Infos:
- Used Zammad version: 6.1.0-1700492762.96ac5a60.bionic
- Used Zammad installation type: package
- Operating system: Ubuntu 20.04.6 LTS
- Browser + version: Newest Chrome
Expected behavior:
I can put Tags in Tickets and refresh it
Actual behavior:
After putting a tag in a ticket the whole webpage refreshes and the tag is not set.
In F12 browser console I can see “401 unauthorized”
In the Zammad production.log I can see “CSRF token verification failed”:
I, [2024-03-21T09:17:12.693458#1657-6568960] INFO -- : Started PUT "/api/v1/taskbar/87615" for [IP] at 2024-03-21 09:17:12 +0100
I, [2024-03-21T09:17:12.697559#1657-6568960] INFO -- : Processing by TaskbarController#update as JSON
I, [2024-03-21T09:17:12.697636#1657-6568960] INFO -- : Parameters: {"key"=>"Ticket-8251", "callback"=>"TicketZoom", "state"=>{"ticket"=>{}, "article"=>{"form_id"=>"943761786"}}, "params"=>{"ticket_id"=>"8251", "init"=>true}, "prio"=>41, "notify"=>false, "active"=>false, "attachments"=>[], "updated_at"=>"2024-03-21T06:45:01.413Z", "id"=>"87615"}
I, [2024-03-21T09:17:12.706092#1657-6568960] INFO -- : CSRF token verification failed
I, [2024-03-21T09:17:12.706232#1657-6568960] INFO -- : CSRF token verification failed! (Exceptions::NotAuthorized)
app/controllers/application_controller/prevents_csrf.rb:36:in `verify_csrf_token'
app/controllers/application_controller/has_download.rb:17:in `block (4 levels) in <module:HasDownload>'
app/controllers/application_controller/has_download.rb:16:in `block (3 levels) in <module:HasDownload>'
app/controllers/application_controller/has_download.rb:15:in `block (2 levels) in <module:HasDownload>'
app/controllers/application_controller/handles_transitions.rb:16:in `handle_transaction'
I, [2024-03-21T09:17:12.707088#1657-6568960] INFO -- : Completed 401 Unauthorized in 9ms (Views: 0.1ms | ActiveRecord: 2.1ms | Allocations: 5284)
I, [2024-03-21T09:17:13.777762#1657-6568860] INFO -- : Started POST "/api/v1/signshow" for [IP] at 2024-03-21 09:17:13 +0100
Steps to reproduce the behavior:
Just add a tag.
Our zammad is running only in internal networks using a internal signed certificate(via Microsoft PKI) so all clients in our network accept it. That works without any problems.
This CSRF-Error happens since I changed the webserver from nginx to apache2 because we tried SSO. (I didnt got SSO to work and deleted the sso-lines but still would like to keep apache if possible)
Our /etc/apache2/sites-enabled/zammad.conf is copied from here: zammad/contrib/apache2/zammad_ssl.conf at develop · zammad/zammad · GitHub
Of course did I try to research how to fix this. And alot people said they fixed it using THE “zammad-le-ssl.conf”-file. This file seems unexistent on our machine.
I had also a look in sites-available.
Here our censored apache2 zammad.conf file:
ServerName [name].[domain]
LogLevel debug
# security - prevent information disclosure about server version
ServerTokens Prod
<VirtualHost *:80>
ServerAlias [name]
Redirect permanent / https://[name].[domain]
</VirtualHost>
<VirtualHost *:443>
ServerAlias [name]
SSLEngine on
SSLCertificateFile "/etc/ssl/certs/zammad.pem"
SSLCertificateKeyFile "/etc/ssl/private/zammad.key"
## don't loose time with IP address lookups
HostnameLookups Off
## needed for named virtual hosts
UseCanonicalName On
## configures the footer on server-generated documents
ServerSignature Off
ProxyRequests Off
ProxyPreserveHost On
<Proxy 127.0.0.1:3000>
Require local
</Proxy>
RequestHeader set X_FORWARDED_PROTO 'https'
RequestHeader set X-Forwarded-Ssl on
ProxyPass /assets !
ProxyPass /favicon.ico !
ProxyPass /apple-touch-icon.png !
ProxyPass /robots.txt !
# legacy web socket server
ProxyPass /ws ws://127.0.0.1:6042/
# action cable
ProxyPass /cable ws://127.0.0.1:3000/cable
ProxyPass / http://127.0.0.1:3000/
# change this line in an SSO setup
RequestHeader unset X-Forwarded-User
# Use settings below if proxying does not work and you receive HTTP-Errror 404
# if you use the settings below, make sure to comment out the above two options
# This may not apply to all systems, applies to openSuse
#ProxyPass /ws ws://127.0.0.1:6042/ "retry=1 acque=3000 timeout=600 keepalive=On"
#ProxyPass /cable ws://127.0.0.1:3000/cable "retry=1 acque=3000 timeout=600 keepalive=On"
#ProxyPass / http://127.0.0.1:3000/ "retry=1 acque=3000 timeout=600 keepalive=On"
DocumentRoot "/opt/zammad/public"
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory "/opt/zammad/public">
Options FollowSymLinks
Require all granted
</Directory>
</VirtualHost>
Im thankful for any help. I cant see my mistake here.
