I have a fresh install of openproject in Debian 10 (using the repo deb https://dl.packager.io/srv/deb/opf/openproject/dev/debian 10 main. 

When trying to log in with admin / admin (or trying to register as new user), there is an error that the CSRF token cannot be validated:

[Fehler 422] Das Cross-Site Request Forgery Token konnte nicht verfiziert werden.

What are possible causes for this problem? What can I do enable some logging?

Configuration is without SSL (yet) using the apacha as installed from the installer openproject reconfigure.

Please first note that you are installing unstable dev packages which are only meant for testing.

You have likely configured something that results in the Rails server responding with either

• https through the SERVER_PROTOCOL or Protocol setting in the system settings set to https, but your server is not actually terminating SSL/TLS yet.
• A different domain in SERVER_HOSTNAME or Host name setting in the system settings for which the cookies are being generated

What does your setup and configuration fromopenproject config look like (redact all password values from that output before publishing here)

Best,

Oliver