# New Install - Invalid origin error

**URL:** <https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891>\
**Category:** Support\
**Created:** [9 June 2021 18:35 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891 "2021-06-09T18:35:26Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![BigWebstas](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/bigwebstas/32/9024_2.png) [@BigWebstas](https://discourse.joplinapp.org/u/BigWebstas)\
**Post date:** [9 June 2021 18:35 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/1 "2021-06-09T18:35:26Z")

</div>

I have tried it with Joplin Server 1.75 and the beta 2.05 but i get the same result

when i attempt to login i get  
 ![image](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/2X/1/1f23f7e849091c22e218f67c6c118940f6eed0d4.png)

no matter what i try its the same result

 ![image](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/2X/3/3cdc039782a2aedb4b1d6af15aeb8bd4dc4d699b.png)

I am using a postgres db  
Any help would be appreciated

---

<div class="post-metadata">

**Author:** ![BigWebstas](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/bigwebstas/32/9024_2.png) [@BigWebstas](https://discourse.joplinapp.org/u/BigWebstas)\
**Post date:** [9 June 2021 18:35 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/2 "2021-06-09T18:35:57Z")

</div>

All tests were fresh installs, no residual data.  
Using docker

---

<div class="post-metadata">

**Author:** ![zblesk](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/zblesk/32/11_2.png) [@zblesk](https://discourse.joplinapp.org/u/zblesk)\
**Post date:** [9 June 2021 19:25 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/3 "2021-06-09T19:25:13Z")

</div>

Got the same error on Server 2.0.5 when the server listened behind a reverse proxy, but the domain the server was listening on was not the domain specified in the Docker's env vars.  
Maybe check you have all those set correctly.

---

<div class="post-metadata">

**Author:** ![dpoulton](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/dpoulton/32/29723_2.png) [@dpoulton](https://discourse.joplinapp.org/u/dpoulton)\
**Post date:** [9 June 2021 19:45 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/4 "2021-06-09T19:45:07Z")

</div>

I have been using the Joplin server docker image behind an nginx reverse proxy. The last version I got to work was, 2.0.1 beta (using the SQLite db). I also had to use _florider_'s version as the official one **always** started with [data already in the admin account and an additional "user1" account](https://discourse.joplinapp.org/t/beta-test-some-findings-joplin-server-client-2-0-1/17348/10). Even after a complete new, clean ubuntu / docker install!!

I then moved onto the later 2.x series _ **using the same .env file** _ and I always got "Invalid origin" regardless of the version. This suggests that the proxy and the Joplin server are not on speaking terms. If I reverted to the 2.0.1 version of the server it worked again. I am not a fan of the Docker concept and so it is currently a bit of a dark art to me and is likely to remain so. I didn't have the knowledge to troubleshoot the issue so I gave up.

Not exactly helpful but just to let you know that you are not the only one who has come across this... assuming it's the same problem 🙂

---

<div class="post-metadata">

**Author:** ![laurent](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laurent](https://discourse.joplinapp.org/u/laurent)\
**Post date:** [9 June 2021 20:03 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/5 "2021-06-09T20:03:56Z")

</div>

Yes sorry this is not currently documented, but you need to make sure that your reverse proxy passes the origin properly to the Docker image.

I think it means having this on the Nginx config:

```
proxy_set_header host $host;

```

And this on Apache:

```
ProxyPreserveHost on
```

---

<div class="post-metadata">

**Author:** ![zblesk](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/zblesk/32/11_2.png) [@zblesk](https://discourse.joplinapp.org/u/zblesk)\
**Post date:** [9 June 2021 20:06 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/6 "2021-06-09T20:06:42Z")

</div>

Yep, that's it for nginx.

In case it helps anyone, this works for me:

```auto
server {
    server_name joplin.example.lol;

    location / {
        proxy_pass http://127.0.0.1:31337;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Host $host;
        client_max_body_size 400M;
    }
}

```

I'm not saying all of those are needed, mind: I just set them by default to avoid trouble. 😃

edit: you may need to add Listen directive for ports. I just let certbot deal with it (and redirect to https.)

---

<div class="post-metadata">

**Author:** ![laurent](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laurent](https://discourse.joplinapp.org/u/laurent)\
**Post date:** [9 June 2021 20:14 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/7 "2021-06-09T20:14:16Z")

</div>

Thanks for sharing your config, the "client\_max\_body\_size" property is important too. I guess once the server gets more stable we can put a sample Nginx and Apache config in the doc.

