# Getting 403 Origin Not Allowed when logging in behind Azure Application Gateway

**URL:** <https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948>\
**Category:** Configuration\
**Tags:** azure\
**Created:** [November 2, 2023, 12:55pm UTC](https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948 "2023-11-02T12:55:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![albal](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/albal/32/39350_2.png) [@albal](https://community.grafana.com/u/albal)\
**Post date:** [November 2, 2023, 12:55pm UTC](https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948/1 "2023-11-02T12:55:46Z")

</div>

- What Grafana version and what operating system are you using?

I was using Grafana 8.0.6 and it was running fine but with 9.4.17 or latest I am getting 403 errors

- **What** are you trying to achieve?

I want to have Grafana running behind an application gateway on a path of an existing domain.

- **How** are you trying to achieve it?

I am using Terraform to provision a Linux Web App (Grafana) and an Application Gateway to terminate SSL, though for testing purposes I am only using HTTP at the moment.

- What happened?

When I run an older version of Grafana everything works as expected with this configuration:

```auto
  app_settings = {
    DOCKER_ENABLE_CI = "true"
    GF_SECURITY_X_XSS_PROTECTION = "false"
    GF_SERVER_DOMAIN = "domain.net"
    GF_LIVE_ALLOWED_ORIGINS = "*"
    GF_SERVER_ROOT_URL = "%(protocol)s://%(domain)s:%(http_port)s/grafana/"
    GF_SERVER_SERVE_FROM_SUB_PATH = "true"
    GF_SECURITY_ADMIN_USER = "admin"
    GF_SECURITY_ADMIN_PASSWORD = var.gf_password
  }

```

I have set the container hostname as the backend setting in the Azure Gateway.

```auto
      name = "prod-grafana-backend-http-settings"
      pick_host_name_from_backend_address = false
      host_name = azurerm_linux_web_app.grafana-web-app.default_hostname
      cookie_based_affinity = "Enabled"
      path = "/grafana/"
      port = 80
      protocol = "Http"
      request_timeout = 30
      probe_name = "${var.appgw_probe[terraform.workspace]}-gf"

```

- What did you **expect** to happen?

I would expect Grafana to work without 403 errors.

- Can you copy/paste the configuration(s) that you are having problems with?

Pasted above

- Did you receive any errors in the Grafana UI or in related logs? If so, please tell us **exactly** what they were.

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/f/2/f2d1b9e28b2a8d976d7e5cb640c18d11e7b3bdd0.png)

- Did you follow any online instructions? If so, what is the URL?

I’ve looked around on the forum but everything seems to discuss nginx or Apache configuration.

---

<div class="post-metadata">

**Author:** ![srinivasmummareddy](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@srinivasmummareddy](https://community.grafana.com/u/srinivasmummareddy)\
**Post date:** [December 22, 2023, 6:57am UTC](https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948/2 "2023-12-22T06:57:23Z")

</div>

Even I’m stuck with the same issue…Did you got the fix?

---

<div class="post-metadata">

**Author:** ![bfakrudd](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/bfakrudd/32/42390_2.png) [@bfakrudd](https://community.grafana.com/u/bfakrudd)\
**Post date:** [February 15, 2024, 2:48pm UTC](https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948/3 "2024-02-15T14:48:36Z")

</div>

Do we have any solution for this ?

---

<div class="post-metadata">

**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\
**Post date:** [February 18, 2024, 4:14pm UTC](https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948/4 "2024-02-18T16:14:54Z")

</div>

There is basic rule that tool in front of Grafana (Azure Application Gateway in this particular case, but generally anything: nginx, AWS ALB, AWS API GW, F5,…) must forward Host header to Grafana - how to do that depends on used tool (so check doc for used tool).  
Of course domain in tha Host header must be matching domain configured(allowed) in the Grafana config.

---

<div class="post-metadata">

**Author:** ![aldosilva6](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/aldosilva6/32/53343_2.png) [@aldosilva6](https://community.grafana.com/u/aldosilva6)\
**Post date:** [March 19, 2025, 7:37pm UTC](https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948/5 "2025-03-19T19:37:38Z")

</div>

Could you share how you configured in Application Gateway and in Grafana [server]?

---

<div class="post-metadata">

**Author:** ![albal](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/albal/32/39350_2.png) [@albal](https://community.grafana.com/u/albal)\
**Post date:** [March 19, 2025, 7:57pm UTC](https://community.grafana.com/t/getting-403-origin-not-allowed-when-logging-in-behind-azure-application-gateway/106948/6 "2025-03-19T19:57:38Z")

</div>

I’m not working on that project anymore but here is the working code:

> <https://github.com/DFE-Digital/childrens-social-care-cpd/blob/next/Terraform/grafana.tf#L41-L51>

> <https://github.com/DFE-Digital/childrens-social-care-cpd/blob/next/Terraform/variables.tf#L981-L991>

> <https://github.com/DFE-Digital/childrens-social-care-cpd/blob/next/Terraform/appgw.tf#L157-L177>

I’ve not used Azure since the project. Working on Air-gapped Kubernetes environments for now.

Hope that helps.