Sortarr setup cannot complete – CSRF validation failed (token-missing-cookie) during /setup POST #33
Description
Environment
Sortarr version
v0.8.5.1
Installation method
Docker (Unraid custom template)
Host OS
Unraid (Linux)
Access method
http://192.168.0.179:9595
Browser
Firefox (also reproduced in private window)
Container port mapping
9595 -> 8787
Persistent config path
/mnt/cache_nvme/appdata/sortarr
Description
During the initial setup wizard, clicking “Save and continue” always fails with:
CSRF validation failed
The server logs show:
reason: "token-missing-cookie"
This happens consistently even after:
- fresh container reinstall
- fresh browser session
- manual secret key seeding
- incognito window
The request reaches the server but the CSRF middleware rejects it because the session cookie is missing.
Relevant logs
Startup:
useradd warning: sortarr's uid 99 outside of the UID_MIN 1000 and UID_MAX 60000 range.
INFO sortarr: Security mode active: persistent-secret enforcement on, startup-fail enforcement on, unsafe-recovery=disabled, csrf-trusted-origins=0, session-cookie={secure-default:true,secure-override:auto,samesite:Lax,httponly:true}.
INFO waitress: Serving on http://0.0.0.0:8787
Failed setup submission:
WARNING sortarr: CSRF request rejected:
{
"method": "POST",
"path": "/setup",
"host": "192.168.0.179:9595",
"reason": "token-missing-cookie",
"remote_addr": "192.168.0.123",
"Origin": "http://192.168.0.179:9595",
"Referer": "http://192.168.0.179:9595/setup"
}
Configuration
Sortarr.env contents after startup:
TAUTULLI_METADATA_LOOKUP_LIMIT=-1
TAUTULLI_METADATA_LOOKUP_SECONDS=0
SORTARR_REQUIRE_PERSISTENT_SECRET_KEY=1
SORTARR_FAIL_STARTUP_ON_MISSING_SECRET_KEY=1
Secret key is provided via file:
SORTARR_SECRET_KEY_FILE=/config/secrets/secret_key
File exists at:
/mnt/cache_nvme/appdata/sortarr/secrets/secret_key
Permissions:
600
owned by 99:100
Steps to reproduce
- Deploy container
- Open http://:9595/setup
- Enter Sonarr/Radarr URLs and API keys
4, Click Save and continue
Result:
CSRF validation failed
Things already tried
- deleting and recreating container
- clearing browser cookies
- private browsing window
- manually seeding SORTARR_SECRET_KEY_FILE
- editing Sortarr.env
- accessing via IP and hostname
All produce the same result.
Expected behavior
Setup should complete and write configuration to Sortarr.env.
Actual behavior
Setup POST request fails CSRF validation due to token-missing-cookie, preventing initial configuration.