssl ""; Apache 2 Within your virtual host configuration, just above the first ``ProxyPass`` directive, insert: - .. code-block:: text + .. code-block:: apache RequestHeader set X_FORWARDED_PROTO 'https' RequestHeader set X-Forwarded-Ssl on + +If you use the Docker Compose stack instead of your own webserver, the +scenario files already set the ``NGINX_SERVER_SCHEME`` environment +variable for you (see :doc:`the HTTPS scenarios +`).