# Missing csrf token when terminate workflow on temporal ui

**URL:** <https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716>\
**Category:** Community Support\
**Tags:** web-ui\
**Created:** [December 13, 2022, 8:49am UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716 "2022-12-13T08:49:06Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![whitecrow](https://avatars.discourse-cdn.com/v4/letter/w/50afbb/32.png) [@whitecrow](https://community.temporal.io/u/whitecrow)\
**Post date:** [December 13, 2022, 8:49am UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/1 "2022-12-13T08:49:06Z")

</div>

First of all, I server temporal ui under a sub path, following the directions here:

> **[ui-server/docker at main · temporalio/ui-server - Serve UI under a sub-path](https://github.com/temporalio/ui-server/tree/main/docker#serve-ui-under-a-sub-path)**
>
> main/docker

It works fine for the viewing part. But when I tried to terminate a workflow, the operation failed with a message:  
“missing csrf token in request header” .

I’ve submitted an issue to ui-server project:

> <https://github.com/temporalio/ui-server/issues/261>
>
> \### What are you really trying to do?
> 
> \<!-- 
> serve temporal ui under a sub pa…th
> https://github.com/temporalio/ui-server/tree/main/docker#serve-ui-under-a-sub-path
> \--\>
> 
> \### Describe the bug
> Error happens when we try to "Terminate" a workflow on the UI. 
> The error message is:
> "missing csrf token in request header"
> 
> \### Minimal Reproduction
> 
> 1. build an image following the directions here: https://github.com/temporalio/ui-server/tree/main/docker#serve-ui-under-a-sub-path
> 2. start the temporal ui server
> 3. visit the ui page
> 4. select a running workflow, go to its details, click the "Terminate" button
> 5. the termination would fail with a message: "missing csrf token in request header".
> 
> \### Environment/Versions
> 
> 
> 
> \- OS and processor: \[e.g. M1 Mac, x86 Windows, Linux\]
> \- Temporal Version: \[e.g. 1.14.0?\] and/or SDK version
> \- Are you using Docker or Kubernetes or building Temporal from source?
> 
> \### Additional context

But still I want to know if there is a quick workaround.

---

<div class="post-metadata">

**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\
**Post date:** [December 13, 2022, 1:57pm UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/2 "2022-12-13T13:57:22Z")

</div>

hi @whitecrow

Thank you, I am not able to reproduce this.

I have created the docker image `docker build --build-arg TEMPORAL_PUBLIC_PATH=/custom-path -t temporal-ui-public-path .`

And to run temporal with this UI I have changed the `temporal-ui` from this [docker compose](https://github.com/temporalio/docker-compose/blob/main/docker-compose.yml)

```auto
  temporal-ui:
    container_name: temporal-ui
    depends_on:
      - temporal
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CORS_ORIGINS=http://localhost:3000
      - TEMPORAL_PUBLIC_PATH=/custom-path
    image: temporal-ui-public-path
    networks:
      - temporal-network
    ports:
      - 8080:8080

```

Terminating workflows from the UI works for me.

how are you starting the UI?

---

<div class="post-metadata">

**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\
**Post date:** [December 13, 2022, 2:04pm UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/3 "2022-12-13T14:04:14Z")

</div>

I see that there is an open issue in the UI repo related to terminating workflows, but the error message is different, do you think it could be related? [An error occurred while terminating workflow · Issue #793 · temporalio/ui · GitHub](https://github.com/temporalio/ui/issues/793)

---

<div class="post-metadata">

**Author:** ![whitecrow](https://avatars.discourse-cdn.com/v4/letter/w/50afbb/32.png) [@whitecrow](https://community.temporal.io/u/whitecrow)\
**Post date:** [December 13, 2022, 2:26pm UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/4 "2022-12-13T14:26:07Z")

</div>

I deploy temporal server&ui on k8s, too.  
Here are my deployment yaml config:

```auto
apiVersion: apps/v1
kind: Deployment
metadata:
  name: temporal-web-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: temporal-web
  template:
    metadata:
      labels:
        app: temporal-web
    spec:
      containers:
        - name: temporal-web
          image: my-temporal-ui-image:2.8.x
          env:
            - name: LANG
              value: "en_US.UTF-8"
            - name: TEMPORAL_ADDRESS
              value: temporal-server:7233
            - name: TEMPORAL_CORS_ORIGINS
              value: http://localhost:3000
            - name: TEMPORAL_PUBLIC_PATH
              value: /svc-temporal-web
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 500m

