The authentification form url is relative "<form action="/auth/login/password:self/"', it ends in a AphrontCSRFException if :

• The user used an http:// url
• The phabricator.base-uri is https://

From what i see, if phabricator.base-uri is https:// the cookie is sent with the secure parameter, so the "token" POST parameter is considered as forged by Aphront.

It would be great if :

• If the phabricator.base-uri is https:// then all HTTP requests to phabricator are redirected to HTTPS (eventually controlled by a phabricator.force_secure parameter or so)

OR

• The Auth form action parameter is generated respecting the phabricator.base-uri parameter