# SAML and XSRF - Jupyterhub 4.0.2

**URL:** https://discourse.jupyter.org/t/saml-and-xsrf-jupyterhub-4-0-2/21202
**Category:** JupyterHub
**Tags:** help-wanted
**Created:** [September 1, 2023, 4:54am UTC](https://discourse.jupyter.org/t/saml-and-xsrf-jupyterhub-4-0-2/21202 "2023-09-01T04:54:25Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![moloch](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@moloch](https://discourse.jupyter.org/u/moloch)
#### Post date: [September 1, 2023, 4:54am UTC](https://discourse.jupyter.org/t/saml-and-xsrf-jupyterhub-4-0-2/21202/1 "2023-09-01T04:54:25Z")

</div>

Hi,

We have installed Jupyterhub 4.0.2 with SAML authentication. However when we authenticate via SAML it seems to not work reporting a 403 error reporting that the \_xsrf token is missing. I can see that when the POST is sent via SAML it doesn’t have the token but when authenticating locally it does. How can I make sure the SAML post has this token?

Many thanks,

---

<div class="post-metadata">

### Author: ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)
#### Post date: [September 1, 2023, 9:42pm UTC](https://discourse.jupyter.org/t/saml-and-xsrf-jupyterhub-4-0-2/21202/2 "2023-09-01T21:42:16Z")

</div>

Is this the authenticator you’re using?

> **[GitHub - HewlettPackard/jupyterhub-samlauthenticator:...](https://github.com/HewlettPackard/jupyterhub-samlauthenticator/)**
>
> jupyterhub-samlauthenticator. Contribute to HewlettPackard/jupyterhub-samlauthenticator development by creating an account on GitHub.

Maybe it needs to be updated to work with JupyterHub 4? If you turn on debug logging you may get more information on which call is missing the XSRF token.

---

<div class="post-metadata">

### Author: ![moloch](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@moloch](https://discourse.jupyter.org/u/moloch)
#### Post date: [September 3, 2023, 10:35pm UTC](https://discourse.jupyter.org/t/saml-and-xsrf-jupyterhub-4-0-2/21202/3 "2023-09-03T22:35:38Z")

</div>

Hi there yeah that is the one. Is there any other recommended authenticator for saml that is compatible with jupyterhub 4?

---

<div class="post-metadata">

### Author: ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)
#### Post date: [September 5, 2023, 9:21am UTC](https://discourse.jupyter.org/t/saml-and-xsrf-jupyterhub-4-0-2/21202/4 "2023-09-05T09:21:10Z")

</div>

I don’t know of anything, maybe this is something the rest of the community can answer?

You could also open an issue on that project’s GitHub repo?