XSRF check failed with nginx and ssl

[Fabien ROUSSEAU]

Hi,

Specs:

• bitbucket server and nginx are on the same host.
• Linux debian 9 (stretch)
• nginx from official debian source
• Atlassian Bitbucket v5.10.0
• Physical host (not a VPS)

I have several problems setting up a bitbucket server with nginx and ssl.
I want to clarify that when I access the website from http://myhost:7990/ none of the following issues occur.

Several pages triggers "XSRF check failed" (adding user in a group, list of commits of a repo for example) when I look at the network tab of my firefox development tool, I have errors 403 with this response.

My nginx virtualhost settings:

server {
        server_name repos.domain.com;
        location / {
                proxy_pass http://127.0.0.1:7990;
                include proxy_params;
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header X-Forwarded-Server $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_redirect off;
        }

        listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/repos.domain.com/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/repos.domain.com/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}
server {
        if ($host = repos.domain.com) {
                return 301 https://$host$request_uri;
        } # managed by Certbot


        listen 80;
        server_name repos.domain.fr;
        return 404; # managed by Certbot
}

 My shared/bitbucket.properties

jdbc.driver=org.postgresql.Driver
jdbc.url=jdbc:postgresql://myhost:port/repos
jdbc.user=user
jdbc.password=passwd

server.port=7990
server.secure=true
server.scheme=https
server.proxy-port=443
server.proxy-name=repos.domain.com

 And http://repos.domain.com is configured in my url settings on the website.

I would just like to know how to solve this problem, except otherwise, the rest works pretty well :).

[Fabien ROUSSEAU · Accepted solution]

After hours of trying several times on the nginx conf, I rebooted the server and made a reset cache (ctrl + f5 on firefox) and now everything works. I have no explanation, but the config posted above is still the same, if it helps someone.

Sorry for the inconvenience...

Have a nice day !

[Marek Suchecki]

Some REST API endpoints require:

-H "Content-type: application/json"

Missing that may cause the failure with:

XSRF check failed

For example, using the REST API endpoint to create a new user:

curl -u <Admin>:<Password> -X POST "<BaseURL>/rest/api/latest/admin/users?emailAddress='john@example.com'&displayName='John%20Doe'&name='john'&password='Password'"
XSRF check failed

The same command with the required option works correctly:

curl -u <Admin>:<Password> -X POST -H "Content-type: application/json" "<BaseURL>/rest/api/latest/admin/users?emailAddress='john@example.com'&displayName='John%20Doe'&name='john'&password='Password'"

[Gonchik Tsymzhitov]

Hi! 

Could you provide info from  ?

include proxy_params;

Cheers,

Gonchik Tsymzhitov

[Fabien ROUSSEAU]

Hi,

I use it for most of my django processes.

proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

 I tried to remove it, but when I do it and I make a save (for example in the server settings) I am always redirected to http://127.0.0.1:7990 or, it's problematic being given that bitbucket server is hosted on a dedicated

edit: I tried to disable the clones but it changes nothing, when "proxy_set_header Host $http_host;" is not define, I'm redirected to http://127.0.0.1:7990 when I save on bitbucket settings.