Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Celebration

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root

Avatar

1 badge earned

Collect

Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!

Challenges
Coins

Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.

Recognition
Ribbon

Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!

Leaderboard

Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,467,582
Community Members
 
Community Events
177
Community Groups

Crowd XSRF Check failed with proxy script

Edited

I'm trying to use Crowd to authenticate users using a local MAC application. In my first question, I wanted to know how I can authenticate the user, and this is resolved. I was told, that I should write a proxy web application, so that the application user and application password is not exposed in the MAC application.

See:

https://community.atlassian.com/t5/Crowd-questions/Atlassian-Crowd-Authentication-with-FAT-client/qaq-p/926346?utm_source=atlcomm&utm_medium=email&utm_campaign=solution_to_question&utm_content=topic

I have created a PHP script, which acts as proxy, however now I get an XSRF Check Failed 403 Forbidden message when sending a post to the API, even though the IP has been configured as valid.

I was reading through the documentation and found this:

How to call protected REST APIs from third party websites
It is not possible to call protected APIs from third party websites as this would pose a security risk.

So how can I write a proxy application, when Atlassian doesn't allow third party websites?

Thanks,

Chris

2 answers

1 accepted

2 votes
Answer accepted

Hi @Christopher_Armstrong

How to call protected REST APIs from third party websites
It is not possible to call protected APIs from third party websites as this would pose a security risk.

The documentation you are referring to applies to Atlassian Cloud APIs. It does not apply to Crowd's REST API.

The problem you are facing here is due to the Httpful client library which sends a regular browser user-agent header along with the HTTP request. Thus, Crowd thinks the HTTP request comes from a regular browser and responds with a XSRF Check failed error.

You just need to change the value of the User-Agent header here (for instance PHP or even a blank value will work):

->addHeader('User-Agent','PHP')

Screen Shot 2018-11-04 at 20.45.39.png

Screen Shot 2018-11-04 at 20.46.43.png

Thanks a lot Bruno Vincent. That solved it. Your fast feedback is much appreciated guys.

1 vote

Hi! 

 

 

I use in my code parameter  'X-Atlassian-Token': 'no-check' like this

https://github.com/atlassian-api/atlassian-python-api/blob/master/atlassian/rest_client.py#L14

 

Hope it helps

 

Cheers,

Gonchik Tsymzhitov

Thanks a lot for this. I tried, but it didn't work. Still same message. Below my php code executed through Chrome.

 

<?php
include('./httpful.phar');

$uri = "http://thecrowd.url:8095/crowd/rest/usermanagement/1/session";
$body = "{\"username\": \"myuser\", \"password\":\"mypassword\", \"validation-factors\": { \"validationFactors\": [{\"name\": \"remote_address\", \"value\":\"127.0.0.1\"}]}}";

$response = \Httpful\Request::post($uri)
->authenticateWith('myappuser', 'myapppass')
->addHeader('Content-Type', 'application/json')
->addHeader('Accept', 'application/json')
->addHeader('X-Atlassian-Token', 'no-check')
->body($body)
->send();

/*
// Get Groups
$uri = "http://milk.tendswiss.ch:8095/crowd/rest/usermanagement/1/user/group/direct?username=christopher.armstrong@tend.swiss";

$response = \Httpful\Request::get($uri)
->authenticateWith('christest', '123456')
->addHeader('Content-Type', 'application/json')
->addHeader('Accept', 'application/json')
->send();
*/
/*
$response = \Httpful\Request::post($uri)
->authenticateWith('christest', '123456')
->addHeader('Content-Type', 'application/json')
->addHeader('Accept', 'application/json')
->send();
*/
echo "Done<br>";

var_dump($response);
?>

Hi! 

Is it possible to set header variable in all request?

 

 

Cheers,

Gonchik Tsymzhitov

What do you mean by "in all request"?

Currently I try to get this working, and this contains the X-Atlassian-Token header.

$uri = "http://thecrowd.url:8095/crowd/rest/usermanagement/1/session";
$body = "{\"username\": \"myuser\", \"password\":\"mypassword\", \"validation-factors\": { \"validationFactors\": [{\"name\": \"remote_address\", \"value\":\"127.0.0.1\"}]}}";

$response = \Httpful\Request::post($uri)
->authenticateWith('myappuser', 'myapppass')
->addHeader('Content-Type', 'application/json')
->addHeader('Accept', 'application/json')
->addHeader('X-Atlassian-Token', 'no-check')
->body($body)
->send();

Suggest an answer

Log in or Sign up to answer
TAGS

Atlassian Community Events