XSRF Security Token Missing when editing an issue

[serge calderara]

Dear all,

when I edit an issue in our Jira server instance, time to time we get a strange warning which is really enoying all our users.

I have check the log entry but notthing related to this error pops up

Any idea what could be the issue ?

It has appen since yesrday but no jira instance update has been made.

We are using Jira Server 8.4.3

Thanks for help

regards

[Albert Manuel · Accepted solution]

After hours and hours of researching and investigation, i found the solution. I will post it here for other that might have the same problem.

• Go to <Jira-installation-directory>/conf, and edit the server.xml file.
• Add relaxedPathChars="[]|" relaxedQueryChars="[]|{}^\`"<>" to the connector properties in server.xml. For example:
• Add this line into the connector:

  <Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;" maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false" maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443" acceptCount="100" disableUploadTimeout="true" bindOnInit="false"/>

• Restart Jira.

This solved my problem.

The problem is in fact with tomcat wich is filtering out requests that contain special characters.

[Jason Chang]

Unsung hero, thanks for going around and posting this fix.

[asterr]

I had a similar issue that start for one user profile (Chrome) a couple of days ago.

On further inspection, the following cookies were missing for the jira site (Server):

- atlassian.xsrf.token

- JSESSIONID

If the same user logged in with the same Chrome, but incognito mode, the cookies were created correctly.  However, logging out and logging back in the problem profile failed to create those cookies.

The solution that worked in this case was:

1. In Chrome Inpect.

2. Application -> Storage -> Clear site data 

This only cleared the storage for the JIRA site.

As soon as the storage was cleared, the cookies were created.  The user did not need to logout / log back in.

[Adrian Stephen]

Hi @serge calderara 

Can you confirm that URL used by the user is the same as configured at :

• on the server.xml file 
• the baseurl configuration in Jira

If the user is using a different URL to access Jira, there is a possibility that they will run into this error message. 

• https://confluence.atlassian.com/kb/cross-site-request-forgery-csrf-protection-changes-in-atlassian-rest-779294918.html

There are other possible root causes here: 

• https://confluence.atlassian.com/bitbucketserverkb/xsrf-security-token-missing-779171343.html ( Bitbucket article but can also be applied to Jira )

[Andrew Morin]

I know for my users this is usually due to an expired session. Logging out and back in fixes the issue.

[sc]

What do you mean by expired session ? if session is expired the application should prompt you to login page automatically no ?

can you explain ?

In my case users get back to work this morning and theire surely login correctly from start so could not be same as you I guess