pjv
commented
4 years ago this is the nginx config from the host for proxying to zammad:
server {
listen 80;
server_name helpdesk.example.com;
return 301 https://helpdesk.example.com$request_uri;
}
server {
listen 443 ssl;
server_name helpdesk.example.com;
# SSL configs
ssl_certificate /var/www/certs/bt.com.cert.pem;
ssl_certificate_key /var/www/certs/bt.com.key.pem;
ssl_dhparam /etc/nginx/dhparams.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 180m;
access_log /var/log/nginx/helpdesk.example.com.access.log;
error_log /var/log/nginx/helpdesk.example.com.error.log;
location / {
#proxy_pass http://localhost:5000/;
proxy_pass http://127.0.0.1:5000/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forward-Proto https;
proxy_set_header X-Nginx-Proxy true;
proxy_redirect off;
}
}And the docker-compose-override.yml looks like this:
version: '2'
services:
zammad-nginx:
ports:
- "5000:80"
volumes:
- ./custom/zammad.conf:/opt/zammad/contrib/nginx/zammad.conf
MrGeneration
monotek
stale[bot]
ethrgeist
stopak
thorsteneckel
TuringTux
Infos:
Expected behavior:
Able to log in
Actual behavior:
Not able to log in with CSRF token validation error
Steps to reproduce the behavior:
Try to log in after upgrading from Zammad 3.3X to 3.4.0-4.
I had a working docker install of Zammad v 3.3.x running behind an nginx proxy on the host which handles SSL (this host itself is behind cloudflare proxy which provides the SSL certs). I solved prior CSRF token validation issues by using the
zammad.confprovided here.I upgraded this morning by pulling the latest version of this repo, docker-compose pulling the latest images, and then docker-compose up. Now I have the CSRF token validation error again on trying to log in. I have tried all the prior fixes that I could find from issues here at github and from the zammad forum but nothing works.
I have a bunch of customer service agents that are going to arrive at their desks in an hour or two who are not going to be able to log in to Zammad. Any help appreciated.
I'm guessing that this issue is somehow related to #166 (by @monotek) but I don't know enough about what those commits are doing to figure out what to try.