Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Invalid CSRF token with Docker Compose setup

Open
  • Is something wrong?
#423 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
30/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
docker, docker-compose, mariadb, redis
Domain
authentication, infrastructure

Research direction

Start by reproducing the login flow with the supplied Docker Compose configuration, noting that the default account succeeds while the newly created account fails and /quickstart remains authenticated. Compare the behavior with wallabag/docker#397 and check the Cloudflare and Traefik-proxied setup; done means the new account can sign in without an Invalid CSRF Token.

Written by the indexing model from the issue text.

Description

I'm having a slightly similar problem to this issue: https://github.com/wallabag/docker/issues/397

I just setup Wallabag with docker compose as follows:

services:
  wallabag:
    image: wallabag/wallabag
    container_name: wallabag-server
    env_file: ./wallabag.env
    volumes:
      - ./data/app/images:/var/www/wallabag/web/assets/images
    networks:
      - traefik
      - wallabag
    restart: unless-stopped
    labels:
      - "diun.enable=true"

      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.routers.wallabag.rule=Host(`wallabag.example.com`)"
      - "traefik.http.routers.wallabag.entrypoints=https"
      - "traefik.http.routers.wallabag.tls.certResolver=letls"
    healthcheck:
      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost/api/info"]
      interval: 1m
      timeout: 3s
    depends_on:
      - db
      - redis
  db:
    image: mariadb
    container_name: wallabag-db
    restart: unless-stopped
    env_file: ./wallabag.env
    volumes:
      - ./data/db:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
      interval: 20s
      timeout: 3s
    networks:
      - wallabag
    labels:
      - "diun.enable=true"
  redis:
    image: redis:alpine
    container_name: wallabag-redis
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 20s
      timeout: 3s
    networks:
      - wallabag
    labels:
      - "diun.enable=true"
networks:
  traefik:
    external: true
    name: traefik
  wallabag:
    external: true
    name: wallabag

I can log in with the default wallabag username and password (with no Invalid CSRF Token), I created another account, signed out and attempted to sign in, but get: Invalid CSRF Token. It goes back to the log in page. However, if a go to https://wallabag.example.com/quickstart - my new user is signed in.

My setup is behind Cloudflare.

Dominant language
Shell
Stars
771
Forks
168
No merged PRs in 30d

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from wallabag/docker

All issues in wallabag/docker

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.