# InvalidAuthenticityToken error despite the presence of SSL Certificate

**URL:** <https://discourse.openondemand.org/t/invalidauthenticitytoken-error-despite-the-presence-of-ssl-certificate/4402>\
**Category:** Get Help\
**Tags:** question\
**Created:** [July 31, 2025, 3:41pm UTC](https://discourse.openondemand.org/t/invalidauthenticitytoken-error-despite-the-presence-of-ssl-certificate/4402 "2025-07-31T15:41:15Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [August 22, 2025, 1:34am UTC](https://discourse.openondemand.org/t/invalidauthenticitytoken-error-despite-the-presence-of-ssl-certificate/4402/8 "2025-08-22T01:34:29Z")

</div>

Sorry for the delay in responding.

I was looking at this error specifically and investigating:

```auto
/var/log/ondemand-nginx/<USER>/error.log

...
App 2316025 output: [2025-07-31 09:42:49 -0500] FATAL "[f203c030-5ab1-4711-bf6c-e56e11964548]
[f203c030-5ab1-4711-bf6c-e56e11964548] ActionController::InvalidAuthenticityToken (Can't verify CSRF token authenticity.):
[f203c030-5ab1-4711-bf6c-e56e11964548]

```

Looking around I did find something similar here:

> [@InvalidAuthenticityToken Error when running behind Caddy reverse proxy](https://discourse.openondemand.org/t/invalidauthenticitytoken-error-when-running-behind-caddy-reverse-proxy/4268):
>
> For being able to use LetsEncrypt certificates, I’m running Caddy as a reverse proxy in front of apache2 as the setup for DNS challenge is easy with Caddy. I get a basic OOD installation running without problems. I only had to put OIDCXForwardedHeaders: "X-Forwarded-Host X-Forwarded-Proto" into oidc\_settings of ood\_portal.yml.j2. However, when trying to launch a Jupyter app, I see the following error in my logs: ActionController::InvalidAuthenticityToken (HTTP Origin header (https://ondemand.…

The setting they used to resolve their issue in the `ood_portal.yml` was:

```yaml
custom_location_directives:
  - 'RequestHeader set X-Forwarded-Proto "https"'

```

And looking at the request header you shared above I’m not seeing that set at the moment. Try that with a restart of `httpd` and hopefully that moves you all along.

---

_[View the full topic](https://discourse.openondemand.org/t/invalidauthenticitytoken-error-despite-the-presence-of-ssl-certificate/4402)._