xsrf token expire and admin session

[Jens Nachtigal]

Good afternoon,

we have moved Jira from Linux to Windows & https
The software works very well so far. The only problem is that the xsrf -token runs on every change, new task or project etc.
Logging in/out does not only help to reset the browser or delete cookies.
We also have the problem that you always have to log into the admin-backend like new, because the session is lost here

[Thomas Deiler]

Dear @Jens Nachtigal ,

this sounds like a web server issue. Are you using Apache, IE or Tomcat? How was the former configuration?

So long

Thomas

PS: Why did you move from Linux to Win?

[Jens Nachtigal]

We use default Tomcat on windows server.

Ic change the server.xml for https:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
connectionTimeout="20000" bindOnInit="false"
maxHttpHeaderSize="8192" SSLEnabled="true"
maxThreads="150" minSpareThreads="25"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
sslEnabledProtocols="TLSv1.2,TLSv1.3"
clientAuth="false" useBodyEncodingForURI="true"
keystorePass="password" keystoreFile="file:///C:/keyfile.jks"
keyAlias="tomcat" keystoreType="JKS"/>

[Jens Nachtigal]

[Thomas Deiler]

Dear @Jens Nachtigal ,

I made not positive experience by terminating SSL connections with Tomcat. That's also not really recommended by Atlassian. Instead install a reverse proxy in front of, like apache or nginx.

For nginx you can read my article.

For apache best perform this search.

So long

Thomas

[Jens Nachtigal]

For Bitbucket / Bamboo it works.

Only Jira has these errors. An extra webserver for this is no solution for us.
It is described here that it should basically work: https://confluence.atlassian.com/adminjiraserver/running-jira-applications-over-ssl-or-https-938847764.html