---

<div class="post-metadata">

**Author:** ![zblesk](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/zblesk/32/11_2.png) [@zblesk](https://discourse.joplinapp.org/u/zblesk)\
**Post date:** [9 June 2021 20:22 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/8 "2021-06-09T20:22:30Z")

</div>

That we definitely should. It's always a hassle to figure out/troubleshoot when projects don't do that.

---

<div class="post-metadata">

**Author:** ![dpoulton](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/dpoulton/32/29723_2.png) [@dpoulton](https://discourse.joplinapp.org/u/dpoulton)\
**Post date:** [9 June 2021 20:57 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/9 "2021-06-09T20:57:22Z")

</div>

> [@laurent](#):
>
> Yes sorry this is not currently documented, ...

![aaugh](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/2X/e/eecd568ba2ee7cc924cecd291730c874ac592f21.png)

_(Server now working 🙂 )_

---

<div class="post-metadata">

**Author:** ![dpoulton](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/dpoulton/32/29723_2.png) [@dpoulton](https://discourse.joplinapp.org/u/dpoulton)\
**Post date:** [9 June 2021 21:56 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/10 "2021-06-09T21:56:29Z")

</div>

In case anyone is interested this is an nginx "sites-available" reverse-proxy file that uses self-signed certs, diverts port 80 to 443, adds a bit of hardening and also logging. It **does** work with 2.0.6-beta.

```nohighlight
 {
    listen 80;
    server_name joplin.example.lol;

    return 301 https://joplin.example.lol$request_uri;
}

server {
    listen 443 ssl http2;
    server_name joplin.example.lol;

    proxy_read_timeout 720s;
    proxy_connect_timeout 720s;
    proxy_send_timeout 720s;

    client_max_body_size 50m;

    # Proxy headers
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;

    # SSL parameters
    ssl_certificate /path/to/certs/joplin.example.lol-cert.pem;
    ssl_certificate_key /path/to/certs/joplin.example.lol-key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

    # log files
    access_log /var/log/nginx/joplin.example.lol.access.log;
    error_log /var/log/nginx/joplin.example.lol.error.log;

    # Handle / requests and redirect to a specific port on localhost
    location / {
       proxy_redirect off;
       proxy_pass http://127.0.0.1:22300;
    }
}

```

Replace `joplin.example.lol` with your domain and `/path/to/certs/example.lol-cert.pem` and `/path/to/certs/example.lol-key.pem` with the real thing.

Then, with the real thing, `sudo ln -s /etc/nginx/sites-available/joplin.example.lol.conf /etc/nginx/sites-enabled/joplin.example.lol.conf`

I got to this by butchering other examples, I am not an nginx expert.

---

<div class="post-metadata">

**Author:** ![BigWebstas](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/bigwebstas/32/9024_2.png) [@BigWebstas](https://discourse.joplinapp.org/u/BigWebstas)\
**Post date:** [10 June 2021 17:52 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/11 "2021-06-10T17:52:19Z")

</div>

I'm kind of screwed, I'm using IIS 8 Url Rewrite

```auto
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
	<system.web>
        <httpRuntime requestPathInvalidCharacters="" />
        <pages validateRequest="false" />
    </system.web>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                    <match url="(.*)" />
                    <action type="Rewrite" url="http://10.2.0.140:22300/{R:1}" />
                    <serverVariables>
                        <set name="HTTP_X_ORIGINAL_ACCEPT_ENCODING" value="HTTP_ACCEPT_ENCODING" />
                    </serverVariables>
                </rule>
            </rules>
            <outboundRules>
                <rule name="fix" preCondition="NeedsRestoringAcceptEncoding">
                    <match serverVariable="HTTP_ACCEPT_ENCODING" pattern="^(.*)" />
                    <action type="Rewrite" value="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" />
                </rule>
                <preConditions>
                    <preCondition name="NeedsRestoringAcceptEncoding">
                        <add input="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" pattern=".+" />
                    </preCondition>
                </preConditions>
            </outboundRules>
        </rewrite>

    </system.webServer>
</configuration>

```

I'm getting the same result ☹  
I have the variable APP\_BASE\_URL set to the url of the reverse proxy

---

<div class="post-metadata">

**Author:** ![BigWebstas](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/bigwebstas/32/9024_2.png) [@BigWebstas](https://discourse.joplinapp.org/u/BigWebstas)\
**Post date:** [10 June 2021 17:57 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/12 "2021-06-10T17:57:36Z")

</div>

Even if i try to hit it directly "[http://10.2.0.140:22300](http://10.2.0.140:22300)" i get Invalid origin

