Crowd session immediately expires in Firefox

Sergey Kachanovskiy

Crowd 3.4.0 on linux, behind nginx for SSL.

 

When I login into Crowd for some admin tasks using Firefox, I am taken to first page (which sadly in my case is still "please configure your mail server") and then when I click any menu item to go there, I am kicked out to login page. When I enter login/password - I am taken to required page, but next click also takes me back to login page.

All works fine from Chrome.

Not sure if this is relevant, but I am seeing the following in Crowd logs:
2019-05-17 13:46:30,576 http-nio-127.0.0.1-8095-exec-17 WARN [common.security.jersey.XsrfResourceFilter] XSRF failure not being enforced for request: https://crowdserver/crowd/rest/usermanagement/1/session/H-cUUA5J5uCUPQ2pOw3oDwAAAAAAAoABbG9jYWwuYWRtaW4uY3Jvd2Q%3D , origin: null , referrer: null, method: DELETE
2019-05-17 13:51:55,616 http-nio-127.0.0.1-8095-exec-23 WARN [common.security.jersey.XsrfResourceFilter] XSRF failure not being enforced for request: https://crowdserver/crowd/rest/usermanagement/1/session/LP4E6EfJNvxt-eVNOJJSGwAAAAAAAoABbG9jYWwuYWRtaW4uY3Jvd2Q%3D , origin: null , referrer: null, method: DELETE
2019-05-17 13:53:45,626 http-nio-127.0.0.1-8095-exec-10 WARN [common.security.jersey.XsrfResourceFilter] XSRF failure not being enforced for request: https://crowdserver/crowd/rest/usermanagement/1/session/Iq_iW-SEINOTxPKJCjkdLQAAAAAAAoABbG9jYWwuYWRtaW4uY3Jvd2Q%3D , origin: null , referrer: null, method: DELETE

and this kind of coincides with my activity.

is there any misconfiguration? or is it a bug?

 

Andy Heinzer

Hi Sergey,

I suspect this is a misconfiguration of Crowd, but it's hard to tell for sure with the information we so far.  I would recommend taking a closer look at Cross Site Request Forgery (CSRF) protection changes in Atlassian REST.  It explains a few conditions in which might trigger these CSRF/XSRF errors like this.

I'd also be interested to learn what site address you are accessing Crowd on when you see this error.

Since we know you're using Crowd with an nginx proxy, I'd be interested to learn more about the settings you have in the crowd server.xml file.  This file governs Crowds tomcat webserver, what ports it is open on.  There has to be at least one <connector> here, but there could be more.  When you setup a reverse proxy, there should be other parameters added to that connector such as proxyName, proxyPort, and scheme for example.  Without these, Crowd can be expected to have problems understanding where requests are really coming from.

There is also a document that might help with checking this configuration such as Configuring Crowd to Work with SSL. But also a non SSL nginx guide in the KB How to use NGINX to proxy requests for Crowd.

If you have to make any changes to that server.xml file, save it, and restart Crowd for these settings to take effect.

Please let me know.

Andy