From b38a766ccc89b224d8aa8e88cdfa46cf0098f69c Mon Sep 17 00:00:00 2001 From: AJ Slater Date: Sun, 18 Oct 2026 20:12:56 -0700 Subject: [PATCH] Note that a correctly configured proxy doesn't need csrf_trusted_origins The setting is a fallback for a proxy that can't send X-Forwarded-Proto and X-Forwarded-Host. Say so next to that advice in the codex.toml comments and the README's "CSRF 403 behind a proxy" section, so users fix the proxy first instead of reaching for the setting. Co-Authored-By: Claude Opus 5.5 --- README.md | 6 ++++-- codex/settings/codex.toml.default | 1 + 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 38abb37cb..76e5fe4a0 100644 --- a/README.md +++ b/README.md @@ -474,6 +474,7 @@ present. # Public origins accepted for CSRF when a reverse proxy serves Codex under # another scheme or host than Codex sees (e.g. https in front of http). # First make sure the proxy sends X-Forwarded-Proto and X-Forwarded-Host. +# A correctly configured proxy does, and then you shouldn't need this. # csrf_trusted_origins = ["https://comics.example.com"] # [logging] @@ -709,8 +710,9 @@ above is what keeps the static assets reachable. If logging in or saving changes fails with a 403 "CSRF Failed" error behind a reverse proxy, first make sure the proxy sends `X-Forwarded-Proto` and `X-Forwarded-Host` (the nginx example above does). Codex compares them with the -browser's `Origin` header. Only if the proxy can't send them, or the error -persists, add the public origin the browser uses to `config/codex.toml`: +browser's `Origin` header, so a correctly configured proxy ordinarily needs no +CSRF setting at all. Only if the proxy can't send them, or the error persists, +add the public origin the browser uses to `config/codex.toml`: ```toml [server] diff --git a/codex/settings/codex.toml.default b/codex/settings/codex.toml.default index 6eb7c0c3b..a7bedd7a1 100644 --- a/codex/settings/codex.toml.default +++ b/codex/settings/codex.toml.default @@ -18,6 +18,7 @@ # Public origins accepted for CSRF when a reverse proxy serves Codex under # another scheme or host than Codex sees (e.g. https in front of http). # First make sure the proxy sends X-Forwarded-Proto and X-Forwarded-Host. +# A correctly configured proxy does, and then you shouldn't need this. # csrf_trusted_origins = ["https://comics.example.com"] # Worker threads that keep a warm database connection between requests. # Opening one costs a few milliseconds, mostly SQLite re-reading the