Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

403 Forbidden with CSRF verification failed, deploying at Google Cloud Run #7070

Closed
leomaurodesenv opened this issue Feb 13, 2025 · 6 comments
Closed

403 Forbidden with CSRF verification failed, deploying at Google Cloud Run #7070

leomaurodesenv opened this issue Feb 13, 2025 · 6 comments

Comments

@leomaurodesenv
Copy link

leomaurodesenv commented Feb 13, 2025 •
edited
Loading

Describe the bug
I want to deploy my own label-studio instance for research purposes. I have tried to deploy using the "quick button link" Google Cloud Run, located in README.md. The deployment works well, however I am unable to login; I am getting "Forbidden (403) CSRF verification failed. Request aborted."

It seems related to this issue #6606 . However they are using Google Cloud Kubernetes Engine and not Google Cloud Run.

Image

To Reproduce
Steps to reproduce the behavior:

  1. Click on 'Google Cloud Run, located in README.md'
  2. In the Google Cloud Shell Editor
  3. Fill the google cloud informations
[ ? ] Value of DISABLE_SIGNUP_WITHOUT_LINK environment variable (Disable signup for users without invite link) 0
[ ? ] Value of USERNAME environment variable (Username(email) for default user) --email--
[ ? ] Value of PASSWORD environment variable (Password for default user) --password--
  1. Click on the application link
  2. See errorExpected behavior

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

  • Google Cloud Run
  • Label Studio Version 1.15.0

Additional context
Full Google Cloud Run log

Welcome to Cloud Shell! Type "help" to get started.
To set your Cloud Platform project in this session use “gcloud config set project [PROJECT_ID]”
cloudshell_open --repo_url "https://github.com/HumanSignal/label-studio.git" --page "shell" --force_new_clone
leo_mauro_desenv@cloudshell:~$ cloudshell_open --repo_url "https://github.com/HumanSignal/label-studio.git" --page "shell" --force_new_clone
[ ✓ ] Cloned git repository https://github.com/HumanSignal/label-studio.git.
[ ✓ ] Queried list of your projects
[ ? ] Would you like to use existing GCP project study-and-explorations to deploy this app? Yes
[ ✓ ] Enabled Cloud Run API on project study-and-explorations.
[ ? ] Choose a region to deploy this application: us-west1
[ ✓ ] Set up cloud-run-source-deploy in region us-west1 (if it doesn't already exist)
[ ? ] Value of DISABLE_SIGNUP_WITHOUT_LINK environment variable (Disable signup for users without invite link) 0
[ ? ] Value of USERNAME environment variable (Username(email) for default user) --email--
[ ? ] Value of PASSWORD environment variable (Password for default user) --password--
[ ! ] Running command: docker build -f Dockerfile.cloudrun -t $IMAGE_URL .
+ docker build -f Dockerfile.cloudrun -t us-west1-docker.pkg.dev/study-and-explorations/cloud-run-source-deploy/label-studio .
#0 building with "default" instance using docker driver

#1 [internal] load build definition from Dockerfile.cloudrun
#1 transferring dockerfile: 146B done
#1 DONE 0.0s

#2 [internal] load metadata for docker.io/heartexlabs/label-studio:latest
#2 DONE 0.7s

