# Missing csrf token in request header **URL:** \ **Category:** Community Support\ **Tags:** web-ui\ **Created:** [February 27, 2023, 1:08pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410 "2023-02-27T13:08:39Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jackban](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@jackban](https://community.temporal.io/u/jackban)\ **Post date:** [February 27, 2023, 1:08pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/1 "2023-02-27T13:08:39Z")
I’m using temporal 1.19.1 I met err on temporal-ui when try to “terminate a flow”, “query a flow”. I notice a param of ui “TEMPORAL\_CORS\_ORIGINS”, I kept it default to “[http://localhost:3000](http://localhost:3000)” and my server and ui has independent domain like “[server.fake.com](http://server.fake.com)”, “[ui.fake.com](http://ui.fake.com)”. does it cause the err? ![image](https://us1.discourse-cdn.com/flex016/uploads/temporal/original/2X/7/76d50a53742f8e4b6899eae631a57ff779e28b22.png) ---
**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\ **Post date:** [February 27, 2023, 1:59pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/2 "2023-02-27T13:59:30Z")
Hello @jackban I guess that you have to set TEMPORAL\_CORS\_ORIGINS to the URL where your UI is deployed. The URL making the request ---
**Author:** ![jackban](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@jackban](https://community.temporal.io/u/jackban)\ **Post date:** [February 27, 2023, 3:00pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/3 "2023-02-27T15:00:50Z")
> [@antonio.perez](#): > > TEMPORAL\_CORS\_ORIGINS I have tried set TEMPORAL\_CORS\_ORIGINS to flowing value, it does not work - [http://ui.fake.com:3000](http://ui.fake.com:3000) - [http://ui.fake.com:8080](http://ui.fake.com:8080) - [http://server.fake.com:7233](http://server.fake.com:7233) ---
**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\ **Post date:** [February 27, 2023, 4:34pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/4 "2023-02-27T16:34:00Z")
Hi @jackban I see the ticket is still open [An error occurred while terminating workflow · Issue #793 · temporalio/ui · GitHub](https://github.com/temporalio/ui/issues/793) Apparently, there is a workaround [An error occurred while terminating workflow · Issue #793 · temporalio/ui · GitHub](https://github.com/temporalio/ui/issues/793#issuecomment-1428989724) (I have not tested this) ---
**Author:** ![Fernando\_Gonzalez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/fernando_gonzalez/32/3655_2.png) [@Fernando\_Gonzalez](https://community.temporal.io/u/Fernando_Gonzalez)\ **Post date:** [April 20, 2023, 12:58pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/5 "2023-04-20T12:58:05Z")
In my case the token is missing. The linked github issue is about an invalid one. It’s a different problem. The browser dev tools showed “Cookie “\_csrf” has been rejected because a non-HTTPS cookie can’t be set as “secure”” and indeed my UI interface was not on a secure server. The solution was to install version 2.13.0 ([Release v2.13.0 · temporalio/ui-server · GitHub](https://github.com/temporalio/ui-server/releases/tag/v2.13.0)) which exposes environment to set insecure cookies (TEMPORAL\_CSRF\_COOKIE\_INSECURE=true) ---
**Author:** ![jackban](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@jackban](https://community.temporal.io/u/jackban)\ **Post date:** [August 18, 2023, 12:02pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/6 "2023-08-18T12:02:54Z")
thanks a lot, it works 👏 👏 👏 ---
**Author:** ![Shiny\_Zebalda](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/shiny_zebalda/32/4410_2.png) [@Shiny\_Zebalda](https://community.temporal.io/u/Shiny_Zebalda)\ **Post date:** [October 10, 2023, 9:21am UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/7 "2023-10-10T09:21:01Z")
TEMPORAL\_CSRF\_COOKIE\_INSECURE=true , where i have to enter the command? after installing the ui-server version ---
**Author:** ![rashmi\_sahu1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/rashmi_sahu1/32/5637_2.png) [@rashmi\_sahu1](https://community.temporal.io/u/rashmi_sahu1)\ **Post date:** [July 29, 2024, 9:56am UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/8 "2024-07-29T09:56:13Z")
In the environment variables where you are giving TEMPORAL\_CORS\_ORIGINS ---
**Author:** ![JobaDiniz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jobadiniz/32/6665_2.png) [@JobaDiniz](https://community.temporal.io/u/JobaDiniz)\ **Post date:** [January 15, 2025, 1:26am UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/9 "2025-01-15T01:26:35Z")
Where do I look at the env vars that are available for temporalio/ui docker image? ---
**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\ **Post date:** [December 26, 2025, 4:41pm UTC](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410/10 "2025-12-26T16:41:39Z")
Just for reference for future > Where do I look at the env vars that are available for temporalio/ui docker image? >