Question & Answer > View Question

Missing CSRF token after F5 HTTP redirection to HTTPS

Confluence User - 14 Jul, 2017

Hi,

Hit with this problem when turning the http redirection to https at my F5 Load balancer. Do help on the possible resolution for this issue.

Detail of the error log:

ERROR 9 Jul 2017 20:04:59 org.owasp.csrfguard.CsrfGuard - Referer domain https://<domain-name>/web/desktop does not match request domain: http://<domain-name>/csrf
ERROR 9 Jul 2017 20:05:02 org.owasp.csrfguard.CsrfGuard - Referer domain https://<domain-name>/web/userview/AppFeedback/PR_userview/_/home? does not match request domain: http://<domain-name>/csrf
ERROR 9 Jul 2017 20:05:11 org.owasp.csrfguard.CsrfGuard - Referer domain https://<domain-name>/web/userview/AppFeedback/PR_userview/_/newFeedback does not match request domain: http://<domain-name>/csrf
ERROR 9 Jul 2017 20:05:29 org.owasp.csrfguard.CsrfGuard - potential cross-site request forgery (CSRF) attack thwarted (user:<anonymous>, ip:X.X.X.X, method:POST, uri:/web/userview/AppFeedback/PR_userview/_/newFeedback, error:required token is missing from the request)
ERROR 9 Jul 2017 20:06:19 org.owasp.csrfguard.CsrfGuard - Referer domain https://<domain-name>/web/console/monitor/running?_ov=1499947577686 does not match request domain: http://<domain-name>/csrf

csrf;https;http

5

Confluence User •

14 Jul, 2017 •

confluenceUser •

•

confluenceUser •

Hi Oz Boo

Looks like you need to configure your proxy. I found more information using Google.

Confluence User •

14 Jul, 2017 •

confluenceUser •

•

confluenceUser •

Hi, I'm not sure this is the best place to get answers for F5 Load Balancer, but I did a google search and found this which might help https://devcentral.f5.com/questions/f5-ssl-tomcat-https-links-rendering

Confluence User •

28 Apr, 2020 •

confluenceUser •

•

confluenceUser •

Only way I know is disable it, you can change the value of "org.owasp.csrfguard.Enabled" to false in Owasp.CsrfGuard.properties file under "[tomcat directory]/webapps/jw/WEB-INF/classes".

Confluence User •

17 Jul, 2020 •

confluenceUser •

•

confluenceUser •

Good afternoon - any news information on this? we are also using a load balancer and wonder if there is any documentation in Apache or owasp.csrfguard setting to accepts both the http and https header?

Confluence User •

30 Oct, 2020 •

confluenceUser •

•

confluenceUser •

Hello,

I am using Joget in Docker with a Traefik reverse-proxy.

I have the same errors.

csrfguard is disabled in

/opt/joget/apache-tomcat-8.5.41/webapps/jw/WEB-INF/classes/Owasp.CsrfGuard.properties

with

# If csrfguard filter is enabled
org.owasp.csrfguard.Enabled = false

Do you have an example of setting up a reverse-proxy so as not to have any more csrf error.

Thank you

Didier

1

CSV | Excel | XML | PDF

Your answer

Print

Missing CSRF token after F5 HTTP redirection to HTTPS

5

RELATED QUESTIONS

Your answer

To answer a question you'll need an account.

5.builder-style-6d7f7a1e-e496-4f9f-91ee-6c4c0d298deb{color:#008C60 !important;}

RELATED QUESTIONS

Your answer.builder-style-1ab6d6ba-baa0-4be4-8f62-96a306ad730b{color:#008C60 !important; margin-left:10px !important;}

To answer a question you'll need an account.

5

Your answer