#3 [internal] load .dockerignore
#3 transferring context: 441B done
#3 DONE 0.0s

#4 [1/1] FROM docker.io/heartexlabs/label-studio:latest@sha256:91f547e76d2d6129569adb8da9547220a9247d80e6f2e365b0975edd1a759c92
#4 resolve docker.io/heartexlabs/label-studio:latest@sha256:91f547e76d2d6129569adb8da9547220a9247d80e6f2e365b0975edd1a759c92 0.0s done
#4 sha256:a0ad34dc284c8c5268eafcbbff06dce38fb6976a4b50f08f26f7fcc06f65dc45 12.64kB / 12.64kB done
#4 sha256:8bfa778b5b231c44fb4d35b4783fe69f55f2b3f59dad4c8205661c3f752494a6 0B / 13.65MB 0.1s
#4 sha256:91f547e76d2d6129569adb8da9547220a9247d80e6f2e365b0975edd1a759c92 1.61kB / 1.61kB done
#4 sha256:aa6fe9ff0ae2a25803c33029f481193417d674d2d907a854255a2030cf52a083 4.66kB / 4.66kB done
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 0B / 28.23MB 0.1s
#4 sha256:9b871d410cbf35a95adbe8c061f6d60e2e129bd2fd9b60485a8dd397ee3fcf61 0B / 3.32MB 0.1s
#4 sha256:8bfa778b5b231c44fb4d35b4783fe69f55f2b3f59dad4c8205661c3f752494a6 7.34MB / 13.65MB 0.4s
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 4.19MB / 28.23MB 0.4s
#4 sha256:9b871d410cbf35a95adbe8c061f6d60e2e129bd2fd9b60485a8dd397ee3fcf61 3.32MB / 3.32MB 0.3s done
#4 sha256:8bfa778b5b231c44fb4d35b4783fe69f55f2b3f59dad4c8205661c3f752494a6 13.65MB / 13.65MB 0.5s done
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 10.49MB / 28.23MB 0.6s
#4 sha256:258b25b9265525eaafd659e18f862525eea9e6379dce2ef29defd91ba0b8868c 249B / 249B 0.5s done
#4 sha256:8edb1bc2739011bf33226559ff4a93d02d6675e32886aa63f4ff458e6793ae20 0B / 102B 0.6s
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 12.58MB / 28.23MB 0.7s
#4 sha256:8edb1bc2739011bf33226559ff4a93d02d6675e32886aa63f4ff458e6793ae20 102B / 102B 0.7s done
#4 sha256:3803b46a1013a6cefdc846a3c290a5137d844038ed585cbc4dc474c6a262a3e6 0B / 4.66MB 0.7s
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 18.87MB / 28.23MB 0.9s
#4 sha256:3803b46a1013a6cefdc846a3c290a5137d844038ed585cbc4dc474c6a262a3e6 4.66MB / 4.66MB 0.9s
#4 sha256:857a9a521f0618a8f922e3e9b5981cf762595fa60ba405c92d297eef7d398af6 0B / 1.59MB 0.9s
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 20.97MB / 28.23MB 1.0s
#4 sha256:3803b46a1013a6cefdc846a3c290a5137d844038ed585cbc4dc474c6a262a3e6 4.66MB / 4.66MB 0.9s done
#4 sha256:857a9a521f0618a8f922e3e9b5981cf762595fa60ba405c92d297eef7d398af6 1.59MB / 1.59MB 0.9s done
#4 sha256:9716b0d7cc784f0baa895969624bd2c55661ae32c7550915c8ce235c98858022 0B / 2.26kB 1.0s
#4 sha256:95da657aa13208d0e53b5010660b6a7d1c33f64cf6b3f85713ef96616185056e 0B / 2.84kB 1.0s
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 28.23MB / 28.23MB 1.2s
#4 sha256:9716b0d7cc784f0baa895969624bd2c55661ae32c7550915c8ce235c98858022 2.26kB / 2.26kB 1.0s done
#4 sha256:95da657aa13208d0e53b5010660b6a7d1c33f64cf6b3f85713ef96616185056e 2.84kB / 2.84kB 1.0s done
#4 sha256:eadd1c0656017d8696ef75c6b303dca485cd035e1a1f65a0a5b1b2db1e1ece4b 2.39kB / 2.39kB 1.1s done
#4 sha256:aa7cf45543a562892ee2e0e9dde74d0b6c4bf09a5276c32beb5c1bdda4379875 0B / 102.00kB 1.2s
#4 sha256:cdec109342fca3c2dacfe984305dc357ba08084d291cfc58a8cb6b767c7b3669 0B / 4.51kB 1.2s
#4 sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 28.23MB / 28.23MB 1.2s done
#4 sha256:aa7cf45543a562892ee2e0e9dde74d0b6c4bf09a5276c32beb5c1bdda4379875 102.00kB / 102.00kB 1.2s done
