nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

XSRF Security Token Missing when editing an issue

serge calderara

Dear all,

when I edit an issue in our Jira server instance, time to time we get a strange warning which is really enoying all our users.

I have check the log entry but notthing related to this error pops up

Any idea what could be the issue ?

It has appen since yesrday but no jira instance update has been made.

We are using Jira Server 8.4.3

Thanks for help

regards

Accepted answers

Albert Manuel

After hours and hours of researching and investigation, i found the solution. I will post it here for other that might have the same problem.

Go to <Jira-installation-directory>/conf, and edit the server.xml file.
Add <span>relaxedPathChars="[]|" </span>relaxedQueryChars="[]|{}^\`"<>" to the connector properties in server.xml. For example:

Add this line into the connector:

<Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;" maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false" maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443" acceptCount="100" disableUploadTimeout="true" bindOnInit="false"/>

Restart Jira.

This solved my problem.

The problem is in fact with tomcat wich is filtering out requests that contain special characters.

All comments

Andrew Morin

I know for my users this is usually due to an expired session. Logging out and back in fixes the issue.

sc_lt8t0d

What do you mean by expired session ? if session is expired the application should prompt you to login page automatically no ?

can you explain ?

In my case users get back to work this morning and theire surely login correctly from start so could not be same as you I guess

Adrian Stephen_q490r0

Hi @serge calderara

Can you confirm that URL used by the user is the same as configured at :

on the server.xml file
the baseurl configuration in Jira

If the user is using a different URL to access Jira, there is a possibility that they will run into this error message.

https://confluence.atlassian.com/kb/cross-site-request-forgery-csrf-protection-changes-in-atlassian-rest-779294918.html

There are other possible root causes here:

https://confluence.atlassian.com/bitbucketserverkb/xsrf-security-token-missing-779171343.html ( Bitbucket article but can also be applied to Jira )

Albert Manuel

After hours and hours of researching and investigation, i found the solution. I will post it here for other that might have the same problem.

Go to <Jira-installation-directory>/conf, and edit the server.xml file.
Add <span>relaxedPathChars="[]|" </span>relaxedQueryChars="[]|{}^\`"<>" to the connector properties in server.xml. For example:

Add this line into the connector:

<Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;" maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false" maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443" acceptCount="100" disableUploadTimeout="true" bindOnInit="false"/>

Restart Jira.

This solved my problem.

The problem is in fact with tomcat wich is filtering out requests that contain special characters.

Jason Chang_tqc81n

Unsung hero, thanks for going around and posting this fix.

asterr

I had a similar issue that start for one user profile (Chrome) a couple of days ago.

On further inspection, the following cookies were missing for the jira site (Server):

- atlassian.xsrf.token

- JSESSIONID

If the same user logged in with the same Chrome, but incognito mode, the cookies were created correctly. However, logging out and logging back in the problem profile failed to create those cookies.

The solution that worked in this case was:

1. In Chrome Inpect.

2. Application -> Storage -> Clear site data

This only cleared the storage for the JIRA site.

As soon as the storage was cleared, the cookies were created. The user did not need to logout / log back in.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-server