I am having problems. I had Openproject configured with ssl but then after my managment said they want to switch to http. I reconfigured Openproject to run without ssl. But now many systems but not all get the 

[Error 422] Unable to verify Cross-Site Request Forgery token.

Maybe I am missing something. What would be all the steps from switching from https config to http?

Many thanks for your reply.

Hi Jänis,

either your OpenProject or your external server is still terminating SSL or treating the request as HTTPS.

If OpenProject assumes the request is HTTPS, it will output cookies with a flag that prohibits them from being sent outside HTTPS. If your connection is now non-SSL, the cookie gets lost and you end up with the error you're seeing.

Please run openproject reconfigure and unset the SSL configuration. Then, ensure that openproject config does not contain any of these:

• SERVER_PROTOCOL_HTTPS_NO_HSTS=true
• SERVER_PROTOCOL_FORCE_HTTPS=true
• SERVER_PROTOCOL=https
• OPENPROJECT_RAILS__FORCE__SSL=true

Also, test that the protocol is not https:

openproject run bundle exec rails runner "puts Setting.protocol" should yield 'http'.

Best

Oliver

Oliver Günther wrote:

Hi Jänis,

either your OpenProject or your external server is still terminating SSL or treating the request as HTTPS.

If OpenProject assumes the request is HTTPS, it will output cookies with a flag that prohibits them from being sent outside HTTPS. If your connection is now non-SSL, the cookie gets lost and you end up with the error you're seeing.

Please run openproject reconfigure and unset the SSL configuration. Then, ensure that openproject config does not contain any of these:

• SERVER_PROTOCOL_HTTPS_NO_HSTS=true
• SERVER_PROTOCOL_FORCE_HTTPS=true
• SERVER_PROTOCOL=https
• OPENPROJECT_RAILS__FORCE__SSL=true

Also, test that the protocol is not https:

openproject run bundle exec rails runner \"puts Setting.protocol\" should yield 'http'.

Best

Oliver

Many thanks @Oliver for your response. Cannot overstate how greatful I am.

I did what you told me.

Here is the output:

root@jr:~# openproject config
ADMIN_EMAIL=janis.roze@autokada.lv
APP_GROUP=openproject
APP_HOME=/opt/openproject
APP_NAME=openproject
APP_RUNNER_CLI=systemctl
APP_RUNNER_TYPE=systemd
APP_SAFE_NAME=openproject
APP_USER=openproject
APP_WIZARDS=legacy-installer,openproject-edition,postgres,apache2,repositories,smtp,memcached,openproject
ATTACHMENTS_STORAGE_PATH=/var/db/openproject/files
DATABASE_URL=postgres://openproject:ZQO6wB0KOOsumQZt4anvWjrRW7taAUiB@127.0.0.1:45432/openproject
EMAIL_DELIVERY_METHOD=smtp
EXECJS_RUNTIME=Node
GEM_PATH=/opt/openproject/vendor/bundle/ruby/2.7.0:
GIT_REPOSITORIES=
HOME=/home/openproject
HOST=127.0.0.1
LANG=en_US.UTF-8
MALLOC_ARENA_MAX=2
MEMORY_AVAILABLE=14336
NODE_ENV=production
NODE_HOME=/opt/openproject/.heroku/node
OLDPWD=/
OPENPROJECT_INSTALLATION__TYPE=packager
OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE=none
OPENPROJECT_WEB_WORKERS=5
ORIGINAL_PWD=/root
PATH=bin:/opt/openproject/vendor/bundle/bin:/opt/openproject/vendor/bundle/ruby/2.7.0/bin:/opt/openproject/.heroku/node/bin:/opt/openproject/.heroku/yarn/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/sbin:/opt/openproject/bin:/opt/openproject/node_modules/.bin
PORT=6000
PWD=/opt/openproject
RACK_ENV=production
RAILS_CACHE_STORE=file_store
RAILS_ENV=production
RAILS_LOG_TO_STDOUT=enabled
RAILS_SERVE_STATIC_FILES=enabled
ROOT_PATH=/
SECRET_KEY_BASE=ca650da76072ed6ebedc3f96db013a59c023a308228d340106abf8ad24487409a44e805a82ce99f73795922af4798b9125592f4d066e284839c47f8b2d6b2ad8
SECRET_TOKEN=ca650da76072ed6ebedc3f96db013a59c023a308228d340106abf8ad24487409a44e805a82ce99f73795922af4798b9125592f4d066e284839c47f8b2d6b2ad8
SERVER_GROUP=www-data
SERVER_HOSTNAME=jr.aknet.local
SERVER_PATH_PREFIX=/
SERVER_PATH_PREFIX_PREVIOUS=/
SERVER_PROTOCOL=http
SERVER_USER=www-data
SHLVL=0
SMTP_AUTHENTICATION=login
SMTP_DOMAIN=
SMTP_ENABLE_STARTTLS_AUTO=true
SMTP_HOST=zm.aknet.eu
SMTP__OPENSSL__VERIFY__MODE=none
SMTP_OPENSSL_VERIFY_MODE=none
SMTP_PASSWORD=0991AkubazD
SMTP_PORT=587
SMTP_SSL=true
SMTP_URL=smtp://janis.roze%40autokada.lv:0991AkubazD@zm.aknet.eu:587/
SMTP_USERNAME=janis.roze@autokada.lv
SVN_REPOMAN_TOKEN=OnMQcAKnLXxl2Dak9W2EOODMvZsfxmH5
SVN_REPOMAN_URL=http://127.0.0.1/repoman_svn
SVN_REPOSITORIES=
SYS_API_KEY=U8F78J24G9yp6AXe5G0qcKAPuFG6rT2n
WEB_CONCURRENCY=4
WEB_MEMORY=512
WEB_TIMEOUT=300
root@jr:~# openproject run bundle exec rails runner "puts Setting.protocol"
http

But still I am experiencing the same error! The thing is weird:

PC1:

• chrome: ok
• Vivaldi: not ok
• Vivaldi in private: ok
• Firefox: ok

PC2(not connected to the system ever before):

• chrome: not ok
• Firefox: not ok

It seems random thats why I cannot pinpoint the problem.