search

JetBrains / teamcity-azure-active-directory

TeamCity plugin which supports authentication via Microsoft Azure Active Directory
Apache License 2.0
26 stars 19 forks source link

Responding with 403 status code due to failed CSRF check #51

Closed jachin84 closed 3 years ago

jachin84 commented 3 years ago

After authenticating with Azure AD I'm see the following error:

403 Forbidden: Responding with 403 status code due to failed CSRF check: authenticated POST request is made, but neither tc-csrf-token parameter nor X-TC-CSRF-Token header are provided.. For a temporary workaround, you can set internal property teamcity.csrf.paranoid=false  and provide valid Origin=https://<fqhn> header with your request
SithVicious commented 3 years ago

The error tells you what to do: set internal property teamcity.csrf.paranoid=false Admin > Diagnostics > Internal Properties

Capture

jachin84 commented 3 years ago

I have those settings in place already and the error still occurs periodically.

I'm also suspicious that the error indicates these parameters should be set 'temporarily'.

bobbyinthedark commented 3 years ago

I'm having the same issue. The error message is pretty clear to use the paranoid=false setting as a temporary workaround, implying it's not suitable for production. The error is not blocking because if I hit enter in the browser URL bar, the error disappears and I can access the TC UI, but it's still a problem as all our users now have to face that and bypass it manually. Maybe some issue with the initial request (from AD callback/redirect URL?)

SithVicious commented 3 years ago

Perfect - this is working for me in latest update.

jachin84 commented 3 years ago

Why is this issue closed? It is pretty clear from the error message in TeamCity that the workaround is temporary. What is the permanent solution to this issue that does not involve disabling security protocols?

SithVicious commented 3 years ago

Why is this issue closed? It is pretty clear from the error message in TeamCity that the workaround is temporary. What is the permanent solution to this issue that does not involve disabling security protocols?

It was fixed in the latest version of the plugin.

https://github.com/JetBrains/teamcity-azure-active-directory/commit/546b31f27bc4d9f24fc3bc611562eaabf7141068

IlyaFomenko commented 3 years ago

Please install latest plugin version (0.7.0) You can find corresponding YT ticket here: https://youtrack.jetbrains.com/issue/TW-66220