Unable to add layer to GeoServer - Origin does not correspond to request

Question

I am unable to add a layer to GeoServer, whenever I click to add layer and select a store from dropdown, I get
HTTP ERROR 400
Problem accessing /geoserver/web/wicket/bookmarkable/org.geoserver.web.data.layer.NewLayerPage.
Reason: Origin does not correspond to request

I have tried setting GEOSERVER_CSRF_WHITELIST to allow-list of proxy with the CSRF filter but no luck, even tried setting GEOSERVER_CSRF_DISABLED property to true but that also didn't work. Recently we shifted out GeoServer from http to https
Can someone tell me how to resolve this or possibly the reason for it to occur

Stefan · Answer

If I remember correctly GeoServer checks both the Origin-header and the referer-header when posting forms. Depending on how you have set up https it might be the culprit. I had a similar problem when we used IIS as a proxy to serve GeoServer as https. The referer-header then contained "https" in the adress, but Geoserver was hosted in jetty using http and then expected the referer-header to contain "http". As we also had a reverse proxy in front of the IIS, I just modified the referer-header to contain http:// instead of https:// and GeoServer was happy.
But I think that Geoserver has a configuration to ignore the referer header, but I can't find it now.

Unable to add layer to GeoServer - Origin does not correspond to request

One Answer

Add your own answers!

Ask a Question