starred/ArchiveBox

Fork 0

mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-04-25 17:16:00 +03:00

[GH-ISSUE #1449] Bug: can't set `CSRF_TRUSTED_ORIGINS`, preventing login when behind a load balancer #3883

New issue

Open

opened 2026-03-15 00:50:31 +03:00 by kerem · 4 comments

kerem commented

2026-03-15 00:50:31 +03:00

Owner

Originally created by @ethitter on GitHub (Jun 5, 2024).
Original GitHub issue: https://github.com/ArchiveBox/ArchiveBox/issues/1449

Describe the bug

We're trying to run ArchiveBox in AWS Fargate, with the container accessed via an AWS ALB. We've set ALLOWED_HOSTS to the default of *, but cannot log in due to the CSRF protection on the login page. With debug enabled, we're stuck at this error:

Forbidden (403)
CSRF verification failed. Request aborted.

Reason given for failure:

    Origin checking failed - https://[REDACTED] does not match any trusted origins.

Per the Django docs, we need to set CSRF_TRUSTED_ORIGINS, but that doesn't seem possible right now.

Steps to reproduce

Run ArchiveBox using the dev image, behind load balancer
Set ALLOWED_HOSTS envar to *
Attempt to log in

Screenshots or log output

ArchiveBox version

# archivebox version
0.8.1
ArchiveBox v0.8.1 COMMIT_HASH=ba14ee0 BUILD_TIME=2024-06-04 11:21:00 1717500060
IN_DOCKER=True IN_QEMU=False ARCH=x86_64 OS=Linux PLATFORM=Linux-5.10.216-204.855.amzn2.x86_64-x86_64-with-glibc2.36 PYTHON=Cpython
FS_ATOMIC=True FS_REMOTE=True FS_USER=0:0 FS_PERMS=644
DEBUG=True IS_TTY=True TZ=UTC SEARCH_BACKEND=ripgrep LDAP=False

[i] Dependency versions:
 √  PYTHON_BINARY         v3.11.9         valid     /usr/local/bin/python3.11
 √  SQLITE_BINARY         v2.6.0          valid     /usr/local/lib/python3.11/sqlite3/dbapi2.py
 √  DJANGO_BINARY         v5.0.6          valid     /usr/local/lib/python3.11/site-packages/django/__init__.py
 √  ARCHIVEBOX_BINARY     v0.8.1          valid     /usr/local/bin/archivebox

 √  CURL_BINARY           v8.8.0          valid     /usr/bin/curl
 √  WGET_BINARY           v1.21.3         valid     /usr/bin/wget
 √  NODE_BINARY           v20.14.0        valid     /usr/bin/node
 √  SINGLEFILE_BINARY     v1.1.54         valid     /app/node_modules/single-file-cli/single-file
 √  READABILITY_BINARY    v0.0.11         valid     /app/node_modules/readability-extractor/readability-extractor
 √  MERCURY_BINARY        v1.0.0          valid     /app/node_modules/@postlight/parser/cli.js
 √  GIT_BINARY            v2.39.2         valid     /usr/bin/git
 √  YOUTUBEDL_BINARY      v2024.05.27     valid     /usr/local/bin/yt-dlp
 √  CHROME_BINARY         v125.0.6422.26  valid     /usr/bin/chromium-browser
 √  RIPGREP_BINARY        v13.0.0         valid     /usr/bin/rg

[i] Source-code locations:
 √  PACKAGE_DIR           31 files        valid     /app/archivebox
 √  TEMPLATES_DIR         3 files         valid     /app/archivebox/templates

[i] Data locations:
 √  OUTPUT_DIR            6 files @       valid     /data
 √  CONFIG_FILE           375.0 Bytes     valid     ./ArchiveBox.conf
 √  SQL_INDEX             328.0 KB        valid     ./index.sqlite3
 √  ARCHIVE_DIR           0 files         valid     ./archive
 √  SOURCES_DIR           0 files         valid     ./sources
 √  LOGS_DIR              1 files         valid     ./logs
 X  CACHE_DIR             missing         invalid   ./cache
 X  CUSTOM_TEMPLATES_DIR  missing         invalid   ./templates
 X  PERSONAS_DIR          missing         invalid   ./personas

