[SOLVED] After restoring backup: CSRF token validation failed

Infos:

  • Used Zammad version: 6.2.0-1711375558.ce1240f3.bookworm
  • Used Zammad installation type: package
  • Operating system: Debian 12
  • Browser + version: Firefox 124.0.2

A freshly installed virgin zammad on this machine works, installed natively, behind apache2. However, after restoring a backup from a docker install, users cannot log on. I have run postinstall.sh after restoring, which has made this instance reachable again, but again, I unfortunately can’t log on.

Expected behavior:

Should be able to log in

Actual behavior:

Login fails with message CSRF token validation failed

production.log says:


I, [2024-04-07T08:28:13.404458#678-142620]  INFO -- : Started POST "/api/v1/signin" for 2003:d3:c719:8b00::4c4 at 2024-04-07 08:28:13 +0000
I, [2024-04-07T08:28:13.411236#678-142620]  INFO -- : Processing by SessionsController#create as JSON
I, [2024-04-07T08:28:13.411294#678-142620]  INFO -- :   Parameters: {"username"=>"**@**.org", "password"=>"[FILTERED]", "remember_me"=>"1", "f
ingerprint"=>"-449639643"}
I, [2024-04-07T08:28:13.414886#678-142620]  INFO -- : CSRF token verification failed
I, [2024-04-07T08:28:13.415001#678-142620]  INFO -- : CSRF token verification failed! (Exceptions::NotAuthorized)
app/controllers/application_controller/prevents_csrf.rb:36:in `verify_csrf_token'
app/controllers/application_controller/has_download.rb:17:in `block (4 levels) in <module:HasDownload>'
app/controllers/application_controller/has_download.rb:16:in `block (3 levels) in <module:HasDownload>'
app/controllers/application_controller/has_download.rb:15:in `block (2 levels) in <module:HasDownload>'

Steps to reproduce the behavior:

Install zammad natively, restore backup from docker host

Solved it by adding

    RequestHeader set X_FORWARDED_PROTO 'https' 
    RequestHeader set X-Forwarded-Ssl on

to the vhost config. why isn’t is there by default?

Because it isn’t always required to do it that way.

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.