for muellerl:
Sep 26 19:46:50 jupyterhub jupyterhub[244487]: [D 2023-09-26 19:46:50.524 JupyterHub systemdspawner:155] user:muellerl Initialized spawner with unit jupyter-muellerl-singleuser
Sep 26 19:46:50 jupyterhub jupyterhub[244487]: [I 2023-09-26 19:46:50.529 JupyterHub log:191] 200 GET /hub/admin (muellerl@127.0.0.1) 30.03ms
Sep 26 19:46:50 jupyterhub jupyterhub[244487]: [I 2023-09-26 19:46:50.788 JupyterHub log:191] 302 GET /user/muellerl/api/events/subscribe?token=[secret] -> /hub/user/muellerl/api/events/subscribe?token=[secret] (@127.0.0.1) 0.64ms
Sep 26 19:46:50 jupyterhub jupyterhub[244487]: [I 2023-09-26 19:46:50.992 JupyterHub log:191] 302 GET /logo -> /hub/logo (@127.0.0.1) 0.48ms
Sep 26 19:46:51 jupyterhub jupyterhub[244487]: [D 2023-09-26 19:46:51.026 JupyterHub log:191] 304 GET /hub/logo (@127.0.0.1) 2.78ms
Sep 26 19:46:51 jupyterhub jupyterhub[244487]: [W 2023-09-26 19:46:51.040 JupyterHub web:1869] 403 GET /hub/api/users?include_stopped_servers&offset=0&limit=50&name_filter= (127.0.0.1): '_xsrf' argument missing from GET
Sep 26 19:46:51 jupyterhub jupyterhub[244487]: [W 2023-09-26 19:46:51.040 JupyterHub log:191] 403 GET /hub/api/users?include_stopped_servers&offset=0&limit=50&name_filter= (muellerl@127.0.0.1) 1.69ms
```
Does someone have an idea?
edit:
The tokens panel also does show `API request failed (403): '_xsrf' argument missing from POST` when trying to create a new token.
---
### Author:  [@manics](https://discourse.jupyter.org/u/manics)
#### Post date: [September 26, 2023, 7:59pm UTC](https://discourse.jupyter.org/t/admin-panel-empty-getting-403-xsrf-argument-missing-from-get/21645/2 "2023-09-26T19:59:43Z")
To rule out `jhub_remote_user_authenticator`, can you test one of the standard authenticators (e.g. the dummy authenticator), and see if the problem still occurs?
---
### Author:  [@vanclaussen](https://discourse.jupyter.org/u/vanclaussen)
#### Post date: [September 26, 2023, 8:31pm UTC](https://discourse.jupyter.org/t/admin-panel-empty-getting-403-xsrf-argument-missing-from-get/21645/3 "2023-09-26T20:31:13Z")
I can try that tomorrow, however, the authenticator was in use since Hub version 2. Did something change in version 4?
edit: Using the DummyAuthenticator does not solve the problem.
edit2: I’m trying to narrow it down, the error comes from the tonardo server check\_xsrf\_cookie function. There is no header set to compare to, only the cookie.
Maybe I’m missing some options in Apache2? I also upgraded to apache 2.4 and am running behind a reverse proxy.
Can someone with knowledge about the cross site checking help maybe?
edit3: okay I did narrow it down:
I was overriding / providing **an old custom page.html** template. The newer templates do provide the xsrf\_token in the jhdata objects which is populated by jinja / when rendering the site.
Of course I did not have this attribute in my old overriding page.html, which was causing the error. Therefore deleting my custom page.html solved the issue…
Maybe note this in an upgrade guide if someone out there is also overriding the page.html?
Best regards
---
### Author:  [@bpfrd](https://discourse.jupyter.org/u/bpfrd)
#### Post date: [January 2, 2024, 8:38am UTC](https://discourse.jupyter.org/t/admin-panel-empty-getting-403-xsrf-argument-missing-from-get/21645/4 "2024-01-02T08:38:36Z")
> [@manics](#):
>
> hub\_remote\_user\_authenticator
Hi,
How did you fix the issue?
best
---
### Author:  [@vanclaussen](https://discourse.jupyter.org/u/vanclaussen)
#### Post date: [January 3, 2024, 10:18am UTC](https://discourse.jupyter.org/t/admin-panel-empty-getting-403-xsrf-argument-missing-from-get/21645/5 "2024-01-03T10:18:39Z")
Hi bpfrd,
I did narrow it down to the fact that the xsrf token was missing for the requests.
As I described above, I had an old custom page.html that was overriding the newer page.html (from updates).
My custom page.html lived in /etc/jupyterhub somewhere. After deleting this custom page.html the issue was gone.
Best regards