Sudden HTTP 403 errors with Discourse Docker ("BAD CSRF")

[claas (Claas Aug.)]

We’re using Discourse Docker and getting HTTP 403 since yesterday (2024-12-21) when trying to login or (for those already logged in) to post a message. The error response is ["BAD CSRF"], which makes me think this security fix may have caused this regression:

SECURITY: Scrub headers to prevent access to files via nginx

Is anybody else experiencing these?

PS: The Discourse instance exists since 2020, and is updated automatically every night.

[claas (Claas Aug.)]

Maybe this will fix it in 3.3.4?

FIX: Simplify nginx config change (#30383)

See also:

SSO broken after rebuild with stable v3.3.3

I suspect the issue here is not the DiscourseConnect security fix but rather the nginx change. On tests-passed we had to make a followup on Thursday because it was causing problems on some environments and another user on Github noted CSRF issues. I have a backport ready for that: https://github.com/discourse/discourse/pull/30410, it should be merged shortly (once someone in the team approves it, though it’s Sunday for most people). You’re welcome to give that branch a try with your SSO set up @…

[sam (Sam Saffron)]

@claas

Maybe this will fix it in 3.3.4?

Can you try it out?

[claas (Claas Aug.)]

@sam Thank you, I just verified and I can log in again in 3.3.3 + 1, so the PR mentioned above resolved the issue.

[j.jaffeux (Joffrey Jaffeux)]

Thanks for checking!