Seqr local installation [AWS] redirect : 403 Error

[ksarathbabu]

Hi Everyone,

I have the seqr installed on a local installation using the docker-compose version. It is installed correctly and works fine when used with the machines IP address. But when I added a load balancer to the instance and redirected it from a URL (instead of direct access to the IP address) I get a 403 error.

Here is the log in the container.

seqr_1 | {"timestamp": "2024-07-19 14:25:46,443", "severity": "WARNING", "message": "Forbidden (Origin checking failed - https://seqr.xyz.com/ does not match any trusted origins.): /api/login"}
seqr_1 | {"timestamp": "2024-07-19 14:25:46,443", "severity": "WARNING", "message": "Forbidden (Origin checking failed - https://seqr.xyz.com/ does not match any trusted origins.): /api/login"}
seqr_1 | {"timestamp": "2024-07-19 14:25:46,443", "severity": "WARNING", "httpRequest": {"requestMethod": "POST", "requestUrl": "http://seqr.xyz.com/api/login", "status": 403, "responseSize": 2584, "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", "remoteIp": "xyz", "referer": "https://seqr.xyz.com/login/", "protocol": "HTTP/1.1"}, "requestBody": {"email": "[email protected]", "password": "***"}}

Any suggestions on changes I could make to the application so it doesn`t think the URL is the IP address.

Thank you

[hanars]

Try setting the BASE_URL environment variable to match your URL. You may also need to set the DEPLOYMENT_TYPE environment variable to prod

[hanars]

To clarify, you are seeing this error in google chrome as your browser?

[ksarathbabu]

Yes, same error if I use safari as well.

After googling to solve the problem, tried different solutions like

CORS_ALLOW_HEADERS = ['*']
CORS_ALLOWED_ORIGINS=['http://seqr.xyz.com','https://seqr.xyz.com']
CSRF_TRUSTED_ORIGINS=['http://seqr.xyz.com','https://seqr.xyz.com']

Unfortunately none worked.

[hanars]

you can try setting DEBUG=True in settings.py to get a more detailed error log

[ksarathbabu]

I wanted to update everyone that once I added CSRF_TRUSTED_ORIGINS = ["https://seqr.xyz.com/"], it was fixed.

Thanks