Originally created by @ethitter on GitHub (Jun 5, 2024). Original GitHub issue: https://github.com/ArchiveBox/ArchiveBox/issues/1449  #### Describe the bug  We're trying to run ArchiveBox in AWS Fargate, with the container accessed via an AWS ALB. We've set `ALLOWED_HOSTS` to the default of `*`, but cannot log in due to the CSRF protection on the login page. With debug enabled, we're stuck at this error: ``` Forbidden (403) CSRF verification failed. Request aborted. Reason given for failure: Origin checking failed - https://[REDACTED] does not match any trusted origins. ``` Per the Django docs, we need to set `CSRF_TRUSTED_ORIGINS`, but that doesn't seem possible right now. #### Steps to reproduce  1. Run ArchiveBox using the `dev` image, behind load balancer 2. Set `ALLOWED_HOSTS` envar to `*` 3. Attempt to log in #### Screenshots or log output  #### ArchiveBox version  ```logs # archivebox version 0.8.1 ArchiveBox v0.8.1 COMMIT_HASH=ba14ee0 BUILD_TIME=2024-06-04 11:21:00 1717500060 IN_DOCKER=True IN_QEMU=False ARCH=x86_64 OS=Linux PLATFORM=Linux-5.10.216-204.855.amzn2.x86_64-x86_64-with-glibc2.36 PYTHON=Cpython FS_ATOMIC=True FS_REMOTE=True FS_USER=0:0 FS_PERMS=644 DEBUG=True IS_TTY=True TZ=UTC SEARCH_BACKEND=ripgrep LDAP=False [i] Dependency versions: √ PYTHON_BINARY v3.11.9 valid /usr/local/bin/python3.11 √ SQLITE_BINARY v2.6.0 valid /usr/local/lib/python3.11/sqlite3/dbapi2.py √ DJANGO_BINARY v5.0.6 valid /usr/local/lib/python3.11/site-packages/django/__init__.py √ ARCHIVEBOX_BINARY v0.8.1 valid /usr/local/bin/archivebox √ CURL_BINARY v8.8.0 valid /usr/bin/curl √ WGET_BINARY v1.21.3 valid /usr/bin/wget √ NODE_BINARY v20.14.0 valid /usr/bin/node √ SINGLEFILE_BINARY v1.1.54 valid /app/node_modules/single-file-cli/single-file √ READABILITY_BINARY v0.0.11 valid /app/node_modules/readability-extractor/readability-extractor √ MERCURY_BINARY v1.0.0 valid /app/node_modules/@postlight/parser/cli.js √ GIT_BINARY v2.39.2 valid /usr/bin/git √ YOUTUBEDL_BINARY v2024.05.27 valid /usr/local/bin/yt-dlp √ CHROME_BINARY v125.0.6422.26 valid /usr/bin/chromium-browser √ RIPGREP_BINARY v13.0.0 valid /usr/bin/rg [i] Source-code locations: √ PACKAGE_DIR 31 files valid /app/archivebox √ TEMPLATES_DIR 3 files valid /app/archivebox/templates [i] Data locations: √ OUTPUT_DIR 6 files @ valid /data √ CONFIG_FILE 375.0 Bytes valid ./ArchiveBox.conf √ SQL_INDEX 328.0 KB valid ./index.sqlite3 √ ARCHIVE_DIR 0 files valid ./archive √ SOURCES_DIR 0 files valid ./sources √ LOGS_DIR 1 files valid ./logs X CACHE_DIR missing invalid ./cache X CUSTOM_TEMPLATES_DIR missing invalid ./templates X PERSONAS_DIR missing invalid ./personas ```

kerem commented

2026-03-15 00:50:37 +03:00

Author

Owner

@dotfrankruan commented on GitHub (Jun 9, 2024):

Same problem here

archivebox-1  | "GET /admin/login/ HTTP/1.0" 200 12531
archivebox-1  | Forbidden (Origin checking failed - https://xxxxxxxx does not match any trusted origins.): /admin/login/
archivebox-1  | "POST /admin/login/ HTTP/1.0" 403 1018

@dotfrankruan commented on GitHub (Jun 9, 2024): Same problem here ``` archivebox-1 | "GET /admin/login/ HTTP/1.0" 200 12531 archivebox-1 | Forbidden (Origin checking failed - https://xxxxxxxx does not match any trusted origins.): /admin/login/ archivebox-1 | "POST /admin/login/ HTTP/1.0" 403 1018 ```

kerem commented

2026-03-15 00:50:42 +03:00

Author

Owner

@carsaig commented on GitHub (Jun 11, 2024):

same issue here. Any suggestions? Pulled it up on two different hosts. No success.

@carsaig commented on GitHub (Jun 11, 2024): same issue here. Any suggestions? Pulled it up on two different hosts. No success.

kerem commented

2026-03-15 00:50:48 +03:00

Author

Owner

@lkubb commented on GitHub (Jun 11, 2024):

same issue here. Any suggestions?

This can be worked around either via https://github.com/ArchiveBox/ArchiveBox/pull/866#issuecomment-2158201512 or by mounting a modified https://github.com/ArchiveBox/ArchiveBox/blob/dev/archivebox/core/settings.py that includes the necessary CSRF_TRUSTED_ORIGINS = ["https://my.archivebox.domain"] over the original inside the container at /app/archivebox/core/settings.py

@lkubb commented on GitHub (Jun 11, 2024): > same issue here. Any suggestions? This can be worked around either via https://github.com/ArchiveBox/ArchiveBox/pull/866#issuecomment-2158201512 or by mounting a modified https://github.com/ArchiveBox/ArchiveBox/blob/dev/archivebox/core/settings.py that includes the necessary `CSRF_TRUSTED_ORIGINS = ["https://my.archivebox.domain"]` over the original inside the container at `/app/archivebox/core/settings.py`

kerem commented

2026-03-15 00:50:53 +03:00

Author

Owner

@nguyenmp commented on GitHub (Oct 21, 2024):

FYI, the environment variable CSRF_TRUSTED_ORIGINS overrides anything in settings.py so when I copied the example docker compose file from the repo, it carried CSRF_TRUSTED_ORIGINS=https://archivebox.example.com with it. I was able to figure it out by going to http://localhost:8000/admin/environment/config/ and reading the actual value set.

@nguyenmp commented on GitHub (Oct 21, 2024): FYI, the environment variable `CSRF_TRUSTED_ORIGINS` overrides anything in `settings.py` so when I copied [the example docker compose file from the repo](https://github.com/ArchiveBox/ArchiveBox/blob/dev/docker-compose.yml#L24), it carried `CSRF_TRUSTED_ORIGINS=https://archivebox.example.com` with it. I was able to figure it out by going to http://localhost:8000/admin/environment/config/ and reading the actual value set.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ArchiveBox#3883

No description provided.

Rows
Columns

[GH-ISSUE #1449] Bug: can't set CSRF_TRUSTED_ORIGINS, preventing login when behind a load balancer #3883

Describe the bug

Steps to reproduce

Screenshots or log output

ArchiveBox version

[GH-ISSUE #1449] Bug: can't set `CSRF_TRUSTED_ORIGINS`, preventing login when behind a load balancer #3883