[Bug]: Bugsink CSRF / HTTPS Proxy issue when deployed behind Coolify

[issam-seghir]

Error Message and Logs

When deploying Bugsink on Coolify, login and POST requests fail due to CSRF validation errors.
After a lot of debugging ,i found that the real issue is that Bugsink does not detect HTTPS correctly behind Coolify's reverse proxy

Root cause

Bugsink (Django-based) relies on X-Forwarded-Proto headers to determine if a request is secure.
Behind Coolify’s reverse proxy, these headers are set, but Bugsink ignores them unless you explicitly configure behind proxy env :

BEHIND_HTTPS_PROXY=True

Without this, CSRF protection fails because Django assumes requests are insecure.

Solution / Fix

Update documentation or defaults for Bugsink deployments on Coolify to include:

web:
   image: bugsink/bugsink
   restart: unless-stopped
   environment:
     ...
     - BEHIND_HTTPS_PROXY=True

Expected behavior

Bugsink should automatically respect X-Forwarded-Proto behind Coolify’s reverse proxy, or at least document the need for BEHIND_HTTPS_PROXY=True.

Steps to Reproduce

1. Deploy Bugsink on Coolify with HTTPS enabled.

2. Set the following env in Coolify:

environment:
  - DEBUG_CSRF=True

(this enables the CSRF debug tool at /debug/csrf/)

3. Try to log in → CSRF check fails.

4. Open /debug/csrf/ to inspect headers:

X-Forwarded-Proto: https is present
request.is_secure() is still False
CSRF protection rejects the request

Example Repository URL

No response

Coolify Version

v4.0.0-beta.420.6

Are you using Coolify Cloud?

No (self-hosted)

Operating System and Version (self-hosted)

Ubuntu 24.04.3 LTS

Additional Information

No response

[ShadowArcanist]

Hey @issam-seghir !

Thanks for the detailed steps to reproduce the issue and for suggesting a solution!

I've submitted a PR to fix the service template

[ejscheepers]

Even if I set - BEHIND_HTTPS_PROXY=True I still get the CRSF error behind a CF Tunnel.

[issam-seghir]

@ejscheepers see CSRF troubleshooting

when you visit to /debug/csrf/
you should see :

BASE_URL : https://bugsink....
ALLOWED_HOSTS  ['bugsink.....com', 'localhost', '127.0.0.1']
SECURE_PROXY_SSL_HEADER ('HTTP_X_FORWARDED_PROTO', 'https')
CSRF_TRUSTED_ORIGINS  []

[ejscheepers]

Yes @issam-seghir but behind CF Tunnel we need to set BASE_URL to http only.. So not sure what to do here? Because mine is:

BASE_URL : http://bugsink....
ALLOWED_HOSTS  ['bugsink.....com', 'localhost', '127.0.0.1']
SECURE_PROXY_SSL_HEADER ('HTTP_X_FORWARDED_PROTO', 'https')
CSRF_TRUSTED_ORIGINS  []

[AhmetHuseyinDOK]

I am also having the exact problem with this one

[ShadowArcanist]

Yes @issam-seghir but behind CF Tunnel we need to set BASE_URL to http only.. So not sure what to do here? Because mine is:

BASE_URL : http://bugsink....
ALLOWED_HOSTS  ['bugsink.....com', 'localhost', '127.0.0.1']
SECURE_PROXY_SSL_HEADER ('HTTP_X_FORWARDED_PROTO', 'https')
CSRF_TRUSTED_ORIGINS  []

You can run you CF tunnel on Full TLS mode: https://coolify.io/docs/knowledge-base/cloudflare/tunnels/full-tls so you will be entering your domain in https instead of http

[ejscheepers]

Thank you @ShadowArcanist I switched my tunnel to run FULL TLS mode and now it works 100%