InvalidAuthenticityToken error despite the presence of SSL Certificate

[travert (Travis Ravert)]

Sorry for the delay in responding.

I was looking at this error specifically and investigating:

/var/log/ondemand-nginx/<USER>/error.log

...
App 2316025 output: [2025-07-31 09:42:49 -0500 ] FATAL "[f203c030-5ab1-4711-bf6c-e56e11964548]
[f203c030-5ab1-4711-bf6c-e56e11964548] ActionController::InvalidAuthenticityToken (Can't verify CSRF token authenticity.):
[f203c030-5ab1-4711-bf6c-e56e11964548]

Looking around I did find something similar here:

InvalidAuthenticityToken Error when running behind Caddy reverse proxy

For being able to use LetsEncrypt certificates, I’m running Caddy as a reverse proxy in front of apache2 as the setup for DNS challenge is easy with Caddy. I get a basic OOD installation running without problems. I only had to put OIDCXForwardedHeaders: "X-Forwarded-Host X-Forwarded-Proto" into oidc_settings of ood_portal.yml.j2. However, when trying to launch a Jupyter app, I see the following error in my logs: ActionController::InvalidAuthenticityToken (HTTP Origin header (https://ondemand.…

The setting they used to resolve their issue in the ood_portal.yml was:

custom_location_directives:
  - 'RequestHeader set X-Forwarded-Proto "https"'

And looking at the request header you shared above I’m not seeing that set at the moment. Try that with a restart of httpd and hopefully that moves you all along.