<p>I have a simple setup that is using OAuth2 Proxy to handle authentication. It works fine locally using minikube but when I try to use GKE when the oauth callback happens I get a 403 status and the the following message...</p>
<blockquote>
<p>Login Failed: Unable to find a valid CSRF token. Please try again.</p>
</blockquote>
<p>The offending url is <code>http://ourdomain.co/oauth2/callback?code=J_6ao0AxSBRn4bwr&amp;state=r_aFqM9wsSpPvyKyyzE_nagGnpNKUp1pLyZafOEO0go%3A%2Fip</code></p>
<p>What should be configured differently to avoid the CSRF error?</p>

<p>In my case it was because I needed to set the cookie to <code>secure = false</code>. Apparently I could still have secure true no problem with http and an IP but once I uploaded with a domain it failed.</p>
