TeamCity Maintenance page - 403 Forbidden: CSRF Header X-TC-CSRF-Token does not match CSRF session value

Problem

After upgrading TeamCity and accessing the Maintenance Mode UI, the error message is given:

403 Forbidden: CSRF Header X-TC-CSRF-Token does not match CSRF session value <UUID>

Cause

• Most commonly, this error happens if the user has multiple TeamCity tabs open, and logs in and back out in one of them.
• Alternatively, it can happen due to a reverse proxy or load balancer issue - if TeamCity sits behind a proxy that strips or rewrites headers, the X-TC-CSRF-Token header may not reach the server correctly. However, in such a case, the issue would not be upgrade- or maintenance-page-specific

Resolution

• Hard-reload the page or clear browser cache and cookies for the TeamCity server URL, and retry accessing the Maintenance Mode UI.
• If a reverse proxy is used, verify the proxy settings and ensure it preserves the X-TC-CSRF-Token header.
• Temporarily relax CSRF checks via internal properties. This should not be used long-term in production.