Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

XSRF check failed with nginx and ssl




  • bitbucket server and nginx are on the same host.
  • Linux debian 9 (stretch)
  • nginx from official debian source
  • Atlassian Bitbucket v5.10.0
  • Physical host (not a VPS)

I have several problems setting up a bitbucket server with nginx and ssl.
I want to clarify that when I access the website from http://myhost:7990/ none of the following issues occur.

Several pages triggers "XSRF check failed" (adding user in a group, list of commits of a repo for example) when I look at the network tab of my firefox development tool, I have errors 403 with this response.

My nginx virtualhost settings:

server {
        location / {
                include proxy_params;
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header X-Forwarded-Server $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_redirect off;

        listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

server {
        if ($host = {
                return 301 https://$host$request_uri;
        } # managed by Certbot

        listen 80;
        return 404; # managed by Certbot

 My shared/



 And is configured in my url settings on the website.

I would just like to know how to solve this problem, except otherwise, the rest works pretty well :).

3 answers

1 accepted

0 votes
Answer accepted

After hours of trying several times on the nginx conf, I rebooted the server and made a reset cache (ctrl + f5 on firefox) and now everything works. I have no explanation, but the config posted above is still the same, if it helps someone.

Sorry for the inconvenience...

Have a nice day !

0 votes
Marek S_
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 24, 2023

Some REST API endpoints require:

-H "Content-type: application/json"

Missing that may cause the failure with:

XSRF check failed

For example, using the REST API endpoint to create a new user:

curl -u <Admin>:<Password> -X POST "<BaseURL>/rest/api/latest/admin/users?emailAddress=''&displayName='John%20Doe'&name='john'&password='Password'"
XSRF check failed

The same command with the required option works correctly:

curl -u <Admin>:<Password> -X POST -H "Content-type: application/json" "<BaseURL>/rest/api/latest/admin/users?emailAddress=''&displayName='John%20Doe'&name='john'&password='Password'"
0 votes
Gonchik Tsymzhitov
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
May 12, 2018



Could you provide info from  ?

include proxy_params;



Gonchik Tsymzhitov


I use it for most of my django processes.

proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

 I tried to remove it, but when I do it and I make a save (for example in the server settings) I am always redirected to or, it's problematic being given that bitbucket server is hosted on a dedicated


edit: I tried to disable the clones but it changes nothing, when "proxy_set_header Host $http_host;" is not define, I'm redirected to when I save on bitbucket settings.

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events