Forms in the web interface work behind an HTTPS proxy

If you reach Anthias through something that adds HTTPS in front of it, such as a Caddy sidecar, a Cloudflare Tunnel or Tailscale Serve, sign-in, uploads and saving settings could fail with a 403 page saying "Your session expired", and uploads with "Upload failed". From Anthias 2026.05.1 those requests go through without any change on your side, as long as the browser and Anthias agree on the host name. The same goes for a browser that keeps using HTTPS after you turned SSL off.

When the proxy changes the host name

Some proxies, such as IIS ARR, send Anthias a different host name than the one in your browser, and then the request is still refused. The simplest fix is to have the proxy pass the original Host header through: proxy_set_header Host $host; in nginx, ProxyPreserveHost On in Apache, or preserveHostHeader="true" in IIS ARR. Caddy and Traefik do this by default.

If you can't change the proxy, Anthias also reads a CSRF_TRUSTED_ORIGINS environment variable in the anthias-server container. Set it to the address people use, for example https://signage.example.com, and separate several addresses with commas. It is empty by default.