“XSRF check failed” was disply in browser when I configured Mail Server at first

[JohnYu]

“XSRF check failed” was disply in browser when I configured Mail Server at first

my env as below:

Operating system:Linux2.6.32-431.el6.x86_64

Version4.0.2

Build number1427

Build date2020-05-18

[LynnG]

This is usually caused by Crowd rejecting the browser request because the request origin/referrer does not match the URL Crowd thinks it is running on. It often happens when Crowd is accessed through a reverse proxy, load balancer, HTTPS offload, or a URL different from the configured base URL.

For Crowd, Atlassian notes that XSRF warnings are generally logged when the request origin does not match its target, and recommends accessing Crowd through the exact configured base URL. If there is a reverse proxy, the Tomcat connector should include the correct proxyName, proxyPort, and scheme values. [support.at...assian.com]

Likely causes

1. Base URL mismatch

Check that you are accessing Crowd using the same URL configured as Crowd’s base URL.

For example, avoid mixing:

Plain Text

1

http://server:8095/crowd

2

https://crowd.example.com/crowd

3

http://ip-address:8095/crowd

Show more lines

Use only the configured public URL.

2. Reverse proxy missing connector settings

If Crowd is behind Apache, Nginx, F5, ELB, or another proxy, update:

Plain Text

1

<crowd-install>/apache-tomcat/conf/server.xml

Show more lines

Look for the HTTP connector and add values similar to:

XML

1

scheme="https"

2

proxyName="crowd.example.com"

3

proxyPort="443"

Show more lines

A community answer for a Crowd XSRF issue reported that adding proxyName, proxyPort, and scheme to Crowd’s server.xml fixed the problem when Crowd was behind Nginx or Apache. [community....assian.com]

Example:

XML

1

<Connector port="8095"

2

protocol="HTTP/1.1"

3

connectionTimeout="20000"

4

redirectPort="8443"

5

URIEncoding="UTF-8"

6

scheme="https"

7

proxyName="crowd.example.com"

8

proxyPort="443" />

Show more lines

Then restart Crowd.

3. Browser/session issue during first setup

If this happened only once during initial Mail Server configuration, also try:

• log out and log back in
• clear browser cache/cookies for Crowd
• use an incognito/private browser window
• access Crowd using the exact base URL only

Important note

Do not try to disable XSRF protection as a workaround. The better fix is to make sure Crowd’s public URL, reverse proxy headers, and Tomcat connector settings are consistent.

What I would check first

1. Confirm Crowd base URL.
2. Confirm the URL in the browser matches that base URL exactly.
3. If using a proxy, add or verify scheme, proxyName, and proxyPort in server.xml.
4. Restart Crowd and test Mail Server configuration again.