Login in SCP not possible

kizu

Hy,

Since some days osticket has worked on my Hoster but now it has stopped working. Yesterday I have seen the problem that I can not login anymore in the Ticket system because the error "Valid CSRF Token Required" on login. I have updated the os ticket from 1.18.3 to 1.18.4 and then the problem seems to be solved and appeared again today.

Then I have found this Thread and tried to truncate the session table: https://forum.osticket.com/d/99040-valid-csrf-token-required

I have seen if I have put in the correct credentials I have gotten a new session (with the same IP address and the same user agent) but I am still on the login page. If I enter the wrong Credentials, then the session will be the same and I got the message "access denied" on the login page.

The Cookie seems to be valid and if I reload the page the session will not be changed.

I have tried to enable the PHP log with htaccess (and this is working, that I have seen, when I have set the PHP version to 8.0) but I can not see any message in the log while I try to login.

I have enabled the PHP extensions OPcache, APCu, OAuth and XML-RPC And I have also tried to disable that extensions. Nothing changed. The PHP version is set to 8.2

What can I do to solve this problem?

Best Regards, Daniel

KevinTheJedi

kizu

PHP 8.2 is not supported. Please upgrade to 8.3-8.4, restart the webserver and PHP-FPM, clear all cache/sessions/cookies in the browser, and retest.

Cheers.

kizu

Hy,
Thank you. I have set the PHP version to 8.4. and cleared the Browser Cache. The message told me again there is an valid CSRF Token needed and after I have tried it again the same problem occours.
Because the osticket is installed inside a hosting service I can not restart the Webserver and the FPM. I will check it again later.
Best Regards, Daniel

KevinTheJedi

kizu

That likely means you need to clear all cache/cookies/sessions for the site and reload the site. Or you can try an incognito/private window or even a different browser.

Cheers.

kizu

Hy,
I have tried it with the private mode and tried also a new Login in a Virtual machine but nothing changed. Every Time I enter the correct credentials the session id changed and I can not log in.
every time on the first try I get the message there is an valid CSRF Token needed. After that I get no message anymore but the login is not working.
Best Regards, Daniel

ntozier

Any chance that you have a 'Header set Set-Cookie' directive in .htaccess?

Are you handling http > https redirects in your .htaccess?

Go to: Admin Panel > Settings > Agents
do you have 'Bind Agent Session to IP' enabled?

kizu

Hy,

No I have not set any Header change or https redirects in the htaccess file. The redirect from http to https is configured in the Hosting package and that was configured before I have installed osticket. I have never used http to access osticket.

This is the full htaccess file:

php_flag log_errors on
php_value error_log [path_to_the_file]

I can not login to the Admin Panel and I can not remember, if that configuration is set or not. How can I check this via the Database access?

Best Regards, Daniel

kizu

Hy,

I have reinstalled Osticket and the problem was solved for some minutes. But now the problem appeared again. I have no Idea to troubleshoot this problem. Is there any possibility to enable error messages on the output or in the log to find the reason why I get the new ID and the login window?

best regards, Daniel

KevinTheJedi

kizu

On the osTicket side you can set the default log level in the config table to DEBUG so it logs more detailed events. You can also modify your bootstrap.php file to set display_errors and display_startup_errors to 1, restart the webserver and php-fpm, and retry to see if any worthwhile errors are shown on screen. Other than that you’d need to check all possible logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, Browser Console logs, etc.) for any related errors.

Cheers.

kizu

Hy,
besides many deprecated messages and the messages, the header information can not be set I got this error messages:

[23-Aug-2026 10:03:31 UTC] PHP Warning: Undefined array key "country" in [path]/include/class.translation.php on line 821
[23-Aug-2026 10:03:31 UTC] PHP Warning: Undefined property: mysqli::$unbuffered_result in [path]/include/mysqli.php on line 194

The default log level in the config table is set to 1, which value I should insert to set the log level to debug an where I can see the logs after that?

Best regards, Daniel

KevinTheJedi

kizu

Those are just warnings, not errors. Logs will be in the syslog table. Is your site truly running PHP 8.4? If you make a phpinfo file at the site root does it show PHP 8.4 as the active, running version?

Cheers.

kizu

phpinfo shows PHP Version 8.4.24

The default log level in the config table is set to 1, which value I should insert to set the log level to debug?

KevinTheJedi

kizu

Okay, that’s good. Set it to 3 for DEBUG level.

Cheers.

KevinTheJedi

kizu

Also, make sure your webserver and/or load balancer is passing the actual (correct) user IPs in the requests. If you use a load balancer or proxy or anything and if you use a cluster make sure you take a look at these settings:

https://github.com/osTicket/osTicket/blob/develop/include/ost-sampleconfig.php#L117-L146

Cheers.