#4 sha256:cdec109342fca3c2dacfe984305dc357ba08084d291cfc58a8cb6b767c7b3669 4.51kB / 4.51kB 1.3s done
#4 extracting sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 0.1s
#4 sha256:36f540f36c8836c6a10df1a54de1a6461b406c24161929965d9cea3a51106913 0B / 4.07kB 1.3s
#4 sha256:c70246cb55ee93ae524c4658a1c4fbd97f2a98a2354b528e582f286340ec0be9 0B / 5.09kB 1.3s
#4 sha256:36f540f36c8836c6a10df1a54de1a6461b406c24161929965d9cea3a51106913 4.07kB / 4.07kB 1.4s done
#4 sha256:c70246cb55ee93ae524c4658a1c4fbd97f2a98a2354b528e582f286340ec0be9 5.09kB / 5.09kB 1.4s done
#4 sha256:59670063d603287846c968746881e5cd6950f6600333f300d32b724ccdf38f81 0B / 6.54kB 1.4s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 0B / 149.18MB 1.4s
#4 sha256:264642e9f6f115a98ff012ac1151e766c14e75db6e8a6d447fecaf81ce492c5b 0B / 420B 1.4s
#4 sha256:59670063d603287846c968746881e5cd6950f6600333f300d32b724ccdf38f81 6.54kB / 6.54kB 1.4s done
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 8.39MB / 149.18MB 1.6s
#4 sha256:264642e9f6f115a98ff012ac1151e766c14e75db6e8a6d447fecaf81ce492c5b 420B / 420B 1.5s done
#4 sha256:ef6f392c754f492201497657b6239f1c97dd8dbaf8bc491372ad7820c8064b17 0B / 9.38MB 1.6s
#4 sha256:0f263cf48e1cac3af8c99d6f296a1271039a384769cb5548358c92a8659cdc42 0B / 350B 1.6s
#4 sha256:ef6f392c754f492201497657b6239f1c97dd8dbaf8bc491372ad7820c8064b17 3.15MB / 9.38MB 1.7s
#4 sha256:ef6f392c754f492201497657b6239f1c97dd8dbaf8bc491372ad7820c8064b17 9.38MB / 9.38MB 1.8s
#4 sha256:0f263cf48e1cac3af8c99d6f296a1271039a384769cb5548358c92a8659cdc42 350B / 350B 1.7s done
#4 sha256:828bb5ad7540170b0deb0338a98e29b2d4c9ab89113e51689310f0693d1d61b8 0B / 378B 1.8s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 16.78MB / 149.18MB 1.9s
#4 sha256:ef6f392c754f492201497657b6239f1c97dd8dbaf8bc491372ad7820c8064b17 9.38MB / 9.38MB 1.8s done
#4 sha256:070e0fba50df04328609d08df8e3253cef271353d5ab5ea24072b9189f8abe35 0B / 411B 1.9s
#4 sha256:828bb5ad7540170b0deb0338a98e29b2d4c9ab89113e51689310f0693d1d61b8 378B / 378B 1.9s done
#4 sha256:070e0fba50df04328609d08df8e3253cef271353d5ab5ea24072b9189f8abe35 411B / 411B 2.0s
#4 sha256:23f4ad84f453d79fc8aad3ca097b9bfba1114e377caa20f4ce8b4e0fd510b4c5 0B / 413B 2.0s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 28.31MB / 149.18MB 2.1s
#4 sha256:070e0fba50df04328609d08df8e3253cef271353d5ab5ea24072b9189f8abe35 411B / 411B 2.0s done
#4 sha256:23f4ad84f453d79fc8aad3ca097b9bfba1114e377caa20f4ce8b4e0fd510b4c5 413B / 413B 2.1s done
#4 sha256:d2582be3f9210ebaecd7c5ff5d819999a57727eb964ccbfa6d0ace8a6ac66c89 0B / 9.65kB 2.1s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 36.70MB / 149.18MB 2.3s
#4 sha256:d2582be3f9210ebaecd7c5ff5d819999a57727eb964ccbfa6d0ace8a6ac66c89 9.65kB / 9.65kB 2.2s done
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 53.48MB / 149.18MB 2.6s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 62.91MB / 149.18MB 2.8s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 74.45MB / 149.18MB 3.1s
#4 extracting sha256:bc0965b23a04fe7f2d9fb20f597008fcf89891de1c705ffc1c80483a1f098e4f 1.9s done
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 87.03MB / 149.18MB 3.3s
#4 extracting sha256:9b871d410cbf35a95adbe8c061f6d60e2e129bd2fd9b60485a8dd397ee3fcf61 0.1s
#4 extracting sha256:9b871d410cbf35a95adbe8c061f6d60e2e129bd2fd9b60485a8dd397ee3fcf61 0.2s done
