If you access your server behind a proxy using url…

Error message

If you access your server behind a proxy using url rewriting, you might check that all HTTP headers are propagated (or add the line $dolibarr_nocsrfcheck=1 into your conf.php file to remove this security check).

What it means

This is the advisory second line printed alongside error 26 when the CSRF referrer check fails. It tells the operator the usual root cause (a proxy not propagating headers) and the escape hatch ($dolibarr_nocsrfcheck=1 in conf.php). On its own it never appears; it is emitted by the same die-block in filefunc.inc.php after the main CSRF refusal message.

Solutions

Fix header propagation at the proxy (Host, X-Forwarded-*, Referer) — the proper fix; see error 26 solutions.
Align dolibarr_main_url_root with the URL users actually use.
Only if the setup is trusted and internal, add $dolibarr_nocsrfcheck=1 to htdocs/conf/conf.php to bypass the referrer check.
Verify the fix by reproducing the POST and confirming it is accepted with correct Referer.

Example fix

// before (htdocs/conf/conf.php)
$dolibarr_main_url_root = 'http://internal-host:8080';
// after (matches public URL so Referer host matches)
$dolibarr_main_url_root = 'https://doli.example.com';

Defensive patterns

Strategy: fallback

Validate before calling

// infra check before blaming the app: does the proxy forward headers?
curl -s -o /dev/null -w '%header{host}' -H 'Referer: https://public-host/' https://internal-doli/ ; // compare with expected host

Prevention

Treat this hint line in logs as a signal that proxy header propagation is broken.
Standardize proxy templates: Host, X-Forwarded-Host, X-Forwarded-Proto, Referer are always set.
Avoid the $dolibarr_nocsrfcheck=1 escape hatch unless risk-approved.
Re-test POST flows after any proxy or TLS termination change.

When it happens

Trigger: Same as the CSRF referrer refusal: a POST with a foreign/mismatched HTTP_REFERER, after which the proxy-hint line is printed before die.

Common situations: Reverse proxy / load balancer stripping or rewriting Host and Referer; admins searching logs and finding only this hint line; operators considering the conf.php switch without fixing headers.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/a16801a3b90fad14. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/filefunc.inc.php:353

// See also CSRF protections done into main.inc.php
if (!defined('NOCSRFCHECK') && isset($dolibarr_nocsrfcheck) && $dolibarr_nocsrfcheck == 1) {    // If $dolibarr_nocsrfcheck is 0, there is a strict CSRF test with token in main
	if (!empty($_SERVER['REQUEST_METHOD']) && !in_array($_SERVER['REQUEST_METHOD'], array('GET', 'HEAD')) && !empty($_SERVER['HTTP_HOST'])) {
		$csrfattack = false;
		if (empty($_SERVER['HTTP_REFERER'])) {
			$csrfattack = true; // An evil browser was used
		} else {
			$tmpa = parse_url($_SERVER['HTTP_HOST']);
			$tmpb = parse_url($_SERVER['HTTP_REFERER']);
			if ((empty($tmpa['host']) ? $tmpa['path'] : $tmpa['host']) != (empty($tmpb['host']) ? $tmpb['path'] : $tmpb['host'])) {
				$csrfattack = true;
			}
		}
		if ($csrfattack) {
			//print 'NOCSRFCHECK='.defined('NOCSRFCHECK').' REQUEST_METHOD='.$_SERVER['REQUEST_METHOD'].' HTTP_HOST='.$_SERVER['HTTP_HOST'].' HTTP_REFERER='.$_SERVER['HTTP_REFERER'];
			// Note: We can't use dol_escape_htmltag here to escape output because lib functions.lib.ph is not yet loaded.
			dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"]." refused by CSRF protection (Bad referrer).", LOG_WARNING);
			print "Access refused by CSRF protection in main.inc.php. Referrer of form (".htmlentities(empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER'], ENT_COMPAT, 'UTF-8').") is outside the server that serve this page (with method = ".htmlentities($_SERVER['REQUEST_METHOD'], ENT_COMPAT, 'UTF-8').").\n";
			print "If you access your server behind a proxy using url rewriting, you might check that all HTTP headers are propagated (or add the line \$dolibarr_nocsrfcheck=1 into your conf.php file to remove this security check).\n";
			die;
		}
	}
	// Another test is done later on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on.
}
if (empty($dolibarr_main_db_host) && !defined('NOREQUIREDB')) {
	print '<div class="center">Dolibarr setup is not yet complete.<br><br>'."\n";
	print '<a href="install/index.php">Click here to finish Dolibarr install process</a> ...</div>'."\n";
	die;
}
if (empty($dolibarr_main_url_root) && !defined('NOREQUIREVIRTUALURL')) {
	print 'Value for parameter \'dolibarr_main_url_root\' is not defined in your \'htdocs\conf\conf.php\' file.<br>'."\n";
	print 'You must add this parameter with your full Dolibarr root Url (Example: http://myvirtualdomain/ or http://mydomain/mydolibarrurl/)'."\n";
	die;
}

if (empty($dolibarr_main_url_root_alt)) {
	$dolibarr_main_url_root_alt = '/custom';

View on GitHub (pinned to 598aa4bdad)