---

<div class="post-metadata">

**Author:** ![BigWebstas](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/bigwebstas/32/9024_2.png) [@BigWebstas](https://discourse.joplinapp.org/u/BigWebstas)\
**Post date:** [10 June 2021 18:14 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/13 "2021-06-10T18:14:56Z")

</div>

I found a solution for us forced IIS users, you need to turn preserve host header on (Its off by default)  
`C:\Windows\system32\inetsrv\appcmd.exe set config -section:system.webServer/proxy -preserveHostHeader:true /commit:apphost`

---

<div class="post-metadata">

**Author:** ![laurent](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laurent](https://discourse.joplinapp.org/u/laurent)\
**Post date:** [10 June 2021 18:18 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/14 "2021-06-10T18:18:21Z")

</div>

In a future version I'll probably remove this Origin check as it's only useful when there are different domains for main website, API, and user content. But when self-hosting you don't really need this.

---

<div class="post-metadata">

**Author:** ![kicune](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/kicune/32/9143_2.png) [@kicune](https://discourse.joplinapp.org/u/kicune)\
**Post date:** [18 June 2021 07:21 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/15 "2021-06-18T07:21:55Z")

</div>

I would really appreciate that - I currently have two setups (with and without proxy, which I use for note re-sync when necessary) and currently it means I have to stop the server and reconfigure APP\_BASE\_URL variable. Or make it an optional check that could be disabled.

---

<div class="post-metadata">

**Author:** ![ssc85](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/ssc85/32/9262_2.png) [@ssc85](https://discourse.joplinapp.org/u/ssc85)\
**Post date:** [27 June 2021 07:10 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/16 "2021-06-27T07:10:45Z")

</div>

I would also highly appreciate removing the origin check or to add the possibility of a whitelist.

In my case the nginx proxy is served/configured by Opnsense which is unfortunatly not able to add the host header (at least not without doing some additional manual config operations).

So currently I have to stick to 2.0.1-beta version ☹

---

<div class="post-metadata">

**Author:** ![cnburke](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/cnburke/32/3555_2.png) [@cnburke](https://discourse.joplinapp.org/u/cnburke)\
**Post date:** [27 June 2021 07:52 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/17 "2021-06-27T07:52:35Z")

</div>

Hello all - I’m trying to migrate to the newest joplin server. I’m an embedded developer, so I suck at web stuff. What I’ve tried thus far:

I’ve stood up a new digital ocean ubuntu 20.04 instance, installed nginx, and setup a reverse proxy (successfully, I believe). I then attempted to perform the fix suggested by @laurent, but I am still getting the “Invalid origin” error. Below are my configuration files:

joplin-server .env file

```auto

# Example of local config, for development:
#
JOPLIN_BASE_URL=http://localhost:22300
JOPLIN_PORT=22300

# Example of config for production:
#
# JOPLIN_BASE_URL=https://example.com/joplin
# JOPLIN_PORT=22300

```

nginx reverse proxy config file:

```auto

cat /etc/nginx/sites-available/reverse-proxy.conf 
server {
    listen 80;
    server_name localhost;
    location / {
        proxy_pass http://localhost:22300;
        proxy_set_header Host $host;
    }
}

```

Don’t trash my configuration too hard 🙂 I’m learning web stuff

---

<div class="post-metadata">

**Author:** ![cnburke](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/cnburke/32/3555_2.png) [@cnburke](https://discourse.joplinapp.org/u/cnburke)\
**Post date:** [2 July 2021 17:24 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/18 "2021-07-02T17:24:07Z")

</div>

Hello again everybody - I managed to get everything working, based on [this](https://discourse.joplinapp.org/t/guide-for-joplin-server-on-raspberry-pi/14702) guide in another thread. I also found that the latest desktop version of 2.1.7 only plays nice with the latest beta of joplin server (2.1.6-beta) according to [this](https://discourse.joplinapp.org/t/not-allowed-put/18166) post. You can change which version of joplin server docker pulls down by changing the "latest" tag in the docker-compose.yml file to "2.1.6-beta". Current versions of apps/server playing happy together below:

Joplin Server: 2.1.6-beta  
Android: 2.1.3  
Windows Desktop: 2.1.7  
iOS (ipad OS on iPad Pro 2020): 12.0.2  
Ubuntu 2020.04: 2.1.7

Thanks all, and let me know if I can help.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/3X/1/c/1c948e33314e232a0927789508474d8624f4270b.png) [@system](https://discourse.joplinapp.org/u/system)\
**Post date:** [1 August 2021 17:24 UTC](https://discourse.joplinapp.org/t/new-install-invalid-origin-error/17891/19 "2021-08-01T17:24:47Z")

</div>

Closed on 1 August 2021 17:24 UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.