Getting CSRF (Cross site request forgery) error when running with Tomcat 8 Service (Windows)

Confluence User - 12 Jan, 2020

Everything works correctly when I start Joget with the supplied scripts but after installing the Tomcat8 service I get the following error when I try to log in;


*****************************************************
* Owasp.CsrfGuard Properties
*
* Logger: org.joget.commons.util.CsrfGuardLogger
* NewTokenLandingPage: null
* PRNG: SHA1PRNG
* SessionKey: OWASP_CSRFTOKEN
* TokenLength: 32
* TokenName: OWASP_CSRFTOKEN
* Ajax: true
* Rotate: false
* Javascript cache control: null
* Javascript domain strict: false
* Javascript inject attributes: false
* Javascript inject forms: false
* Javascript referer pattern: null
* Javascript referer match domain: false
* Javascript source file: null
* Javascript X requested with: null
* Protected methods: Empty HashSet
* Protected pages size: 0
* Unprotected methods: HashSet size: 1: [0]: GET

* Unprotected pages size: 3
* TokenPerPage: false
* Enabled: true
* ValidateWhenNoSessionExists: true
* Action: org.owasp.csrfguard.action.Log
* Parameter: Message = potential cross-site request forgery (CSRF) attack thwarted (user:%user%, ip:%remote_ip%, method:%request_method%, uri:%request_uri%, error:%exception_message%)
* Action: org.owasp.csrfguard.action.Error
* Parameter: Message = Security Violation.
* Parameter: Code = 403
* Action: org.owasp.csrfguard.action.Rotate
*****************************************************

Any recommendations on how to resolve this?


Thanks in advance,


ps

server;tomcat

4


13 Jan, 2020
confluenceUser
confluenceUser

Hi, the messages posted are not errors. Are there actual error messages in the logs? If it worked before installation of the windows service, I would suggest you verify the datasource settings, because the windows service would be running under a different user thus the configuration files could be in a different location.

13 Jan, 2020
confluenceUser
confluenceUser

Anders,

Thanks for replying.  The error is the same error posted on the thread How to overcome Security Violation (Code 403), as far as errors in the logs go there wasn't anything quite so obvious as the entry I posted which has the same 403 error listed in it.

This doesn't have anything to do with datasource settings, directory locations or user credentials as I was able to work around the problem by commenting out the CSRFGuard entries  in the web.xml.  Everything is working correctly now but I assume those entries exist for a reason and was hoping that someone could explain how to resolve the problem properly or look at why it is failing under this scenario.  I certainly would be reluctant to run it this way if this were a public facing or publicly hosted site.

Originally I was using jdk 13 so I tried downgrading to v8 but that also did not resolve the issue.  It's possible that the version of Tomcat is also a factor (v8.5.50) but that seems unlikely - I believe the issue to be in the joget code itself.

If there is anything else that I can provide to assist in debugging this problem, please let me know.

Regards,

ps


14 Jan, 2020
confluenceUser
confluenceUser

Are you running the service behind a web server or reverse proxy? If so, then you need to configure it correctly like in the question IIS Reverse Proxy For Joget (Tomcat)

15 Jan, 2020
confluenceUser
confluenceUser

Neither, it is being used internally and directly connected.

RELATED QUESTIONS

Your answer


To answer a question you'll need an account.

Print