#4 extracting sha256:8bfa778b5b231c44fb4d35b4783fe69f55f2b3f59dad4c8205661c3f752494a6
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 99.61MB / 149.18MB 3.5s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 111.15MB / 149.18MB 3.7s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 120.59MB / 149.18MB 4.0s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 139.46MB / 149.18MB 4.5s
#4 extracting sha256:8bfa778b5b231c44fb4d35b4783fe69f55f2b3f59dad4c8205661c3f752494a6 1.0s done
#4 extracting sha256:258b25b9265525eaafd659e18f862525eea9e6379dce2ef29defd91ba0b8868c done
#4 extracting sha256:8edb1bc2739011bf33226559ff4a93d02d6675e32886aa63f4ff458e6793ae20 done
#4 extracting sha256:3803b46a1013a6cefdc846a3c290a5137d844038ed585cbc4dc474c6a262a3e6 0.1s
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 149.18MB / 149.18MB 4.8s
#4 extracting sha256:3803b46a1013a6cefdc846a3c290a5137d844038ed585cbc4dc474c6a262a3e6 0.2s done
#4 sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 149.18MB / 149.18MB 5.4s done
#4 extracting sha256:857a9a521f0618a8f922e3e9b5981cf762595fa60ba405c92d297eef7d398af6
#4 extracting sha256:857a9a521f0618a8f922e3e9b5981cf762595fa60ba405c92d297eef7d398af6 0.1s done
#4 extracting sha256:95da657aa13208d0e53b5010660b6a7d1c33f64cf6b3f85713ef96616185056e done
#4 extracting sha256:9716b0d7cc784f0baa895969624bd2c55661ae32c7550915c8ce235c98858022
#4 extracting sha256:9716b0d7cc784f0baa895969624bd2c55661ae32c7550915c8ce235c98858022 done
#4 extracting sha256:eadd1c0656017d8696ef75c6b303dca485cd035e1a1f65a0a5b1b2db1e1ece4b done
#4 extracting sha256:aa7cf45543a562892ee2e0e9dde74d0b6c4bf09a5276c32beb5c1bdda4379875 done
#4 extracting sha256:cdec109342fca3c2dacfe984305dc357ba08084d291cfc58a8cb6b767c7b3669 done
#4 extracting sha256:36f540f36c8836c6a10df1a54de1a6461b406c24161929965d9cea3a51106913
#4 extracting sha256:36f540f36c8836c6a10df1a54de1a6461b406c24161929965d9cea3a51106913 done
#4 extracting sha256:c70246cb55ee93ae524c4658a1c4fbd97f2a98a2354b528e582f286340ec0be9 done
#4 extracting sha256:59670063d603287846c968746881e5cd6950f6600333f300d32b724ccdf38f81 done
#4 extracting sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015
#4 extracting sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 5.1s
#4 extracting sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 10.1s
#4 extracting sha256:1018c9d52111e89c86d105f60a5c902664540f9e0bf3e236c1a07aa5b3689015 11.4s done
#4 extracting sha256:264642e9f6f115a98ff012ac1151e766c14e75db6e8a6d447fecaf81ce492c5b
#4 extracting sha256:264642e9f6f115a98ff012ac1151e766c14e75db6e8a6d447fecaf81ce492c5b done
#4 extracting sha256:ef6f392c754f492201497657b6239f1c97dd8dbaf8bc491372ad7820c8064b17 0.1s
#4 extracting sha256:ef6f392c754f492201497657b6239f1c97dd8dbaf8bc491372ad7820c8064b17 0.4s done
#4 extracting sha256:0f263cf48e1cac3af8c99d6f296a1271039a384769cb5548358c92a8659cdc42
#4 extracting sha256:0f263cf48e1cac3af8c99d6f296a1271039a384769cb5548358c92a8659cdc42 done
#4 extracting sha256:828bb5ad7540170b0deb0338a98e29b2d4c9ab89113e51689310f0693d1d61b8 done
#4 extracting sha256:070e0fba50df04328609d08df8e3253cef271353d5ab5ea24072b9189f8abe35 done
#4 extracting sha256:23f4ad84f453d79fc8aad3ca097b9bfba1114e377caa20f4ce8b4e0fd510b4c5 done
#4 extracting sha256:d2582be3f9210ebaecd7c5ff5d819999a57727eb964ccbfa6d0ace8a6ac66c89 done
#4 DONE 18.4s

