CSRF Issue updated config/prod.env

[tmania1216]

After having this issue when trying to login, I fixed the config/prod.env as stated in documentation, for some background I'm using the docker repo, and zerotrust tunnel from cloudflare I updated the config for my domain, and local host ip. I also tried just https://localhost, https://localhost:80 and Im still getting the same issue any help would be greatly appreciated

[rolandgeider]

hi! You mean you've tried the DJANGO_DEBUG "trick"? Usually accessing the app from the different locations (ip, domain, ext) adding the origins does the trick. Can you post the (redacted) value of CSRF_TRUSTED_ORIGINS just in case?

[cwynd]

Hi, I too am having the 'CSRF' issue on a fresh docker install.
DJANGO_DEBUG does indeed show me the expected origin url, which I have placed verbatim in CSRF_TRUSTED_ORIGINS and restarted (several times).

I am trying to run wger on a private network for a few people only, so it is set up on a private IP address on an internal headless server, and HTTP (no S). There is no reverse proxy in front of wger at the moment -- I am trying to keep this simple for limited private use.

Here is my redacted prod.env section:
CSRF_TRUSTED_ORIGINS=http://10.xxx.xxx.xxx:8888

I have added this override file, as described in the manual:

services:
  nginx:
    ports: !override
      - "8888:80"

I have also tried setting X_FORWARDED_PROTO_HEADER_SET=True either with, or without CSRF update, but no success.

Would really appreciate any help or advice.
Thanks

[AntoniyaBK]

Hi! I’d like to help.

I ran into the same problem during my setup and honestly lost a lot of nerves before figuring it out 😄
I hope the steps below save you some time.

1. Update prod.env (Django trusted domains & proxy settings)
   When running wger behind a reverse proxy or a Cloudflare Tunnel, Django must be explicitly told which domains and protocols to trust.
   Make sure your prod.env contains the following (adjust the domain accordingly):

# Proxy / HTTPS settings
X_FORWARDED_PROTO_HEADER_SET=True

# Django settings
DJANGO_DEBUG=False
WGER_USE_GUNICORN=True

# Caching
EXERCISE_CACHE_TTL=18000  # 5 hours (5 * 60 * 60)

# Site configuration
SITE_URL=https://yourdomain.com
DJANGO_ALLOWED_HOSTS=yourdomain.com
DJANGO_CSRF_TRUSTED_ORIGINS=https://yourdomain.com

//Without these settings, you may encounter CSRF errors, redirect loops, or broken HTTPS detection when using Cloudflare or another reverse proxy.

2. Update nginx.conf for Cloudflare Tunnel / reverse proxy
   Below is a working Nginx configuration for running wger behind a Cloudflare Tunnel or any HTTPS-terminating reverse proxy.

upstream wger {
    server web:8000;
}

server {
    listen 80;

    location / {
        proxy_pass http://wger;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_redirect off;
    }

    location /static/ {
        alias /home/wger/static/;
    }

    location /media/ {
        alias /home/wger/media/;
    }

    client_max_body_size 100M;
}

This ensures:
Correct HTTPS handling behind Cloudflare
Proper forwarding of headers to Django
Static and media files are served correctly // For static and media files to work, the volume paths in docker-compose.yml must match the paths used in nginx.conf.

Please let me know if this work for you! :)