What's your question or issue?

Not a new open question — following up on my own old, unresolved thread
(#10177) and a similar
one I found while searching (#5684):
I finally found the actual root cause, months later, and I'm posting the answer here since
#10177 is locked and I can no longer add it there myself.
Symptom: login page loads fine, but submitting the login form always returns a CSRF 403,
even though PAPERLESS_URL (and thus CSRF_TRUSTED_ORIGINS/ALLOWED_HOSTS) is set
correctly. Container logs show:

[WARNING] [django.security.csrf] Forbidden (Origin checking failed - null does not match any trusted origins.): /accounts/login/

Root cause: the reverse proxy (Apache in my case, but the mechanism is proxy-agnostic)
was sending a Referrer-Policy: no-referrer response header — on DietPi this comes from a
global Apache config (/etc/apache2/conf-available/dietpi.conf), applied to every vhost,
not something in Paperless's own config at all.
Per the Fetch/HTML living standard,
a no-referrer policy makes browsers send a literal Origin: null header (not just an
absent Referer) on same-origin POST-navigation requests such as an HTML login form submit.
Django's CSRF middleware then rejects it, since null can never be a trusted origin.
Reproduced identically in current Firefox and Chromium (confirmed via packet capture) — this
is specified browser behaviour, not a bug in either browser, and not something
PAPERLESS_URL/PAPERLESS_CSRF_TRUSTED_ORIGINS/PAPERLESS_ALLOWED_HOSTS can fix on their own.
Full write-up (with the Apache/Nginx fix syntax) is now on the
reverse proxy wiki page. DietPi-specific background: MichaIng/DietPi#3675
(identical mechanism, fixed there only for DietPi's own Pi-hole vhost, not the global default).

What have you tried?

• Checked PAPERLESS_URL, PAPERLESS_CSRF_TRUSTED_ORIGINS, PAPERLESS_ALLOWED_HOSTS —
  all correctly set already (this is not a config-value problem).
• Confirmed via docker exec ... python3 -c "from django.conf import settings; print(settings.SECURE_PROXY_SSL_HEADER, settings.CSRF_TRUSTED_ORIGINS, settings.ALLOWED_HOSTS)"
  that Django sees everything as intended.
• Ran tcpdump -i lo -A -s0 -w /tmp/x.pcap 'tcp port 8000' on the host while retrying the
  login in a real browser, then inspected the raw decrypted request between the reverse
  proxy and the Paperless container (tcpdump -r /tmp/x.pcap -A | grep -A30 'POST /accounts/login').
  This showed the browser genuinely sending Origin: null alongside Sec-Fetch-Site: same-origin — i.e. the browser itself considered it a same-origin request, so this isn't
  a CORS/cross-origin setup mistake.
• Checked the proxy's actual outgoing response headers (curl -I) and found
  Referrer-Policy: no-referrer being sent (in my case, duplicated alongside my own vhost's
  strict-origin-when-cross-origin, coming from a global Apache config, not Paperless).
• Fixed by rewriting the header at the proxy (Header edit Referrer-Policy "no-referrer" "same-origin" for Apache) — confirmed fixed via a full simulated login POST with real
  cookies/CSRF token through the actual public URL, and then a real login with a real
  password.

Paperless-ngx version

2.20.3

Host OS

DietPi (Debian 13 "trixie"), aarch64

Installation method

Docker - official image

System status

{
    "pngx_version": "2.20.3",
    "server_os": "Linux-6.18.37-current-rockchip64-aarch64-with-glibc2.41",
    "install_type": "docker",
    "storage": {
        "total": 3936686497792,
        "available": 22958227456
    },
    "database": {
        "type": "postgresql",
        "url": "paperless",
        "status": "OK",
        "error": null,
        "migration_status": {
            "latest_migration": "paperless_mail.0001_initial_squashed_0009_mailrule_assign_tags",
            "unapplied_migrations": []
        }
    },
    "tasks": {
        "redis_url": "redis://broker:6379",
        "redis_status": "OK",
        "redis_error": null,
        "celery_status": "OK",
        "celery_url": "celery@f12908ddc8d4",
        "celery_error": null,
        "index_status": "OK",
        "index_last_modified": "2026-07-19T00:00:08.225255+02:00",
        "index_error": null,
        "classifier_status": "OK",
        "classifier_last_trained": "2026-07-19T06:05:01.676028Z",
        "classifier_error": null,
        "sanity_check_status": "OK",
        "sanity_check_last_run": "2026-07-18T22:30:01.708096Z",
        "sanity_check_error": null
    },
    "websocket_connected": "ERROR"
}

Relevant logs or output

[WARNING] [django.security.csrf] Forbidden (Origin checking failed - null does not match any trusted origins.): /accounts/login/