Discourse admin login throws 403 ["BAD CSRF"] error

Product Support

AI-generated summary

Discourse Admin Login Issue: 403 [“BAD CSRF”] Error

lzhang reported an issue with a Discourse instance on AWS with CentOS 7, where admin login attempts result in a 403 [“BAD CSRF”] error after a sudden change last Friday. The instance uses Docker with default settings, no reverse proxy, and no SSL.

mpalmer suggested investigating the change that occurred last Friday and examining network traffic to ensure cookies aren’t being stripped. Additionally, verifying session data in Redis was recommended.

lzhang performed a curl test within the Docker container to isolate the issue, but still encountered the 403 error.

codinghorror suspected a proxying issue, but acknowledged that it’s unlikely since no proxy or HTTPS is used.

lzhang confirmed that there is no reverse proxy in their AWS setup, and modifying related Nginx settings within the Docker container did not resolve the issue.

1

We had a discourse build on AWS with CentOS 7 operation system, we followed the document and used docker to build discourse with almost default settings. It was working well at first, but since last Friday suddenly we couldn’t login to it, got 403 [“BAD CSRF”] error doing any POST calls.

We didn’t use any reverse proxy in front of docker, we directly map the docker instance with 80 port of AWS server, we didn’t use ssl.

After getting the error, we tried pulling latest git code and did a full rebuild, but still getting the 403 error.

Any suggestions what else we could do?

Thanks,
Lei Zhang

2

Figure out what changed last Friday. Clearly something happened then. Absent that, you’ll probably want to examine the network traffic going into the app server (via tcpdump or strace) and make sure the cookies aren’t being stripped, then verify that the session data is correctly coming out of Redis.

3

Thanks Matt,

To eliminate the network and traffic influence, what I did earlier today was:

  1. Get into the docker container with command docker exec -it app /bin/bash
  2. Do curl call to localhost:3000 to get a csrf token:
    curl -X GET http://localhost:3000/session/csrf -H ‘X-Requested-With: XMLHttpRequest’.
  3. Then call a login request with the token got:
    curl -X POST http://localhost:3000/session -H ‘Content-Type: application/x-www-form-urlencoded’ -H ‘X-CSRF-Token: qh4CYDsFXIlZ70MJ7bz6FLHxrKRR0zVQoKLOPDyKeXJbkzV/+NEk3JTCaEDFcZ/vzAZa3MhKuETcquJ9zarTKw==’ -H ‘X-Requested-With: XMLHttpRequest’ -d ‘login=test&password=testpassword’

Still got 403 bad csrf error with that.

4

Are you doing proxying and not setting the proper HTTPS headers in your proxy? I believe lots of times I have seen this error, that has been the case.

Oh wait, I see you don’t use HTTPS or proxy, so that can’t be.

5

Hi Jeff,

We are not using reverse proxy or https, I’ve already checked the related issued raised by others in this forum, we don’t have reverse proxy in our aws layer, I tried modifying related nginx settings inside docker container but no luck with that.

Thanks,
Lei Zhang