Security Violation (Code 403) behind SSL load balance

Confluence User - 23 Mar, 2019

Hi - I have setup a joget server based on the docker instructions. everything works fine if I connect via http....

however if I connect through a load balancer with SSL certificate, when I try to make mysql changes, I get the 403 error.... is there a different connect string to mysql  I should be using. dont understand the difference in connecting with ssl https reroute to http...

this is what I did on the server. then for the load balance I simply reroute https  to http port 8080.... the app works but mysql changes error out

 

docker volume create jogetdata

docker run -d --name jogetdb -p 3306:3306 -e MYSQL_ROOT_PASSWORD=jwdb -e MYSQL_USER=joget -e MYSQL_PASSWORD=joget -e MYSQL_DATABASE=jwdb mysql:5.7

docker run -d --link jogetdb:jwdb --name joget -p 8080:8080 -e MYSQL_HOST=jwdb -e MYSQL_DATABASE=jwdb -e MYSQL_PORT=3306 -e MYSQL_USER=joget -e MYSQL_PASSWORD=joget --mount source=jogetdata,target=/opt/joget/wflow jogetworkflow/joget-professional

than

ssl;mysql;403

2


25 Mar, 2019
confluenceUser
confluenceUser

Good Morning - so I little more information as I try to address this issue. might help others in the future... the log as a csrf issue with using a load balance with https -> http url redirect.

Unprotected pages size: 3
* TokenPerPage: false
* Enabled: true
* ValidateWhenNoSessionExists: true
* Action: org.owasp.csrfguard.action.Log
* Parameter: Message = potential cross-site request forgery (CSRF) attack thwarted (user:%user%, ip:%remote_ip%, method:%request_method%, uri:%request_uri%, error:%exception_message%)
* Action: org.owasp.csrfguard.action.Error
* Parameter: Message = Security Violation.
* Parameter: Code = 403
* Action: org.owasp.csrfguard.action.Rotate

26 Mar, 2019
confluenceUser
1
confluenceUser

Hi, if it is a CSRF issue then it is likely a misconfiguration in your load balancer. There is a similar question at Missing CSRF token after F5 HTTP redirection to HTTPS

RELATED QUESTIONS

Your answer


To answer a question you'll need an account.

Print