Error in log: credentials in request: true , allowed via CORS: false

[Sonja_Linsi]

Hello

Various actions in the Crowd web interface generates this and similar errors:

2019-05-22 13:15:46,085 http-nio-8095-exec-17 WARN [common.security.jersey.XsrfResourceFilter] Additional XSRF checks failed for request: http://deutz.domain.ch:8095/crowd/rest/admin/1.0/mail/configuration , origin: https://jira.domain.ch , referrer: https://jira.domain.ch/crowd/console/secure/admin/mailserver.action , credentials in request: true , allowed via CORS: false

It happens when clicking on password reset, sending test email, create support.zip.

Base URL of crowd is https://jira.domain.ch/crowd and the hostname is deutz.domain.ch.  

Crowd is running in following environment:

• Application serverApache Tomcat/8.5.40
• Crowd version 3.4.4 Build number1069 Build date2019-05-02
• Java version 1.8.0_152
• PostgreSQL 9.6
• OS: Debian 4.9
• Does anyone know how to fix this problem.

Thank you and best regards

Sonja

[sara]

This is due to cross origin headers.This can be fixed by enabling cors in web.xml in tomcat.

[Sonja_Linsi]

Hi Sarath

Thank you for the hint. I tried it with this cors Filter incrowd/install/apache-tomcat/conf/web.xml  but didn't work i have still the same error:

<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>

<init-param>

<param-name>cors.allowed.origins</param-name>

<param-value>/*</param-value>

</init-param>

<init-param>

<param-name>cors.allowed.methods</param-name>

<param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>

</init-param>

<init-param>

<param-name>cors.exposed.headers</param-name>

<param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>

</init-param>

<init-param>

<param-name>cors.support.credentials</param-name>

<param-value>true</param-value>

</init-param>

<init-param>

<param-name>cors.preflight.maxage</param-name>

<param-value>1800</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>CorsFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

[sara]

This can also be configured in proxy by allow origin tag.