#5 exporting to image
#5 exporting layers done
#5 writing image sha256:6877a40abcde58624a98b27baf35fa5eb90f17681ecff8765b202b946e7b44bc done
#5 naming to us-west1-docker.pkg.dev/study-and-explorations/cloud-run-source-deploy/label-studio done
#5 DONE 0.0s
[ ! ] Skipping built-in build methods
[ ! ] FYI, running the following command:
        docker push us-west1-docker.pkg.dev/study-and-explorations/cloud-run-source-deploy/label-studio
[ ✓ ] Pushed container image to Google Container Registry.
[ ! ] FYI, running the following command:
        gcloud run deploy label-studio\
          --project=study-and-explorations\
          --platform=managed\
          --region=us-west1\
          --image=us-west1-docker.pkg.dev/study-and-explorations/cloud-run-source-deploy/label-studio\
          --update-env-vars=DISABLE_SIGNUP_WITHOUT_LINK=0,USERNAME=--email---,PASSWORD=--password--\
          --allow-unauthenticated
[ ✓ ] Successfully deployed service label-studio to Cloud Run.
* This application is billed only when it's handling requests.
* Manage this application at Cloud Console:
        https://console.cloud.google.com/run/detail/us-west1/label-studio?project=study-and-explorations
* Learn more about Cloud Run:
        https://cloud.google.com/run/docs
[ ✓ ] Your application is now live here:
        https://label-studio-xxxxxxxxxxx-uw.a.run.app
leo_mauro_desenv@cloudshell:~$ ^C
leo_mauro_desenv@cloudshell:~$
@heidi-humansignal
Copy link
Collaborator

