I have Grafana running under Microsoft Internet Information Services (IIS). IIS is configured with URL Rewrite as a Reverse Proxy. After upgrading Grafana from version 8 to version 9 this no longer works. The dashboards are visble but show no data, and there is a popup with the warning 'Origin not allowed'
Grafana was updated to prevent a CRSF vulnerability. As a result it now checks for the origin of the request which is supposed to be in the header, but by default this is not passed by the IIS proxy. In the IIS manager, select Configuration Manager, go to section 'system.webServer.proxy', and set 'preserveHostHeader' to True.