A bug with CSRF after update label-studio

[lgq-garbage]

I update label-studio to the newest version and run docker-compose up -d --build.

But when I open the 8080 port, the website shows these.(Include edge or chrome

[lgq-garbage]

This problem appears again. Anyone meets this problem？ I don’t know how to adjust files.

[june-oh]

Same problem

[june-oh]

I found a temporary workaround. Add USE_ENFORCE_CSRF_CHECKS=false to the docker-compose.yml file as shown below:

app:  
   stdin_open: true  
   tty: true  
   build: .  
   image: heartexlabs/label-studio:latest  
   restart: unless-stopped  
   expose:  
     - "8000"  
   depends_on:  
     - db  
   environment:  
     - DJANGO_DB=default  
     - POSTGRE_NAME=postgres  
     - POSTGRE_USER=postgres  
     - POSTGRE_PASSWORD=  
     - POSTGRE_PORT=5432  
     - POSTGRE_HOST=db  
     - LABEL_STUDIO_HOST=${LABEL_STUDIO_HOST:-}  
     - JSON_LOG=1  
     - USE_ENFORCE_CSRF_CHECKS=false     #add this line 

[lgq-garbage]

Thanks，I  will  add  this option  and rebuild.

…

---Original--- From: ***@***.***> Date: Wed, Sep 4, 2024 18:42 PM To: ***@***.***>; Cc: ***@***.***>;"State ***@***.***>; Subject: Re: [HumanSignal/label-studio] A bug with CSRF after updatelabel-studio (Issue #6296) I found a temporary workaround. Add USE_ENFORCE_CSRF_CHECKS=false to the docker-compose.yml file as shown below: app: stdin_open: true tty: true build: . image: heartexlabs/label-studio:latest restart: unless-stopped expose: - "8000" depends_on: - db environment: - DJANGO_DB=default - POSTGRE_NAME=postgres - POSTGRE_USER=postgres - POSTGRE_PASSWORD= - POSTGRE_PORT=5432 - POSTGRE_HOST=db - LABEL_STUDIO_HOST=${LABEL_STUDIO_HOST:-} - JSON_LOG=1 - USE_ENFORCE_CSRF_CHECKS=false #add this line — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you modified the open/close state.Message ID: ***@***.***>

[june-oh]

@lgq-garbage Actually, I tried it out, and it seems like this change works with just docker compose up without needing to run docker compose --rebuild

[jombooth]

/jira create

Workflow run
Jira issue TRIAG-822 is created

[jombooth]

Disabling CSRF as shown above will fix this, but note that it also makes Label Studio less secure. I've also seen this bug a few times on my own setup, and will flag it for the engineering team.

[jombooth]

Note also that a hard refresh (ctrl+shift+R / cmd+shift+R in chrome) can help resolve this issue when it comes up.

[lgq-garbage]

Great.

[gawbul]

Disabling CSRF as shown above will fix this, but note that it also makes Label Studio less secure. I've also seen this bug a few times on my own setup, and will flag it for the engineering team.

I was just about to post the very same. This is a security risk for us, and although it works in the interim, it's not the ideal solution in the long run. It would be great to get a longer term fix on this, an issue which just spontaneously impacted us this week. Is there any estimate on the time for a fix on this? I'm assuming it is still an issue in 1.13.1 (we're still on 1.12.1)? @jombooth