Hello,

This error typically occurs when Label Studio’s Django CSRF protection doesn’t recognize requests from your Cloud Run URL. Although issue #6606 was originally reported for Kubernetes, the same solution applies to Cloud Run.

Please try the following steps:

1. Set the CSRF_TRUSTED_ORIGINS Environment Variable

Update your deployment to include this variable with your Cloud Run service URL. For example, if your service URL is:
https://label-studio-xxxxxxxxxxx-uw.a.run.app
Then add:

iniCopyEditCSRF_TRUSTED_ORIGINS=https://label-studio-xxxxxxxxxxx-uw.a.run.app

You can update your Cloud Run deployment using the following command:

shCopyEditgcloud run deploy label-studio \ --project=your_project_id \ --platform=managed \ --region=your_region \ --image=your_image_url \ --update-env-vars=DISABLE_SIGNUP_WITHOUT_LINK=0,USERNAME=your_email,PASSWORD=your_password,CSRF_TRUSTED_ORIGINS=https://label-studio-xxxxxxxxxxx-uw.a.run.app \ --allow-unauthenticated

2. Remove Unnecessary Environment Variables

If you’ve set LABEL_STUDIO_HOST, please remove it. In recent versions, this variable is no longer required and may cause conflicts.

3. Verify Headers

Cloud Run automatically manages forwarded headers (such as X-Forwarded-Proto), so no additional configuration is usually needed.
After updating your environment variables, redeploy the service and clear your browser cache (or perform a hard refresh) before attempting to log in again.

Let me know if this resolves the issue or if you need further assistance.
Best regards,

Comment by Oussama Assili
Workflow Run

@leomaurodesenv
Copy link
Author

I tested and it is not working

Image

I did not setup LABEL_STUDIO_HOST

@leomaurodesenv
Copy link
Author

I know that is not recommended to turn off CSRF, but I manage to do it by setup:
Image

Similar to huggingface dockerfile.

@heidi-humansignal
Copy link
Collaborator

Hello,

Could you please apply the following suggestion and let us know if it has helped you bypass this error>

1. Verify CSRF_TRUSTED_ORIGINS
Ensure that the CSRF_TRUSTED_ORIGINS environment variable is set exactly to your service URL without any trailing slash. For example, if your Cloud Run URL is:

https://label-studio-xxxxxxxxxxx-uw.a.run.app

Then you should set:

CSRF_TRUSTED_ORIGINS=https://label-studio-xxxxxxxxxxx-uw.a.run.app

Double-check that the URL you use in your browser exactly matches this entry (including the https scheme).

2. Set Additional Proxy-Related Variables

When deploying behind a load balancer or proxy (as Cloud Run does), Django might require extra settings for forwarded headers. Please update your deployment to include these variables:

USE_X_FORWARDED_HOST=trueUSE_X_FORWARDED_PORT=trueSECURE_PROXY_SSL_HEADER=HTTP_X_FORWARDED_PROTO,https

For example, your deployment command could look like this:

gcloud run deploy label-studio \ --project=your_project_id \ --platform=managed \ --region=your_region \ --image=your_image_url \ --update-env-vars=DISABLE_SIGNUP_WITHOUT_LINK=0,USERNAME=your_email,PASSWORD=your_password,CSRF_TRUSTED_ORIGINS=https://label-studio-xxxxxxxxxxx-uw.a.run.app,USE_X_FORWARDED_HOST=true,USE_X_FORWARDED_PORT=true,SECURE_PROXY_SSL_HEADER="HTTP_X_FORWARDED_PROTO,https" \ --allow-unauthenticated

3. Confirm URL Consistency

Please check that the URL in your CSRF_TRUSTED_ORIGINS exactly matches the URL you use to access the service (no extra characters, trailing slashes, or mismatched schemes). Even a small difference can cause CSRF validation to fail.

4. Review Your Application Logs

It would be helpful to inspect the logs from your Cloud Run instance to see what “Origin” or “Referer” header values Django is receiving. This might reveal if the forwarded header values differ from what your CSRF_TRUSTED_ORIGINS variable expects.

Please let me know if the above has resolved the issue!

Comment by Oussama Assili
Workflow Run

@leomaurodesenv
Copy link
Author

Thank you, it worked!

@heidi-humansignal
Copy link
Collaborator

Great! we are happy to assist you!

Please feel free to reach out if you need help! for now we will close this ticket.

Comment by Oussama Assili
Workflow Run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@leomaurodesenv @heidi-humansignal