PaperCut Web Server Error When Using Reverse Proxy

If you are running the PaperCut NG or PaperCut MF print management software and clients are accessing the web server (port 9192 by default for SSL) through a reverse proxy setup using NGINX, etc., then users may be receiving an error relating to header validation when trying to log into the user portal.

Example Error:

HTTP ERROR 403 CSRF validation: target and origin don't match

Read on for the solution...

PaperCut outlines the issue regarding CSRF validation issues at https://www.papercut.com/help/manuals/ng-mf/common/security-csrf-validation-configurations/. They indicate that with reverse proxy server configurations where host headers are overridden by a proxy that is configured to run in front of PaperCut, you must update the proxy configuration to rely on the X-Forwarded-Host header instead of overriding the host header.

For NGINX, the simple solution is to add the following configuration to the specific server configuration (again, typically for port 9192 for SSL):

proxy_set_header Host $http_host; # PaperCut requirement - Pass the original host header

Once you do this, restart the NGINX service:

systemctl restart nginx.service

That's it!