Missing csrf token in request header

I’m using temporal 1.19.1

I met err on temporal-ui when try to “terminate a flow”, “query a flow”.

I notice a param of ui “TEMPORAL_CORS_ORIGINS”, I kept it default to “http://localhost:3000” and my server and ui has independent domain like “server.fake.com”, “ui.fake.com”. does it cause the err?

Hello @jackban

I guess that you have to set TEMPORAL_CORS_ORIGINS to the URL where your UI is deployed. The URL making the request

I have tried set TEMPORAL_CORS_ORIGINS to flowing value, it does not work

Hi @jackban

I see the ticket is still open An error occurred while terminating workflow · Issue #793 · temporalio/ui · GitHub

Apparently, there is a workaround An error occurred while terminating workflow · Issue #793 · temporalio/ui · GitHub (I have not tested this)

In my case the token is missing. The linked github issue is about an invalid one. It’s a different problem. The browser dev tools showed “Cookie “_csrf” has been rejected because a non-HTTPS cookie can’t be set as “secure”” and indeed my UI interface was not on a secure server.

The solution was to install version 2.13.0 (Release v2.13.0 · temporalio/ui-server · GitHub) which exposes environment to set insecure cookies (TEMPORAL_CSRF_COOKIE_INSECURE=true)

1 Like

thanks a lot, it works :clap: :clap: :clap:

TEMPORAL_CSRF_COOKIE_INSECURE=true , where i have to enter the command?
after installing the ui-server version