403 Forbidden with CSRF verification failed after updating label-sutdio version [GKE] [helm chart]

[ArmandXUuu]

Describe the bug
Our team has a LabelStudio deployment via helm chart on a Google (Cloud) Kubernetes Engine

After trying to bump the docker image version from 1.13.1 to 1.14.0 users could no longer login with an error saying "Forbidden (403) CSRF verification failed" (see screenshot)

To Reproduce About our implementation
We used this chart:

helm repo add heartex https://charts.heartex.com/
helm repo update heartex

with custom values.yaml + image heartexlabs/label-studio:1.14.0

...
global:
  image:
    repository: heartexlabs/label-studio
    pullPolicy: IfNotPresent
    # tag: "1.13.1"
    tag: "1.14.0"
...
  extraEnvironmentVars:
    EXPERIMENTAL_FEATURES: 1
    LABEL_STUDIO_HOST: "https://labelstudio.ourdomain.com"
    DJANGO_CSRF_TRUSTED_ORIGINS: "https://labelstudio.ourdomain.com" # yeah that's my desperate attempt
    SSRF_PROTECTION_ENABLED: "true"

Other values remain nearly the same as here

Expected behavior
A user should be able to login without any problem

Screenshots

Environment:

• OS:
  • Client: MacOS 15.1, Safari / Ubuntu, Firefox
  • K8s: Google Kubernetes Engine 1.29.8-gke.1278000
• Label Studio Version: 1.14.0

Additional context
I'd be happy to provide more information.

[CertainPassenger]

Same issue here. Label Studio deployed in our Kubernetes Cluster. After the upgrade from 1.13.2 to 1.14.0, using Edge or Firefox in Linux results in the CSRF validation failed error.

[jombooth]

Quick debugging step: does it work if you specify CSRF_TRUSTED_ORIGINS instead of DJANGO_CSRF_TRUSTED_ORIGINS?

[CertainPassenger]

I've already wanted to say that it also didn't work using CSRF_TRUSTED_ORIGINS, since we tried it already. But we've taken another look at the source code for parsing the CSRF_TRUSTED_ORIGINS in https://github.com/HumanSignal/label-studio/blob/develop/label_studio/core/settings/base.py#L700-L702 and seen that we've set the env variable wrong. Using the following snippet, it's now working for us:

env:
  - name: CSRF_TRUSTED_ORIGINS
    value: "https://example-a.com,https://example-b.com"

[farioas]

LABEL_STUDIO_HOST is no longer required, can you try with unset LABEL_STUDIO_HOST and CSRF_TRUSTED_ORIGINS env vars?

[ArmandXUuu]

LABEL_STUDIO_HOST is no longer required, can you try with unset LABEL_STUDIO_HOST and CSRF_TRUSTED_ORIGINS env vars?

Thank you for your reply, I just tried with removing LABEL_STUDIO_HOST and CSRF_TRUSTED_ORIGINS but it still doesn't work.

[ArmandXUuu]

Quick debugging step: does it work if you specify CSRF_TRUSTED_ORIGINS instead of DJANGO_CSRF_TRUSTED_ORIGINS?

In fact it works ! Thank you !
I've got:

global:
...
  extraEnvironmentVars:
    EXPERIMENTAL_FEATURES: 1
    CSRF_TRUSTED_ORIGINS: "https://labelstudio.ourdomain.com"
    SSRF_PROTECTION_ENABLED: "true"
...

[ArmandXUuu]

My problem solved, I close this issue, thank you all !

[shhivam]

I am on Label Studio 1.14.0 and I am facing the same problem.

LABEL_STUDIO_HOST does nothing, the documentation needs to be updated, I think.

After specifying the following variables, it worked.

EXPERIMENTAL_FEATURES: 1
CSRF_TRUSTED_ORIGINS: "https://labelstudio.ourdomain.com"
SSRF_PROTECTION_ENABLED: "true"

[prestonzen]

I added these flags but I still have the same CRSF error

[m4tej241]

Hello guys, can someone tell me where can I change these variables? I can't find the file. Thanks

[ArmandXUuu]

Hello guys, can someone tell me where can I change these variables? I can't find the file. Thanks

Hey @m4tej241. It depends on how you implement labelstudio. In my case I use officiel helm chart to deploy on Kubernetes. The configurations can be added in global.extraEnvironmentVars.

helm repo add heartex https://charts.heartex.com/
helm repo update
helm upgrade --install labelstudio heartex/label-studio -n prod -f prod/label-studio.yaml

---

The goal is to create/modify environment variables, for more information you can refer to this doc:
https://labelstud.io/guide/start#Set-environment-variables

[m4tej241]

Hello @ArmandXUuu I just cloned the github repo and that's it. Is it possible to include it inside .env file that I have in the web folder?

[m4tej241]

It got fixxed for me when I firstly run the backend server and log in and then turn the frontend server aswell. Before I was starting the frontend while being on the log screen with backend and that caused the error when I tried logging on the frontend server. Hopefully this makes sense to some of you. Take care