Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

XSRF check failed with nginx and ssl

Fabien ROUSSEAU May 12, 2018

Hi,

Specs:

  • bitbucket server and nginx are on the same host.
  • Linux debian 9 (stretch)
  • nginx from official debian source
  • Atlassian Bitbucket v5.10.0
  • Physical host (not a VPS)

I have several problems setting up a bitbucket server with nginx and ssl.
I want to clarify that when I access the website from http://myhost:7990/ none of the following issues occur.

Several pages triggers "XSRF check failed" (adding user in a group, list of commits of a repo for example) when I look at the network tab of my firefox development tool, I have errors 403 with this response.

My nginx virtualhost settings:

server {
        server_name repos.domain.com;
        location / {
                proxy_pass http://127.0.0.1:7990;
                include proxy_params;
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header X-Forwarded-Server $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_redirect off;
        }

        listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/repos.domain.com/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/repos.domain.com/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}
server {
        if ($host = repos.domain.com) {
                return 301 https://$host$request_uri;
        } # managed by Certbot


        listen 80;
        server_name repos.domain.fr;
        return 404; # managed by Certbot
}

 My shared/bitbucket.properties

jdbc.driver=org.postgresql.Driver
jdbc.url=jdbc:postgresql://myhost:port/repos
jdbc.user=user
jdbc.password=passwd

server.port=7990
server.secure=true
server.scheme=https
server.proxy-port=443
server.proxy-name=repos.domain.com

 And http://repos.domain.com is configured in my url settings on the website.

I would just like to know how to solve this problem, except otherwise, the rest works pretty well :).

3 answers

1 accepted

0 votes
Answer accepted
Fabien ROUSSEAU May 12, 2018

After hours of trying several times on the nginx conf, I rebooted the server and made a reset cache (ctrl + f5 on firefox) and now everything works. I have no explanation, but the config posted above is still the same, if it helps someone.

Sorry for the inconvenience...

Have a nice day !

0 votes
Marek Suchecki
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 24, 2023

Some REST API endpoints require:

-H "Content-type: application/json"

Missing that may cause the failure with:

XSRF check failed

For example, using the REST API endpoint to create a new user:

curl -u <Admin>:<Password> -X POST "<BaseURL>/rest/api/latest/admin/users?emailAddress='john@example.com'&displayName='John%20Doe'&name='john'&password='Password'"
XSRF check failed

The same command with the required option works correctly:

curl -u <Admin>:<Password> -X POST -H "Content-type: application/json" "<BaseURL>/rest/api/latest/admin/users?emailAddress='john@example.com'&displayName='John%20Doe'&name='john'&password='Password'"
0 votes
Gonchik Tsymzhitov
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
May 12, 2018

Hi! 

 

Could you provide info from  ?

include proxy_params;

 

Cheers,

Gonchik Tsymzhitov

Fabien ROUSSEAU May 12, 2018

Hi,

I use it for most of my django processes.

proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

 I tried to remove it, but when I do it and I make a save (for example in the server settings) I am always redirected to http://127.0.0.1:7990 or, it's problematic being given that bitbucket server is hosted on a dedicated

 

edit: I tried to disable the clones but it changes nothing, when "proxy_set_header Host $http_host;" is not define, I'm redirected to http://127.0.0.1:7990 when I save on bitbucket settings.

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events