Unable to create a project at Scancode.io which is spinned up through Docker compose on Debian linux azure machine

[199219921992]

Unable to save a project in scancode.io where is scancode.io is configured through Docker compose deployed based instance running on Azure Debian linux machine.

Able to get the instance running but when we try to add project it through the Forbidden (403)
CSRF verification failed. Request aborted. error.

Running this instance with HTTP protocol itself.

[Ganesh-403]

@199219921992 A 403 CSRF verification failed when submitting the Create Project form is usually caused by the deployment configuration rather than the project creation logic itself.

Since you're running ScanCode.io behind Docker Compose on an Azure Debian VM over HTTP, I'd check the following first:

1. ALLOWED_HOSTS

   Make sure the hostname or IP you're using to access the application is included in ALLOWED_HOSTS. :contentReference[oaicite:0]{index=0}

2. CSRF_TRUSTED_ORIGINS

   If you're accessing the application through a domain name or reverse proxy, configure CSRF_TRUSTED_ORIGINS accordingly. The installation guide documents this setting, for example:

   ALLOWED_HOSTS=.your-domain.com
   CSRF_TRUSTED_ORIGINS=https://*.your-domain.com
   

   Adjust these values to match your deployment. :contentReference[oaicite:1]{index=1}

3. Restart the services after changing .env

   ScanCode.io reads these settings from the environment, so after modifying .env you'll need to restart the containers:

   docker compose restart web worker

One thing I'd like to clarify is your deployment:

• Are you accessing ScanCode.io via the Azure VM's public IP (e.g. http://20.x.x.x) or through a DNS hostname?
• Are you using the provided Docker Compose stack directly, or is there a reverse proxy (Nginx, Azure Application Gateway, Traefik, etc.) in front of it?

Also, could you share the exact reason shown on the Django CSRF error page? For example, it often says something like:

• Origin checking failed...
• CSRF cookie not set.
• CSRF token missing or incorrect.

That specific message usually pinpoints the underlying configuration issue.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.