```

---

<div class="post-metadata">

**Author:** ![whitecrow](https://avatars.discourse-cdn.com/v4/letter/w/50afbb/32.png) [@whitecrow](https://community.temporal.io/u/whitecrow)\
**Post date:** [December 13, 2022, 2:58pm UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/5 "2022-12-13T14:58:18Z")

</div>

@antonio.perez  
Is there any relation to the ENV config TEMPORAL\_CORS\_ORIGINS?  
I just found it worked fine if I visit my ui through localhost instead of a public IP .

---

<div class="post-metadata">

**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\
**Post date:** [December 13, 2022, 5:00pm UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/6 "2022-12-13T17:00:53Z")

</div>

not sure about that. Let me ask internally!

---

<div class="post-metadata">

**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\
**Post date:** [December 13, 2022, 7:02pm UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/7 "2022-12-13T19:02:38Z")

</div>

Hi @whitecrow ,

You have to set TEMPORAL\_CORS\_ORIGINS to the same url that you will be terminating from. (I guess the public IP)

Let me know if it works.

---

<div class="post-metadata">

**Author:** ![whitecrow](https://avatars.discourse-cdn.com/v4/letter/w/50afbb/32.png) [@whitecrow](https://community.temporal.io/u/whitecrow)\
**Post date:** [December 14, 2022, 2:57am UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/8 "2022-12-14T02:57:52Z")

</div>

@antonio.perez  
I tried but it did not work.  
The official image works fine with TEMPORAL\_CORS\_ORIGINS unchanged. So I think this problem is related to the subpath mechanism.

---

<div class="post-metadata">

**Author:** ![jackban](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@jackban](https://community.temporal.io/u/jackban)\
**Post date:** [February 27, 2023, 8:17am UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/9 "2023-02-27T08:17:44Z")

</div>

> [@whitecrow](#):
>
> I tried but it did not work.

+1

solved now?

---

<div class="post-metadata">

**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\
**Post date:** [February 27, 2023, 2:00pm UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/11 "2023-02-27T14:00:41Z")

</div>

@jackban is this the same question [Missing csrf token in request header](https://community.temporal.io/t/missing-csrf-token-in-request-header/7410)

---

<div class="post-metadata">

**Author:** ![rashmi\_sahu1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/rashmi_sahu1/32/5637_2.png) [@rashmi\_sahu1](https://community.temporal.io/u/rashmi_sahu1)\
**Post date:** [July 29, 2024, 10:03am UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/12 "2024-07-29T10:03:52Z")

</div>

Solution 1: Add TEMPORAL\_CSRF\_COOKIE\_INSECURE:True in your environment section in docker-compose file, it works for me.

Solution 2: try adding this line in your code before starting workflow execution:  
await client.get\_workflow\_handle(WORKFLOW\_ID).terminate()

---

<div class="post-metadata">

**Author:** ![jeffreypan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jeffreypan/32/5903_2.png) [@jeffreypan](https://community.temporal.io/u/jeffreypan)\
**Post date:** [September 26, 2024, 6:29am UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/13 "2024-09-26T06:29:11Z")

</div>

```yaml
cors:
  cookieInsecure: true

```

Works for me.

---

<div class="post-metadata">

**Author:** ![Russell\_de\_Pina](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/russell_de_pina/32/7240_2.png) [@Russell\_de\_Pina](https://community.temporal.io/u/Russell_de_Pina)\
**Post date:** [May 6, 2025, 5:47am UTC](https://community.temporal.io/t/missing-csrf-token-when-terminate-workflow-on-temporal-ui/6716/14 "2025-05-06T05:47:26Z")

</div>

I installed Temporal from the Helm chart and I am getting the error

 ![image](https://us1.discourse-cdn.com/flex016/uploads/temporal/original/2X/f/f1f11039f2997c344dfe95a8be3a828b41fc1dcf.png)