Dify Enterprise Edition, after upgrading from 3.5.6 to 3.6.0, all API requests return 401 Unauthorized: {"code":"unauthorized","message":"CSRF token is missing or invalid.","status":401}

Help Me Build
1 
enterprise:
  enabled: true
  image:
    # g-hsod9681-docker.pkg.coding.net/dify-artifact/dify/dify-enterprise
    repository: langgenius/dify-enterprise
    tag: "0.12.5"
  replicas: 1
  resources: {}
  nodeSelector: {}
  affinity: {}
  tolerations: []
  readinessProbe:
    failureThreshold: 3
    httpGet:
      path: /v1/healthz
      port: 8082
      scheme: HTTP
    initialDelaySeconds: 30
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 3
  livenessProbe:
    failureThreshold: 3
    httpGet:
      path: /v1/healthz
      port: 8082
      scheme: HTTP
    initialDelaySeconds: 20
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 3
  extraEnv:
  # Apply your own Environment Variables if necessary. Below is demo.
  # extraEnv:
  #   - name: ENV_FROM_COMMUNITY1
  #     value: env123
  #   - name: ENV_FROM_COMMUNITY2
  #     value: env123
  appSecretKey: "#REPLACE_ME#"
  adminAPIsSecretKeySalt: "#REPLACE_ME#"
  innerApi:
    enabled: true
  corsOrigins: "All component domains, not listed here"

This was the CORS configuration used during the 3.5.6 deployment, and it was effective.

However, after upgrading to 3.6.0, this parameter is no longer available. Instead, the gateway now includes an additional configuration:

gateway:
  replicas: 1
  image:
    # g-hsod9681-docker.pkg.coding.net/dify-artifact/dify/enterprise_gateway
    repository: langgenius/enterprise_gateway
    tag: 0.13.0
  resources: {}
  nodeSelector: {}
  affinity: {}
  tolerations: []

  # additional origins to allow CORS requests from
  # if left empty, only dify domains will be allowed
  allowOrigins:
    - All component domains, not listed here
    - All component domains, not listed here
    - All component domains, not listed here

I also configured this, but after running helm upgrade, many links on the page returned 401 errors.

Even when I added the previous 3.5.6 parameters back, it had no effect. The entire environment is now unusable. Rolling back to 3.5.6 also fails — the API component’s pod cannot start, and it fails to launch.

The logs show the following:

/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
/entrypoint.sh: line 7: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
Running migrations
2025-12-12 09:28:01,267.267 INFO [MainThread] [utils.py:164] - NumExpr defaulting to 16 threads.
2025-12-12 09:28:06,241.241 INFO [MainThread] [aws_s3_storage.py:27] - Using ak and sk for S3
Preparing database migration…
Starting database migration.
INFO [alembic.runtime.migration] Context impl PostgresqlImpl.
INFO [alembic.runtime.migration] Will assume transactional DDL.
ERROR [flask_migrate] Error: Can’t locate revision identified by ‘03f8dcbc611e’

Now, I’m in a situation where I can’t roll back, and upgrading results in 401 errors — the entire environment is completely unusable.