Hi Sergey,
I suspect this is a misconfiguration of Crowd, but it's hard to tell for sure with the information we so far. I would recommend taking a closer look at Cross Site Request Forgery (CSRF) protection changes in Atlassian REST. It explains a few conditions in which might trigger these CSRF/XSRF errors like this.
I'd also be interested to learn what site address you are accessing Crowd on when you see this error.
Since we know you're using Crowd with an nginx proxy, I'd be interested to learn more about the settings you have in the crowd server.xml file. This file governs Crowds tomcat webserver, what ports it is open on. There has to be at least one <connector> here, but there could be more. When you setup a reverse proxy, there should be other parameters added to that connector such as proxyName, proxyPort, and scheme for example. Without these, Crowd can be expected to have problems understanding where requests are really coming from.
There is also a document that might help with checking this configuration such as Configuring Crowd to Work with SSL. But also a non SSL nginx guide in the KB How to use NGINX to proxy requests for Crowd.
If you have to make any changes to that server.xml file, save it, and restart Crowd for these settings to take effect.
Please let me know.
Andy
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.