[Bug]: CSRF check failed #40626
Comments
Boc-chi-no
added
0. Needs triage
|
I have the same issue, the message appears each second in the nextcloud.log file just exhausting it: |
|
Receiving the same on 27.1, unable to login or reset password. |
|
Same here. with And in log : |
|
Same here, NC 28.0.3, issue comes and goes. Access via IOS app works, but not with browsers. |
|
My problem was resolved, and I was attempting to address another issue concerning slow access to Nextcloud. Upon checking the log, I discovered numerous occurrences of |
I just experienced this on Server 28.0.3. I visited the front page where it showed me the menus and chat mentions. I clicked the Log out link. The result was a Nextcloud-style Forbidden screen with a CSRF error. When I returned to the front page again and clicked Log out again, the problem went away that time. |
|
The issue persists on NC 29, if I leave a login idle it will timeout and rather than logout it creates the csrf failure. However the login is not closed as I can change the url and re access the session; despite the fact that the session end should have occurred. |
|
Do you have http2 enabled? I have this issue frequently, random things stop working with "Invalid action" error (like clicking on details of a file). Sometimes loading /files/files URL which should show root folder is just empty saying No Files. Refresh fixes it. |
|
This is still ongoing, for random actions. Like uploading file. Refreshing page fixes the issue. |
|
I'll see this now happening on nextcloud v30 on one instance 😕 |
|
OK, i could reduce via disabling |
joshtrichards
added
the
needs review
|
I still see a lot errors in my browsers and then empty file lists. they're gone after a few reloads. <?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
<s:exception>Interner Serverfehler</s:exception>
<s:message>
Der Server konnte die Anfrage nicht fertig stellen. Sollte dies erneut auftreten, senden Sie bitte die nachfolgenden technischen Einzelheiten an Ihren Server-Administrator. Weitere Details können im Server-Protokoll gefunden werden. </s:message>
<s:technical-details>
<s:remote-address>2001:9e8:f734:5900:199c:8858:7619:aa71</s:remote-address>
<s:request-id>m8HhXNUyUvsgjV3OGagL</s:request-id>
</s:technical-details>
</d:error> |
|
OK, i could solve it by moving the redis connections to my valkey master node only. It would be really nice if nextcloud can support redis+sentinel |
Bug description
I am getting frequent HTTP 412 errors, it says {"message": "CSRF check failed"}
I think everything I've configured is reasonable, since the upgrade to V26 it started to appear, recently upgraded to V27 the problem has become more frequent!
According to my experiments and observations I found that this problem may have something to do with the layout's head tag, I use the data-requesttoken returned to me by the page's head to make a request will generate a 412 error, But when I use "/csrftoken" to get the token, making the request works!
I have observed that this problem has been around for a long time and has not been resolved on the internet, so I hope to receive your further attention
I'd like to make a suggestion if it's possible to catch a 412 error on the front-end and then Call /csrftoke to refresh the CSRF Token and immediately re-request it?
https://github.com/nextcloud/server/blob/master/core/templates/layout.base.php#L3
https://github.com/nextcloud/server/blob/master/core/Controller/CSRFTokenController.php#L57
Steps to reproduce
1.Clocking a page
2.Accessing an interface without the @NoCSRFRequired annotation
Expected behavior
The request was successful
Installation method
Community Manual installation with Archive
Nextcloud Server version
27
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.0
Web server
Nginx
Database engine version
MySQL
Is this bug present after an update or on a fresh install?
Upgraded to a MAJOR version (ex. 22 to 23)
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
Configuration report
{ "system": { "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "memcache.local": "\\OC\\Memcache\\APCu", "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 6379 }, "trusted_domains": [ "xxxxxxx:xxxxx", ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "27.1.0.7", "overwrite.cli.url": "https:\/\/xxxxxx:xxxx\/xxxxxx\/", "overwriteprotocol": "https", "allow_local_remote_servers": "true", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "twofactor_enforced": "true", "tempdirectory": "\/data\/nextcloud_tmp\/", "default_language": "ja", "default_locale": "jp-JA", "twofactor_enforced_groups": [ "admin", ], "twofactor_enforced_excluded_groups": [], "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "smtp", "mail_sendmailmode": "smtp", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtpauthtype": "LOGIN", "mail_smtpauth": 1, "mail_smtpsecure": "tls", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "587", "mail_smtpname": "***REMOVED SENSITIVE VALUE***", "mail_smtppassword": "***REMOVED SENSITIVE VALUE***", "maintenance": false, "updater.release.channel": "stable", "theme": "", "loglevel": 0, "default_phone_region": "JP", "app_install_overwrite": [ "epubreader", "scanner" ], } }List of activated Apps
Nextcloud Signing status
No response
Nextcloud Logs
{"reqId":"7pguVp7wVcp1j7oblyn6","level":0,"time":"2023-09-26T02:54:55+00:00","remoteAddr":"xxxx","user":"xxxx","app":"no app in context","method":"GET","url":"/nextcloud/apps/xxxxxxxxxxxx","message":"CSRF check failed","userAgent":"xxxxxxxxxxxx","version":"27.1.0.7","exception":{"Exception":"OC\\AppFramework\\Middleware\\Security\\Exceptions\\CrossSiteRequestForgeryException","Message":"CSRF check failed","Code":412,"Trace":[{"file":"/xxxxx/wwwroot/nextcloud/nextcloud/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php","line":96,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\Security\\SecurityMiddleware","type":"->"},{"file":"/xxxxx/wwwroot/nextcloud/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":129,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\MiddlewareDispatcher","type":"->"},{"file":"/xxxxx/wwwroot/nextcloud/nextcloud/lib/private/AppFramework/App.php","line":183,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/xxxxx/wwwroot/nextcloud/nextcloud/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/xxxxx/wwwroot/nextcloud/nextcloud/lib/base.php","line":1068,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/xxxxx/wwwroot/nextcloud/nextcloud/index.php","line":36,"function":"handleRequest","class":"OC","type":"::"}],"File":"/xxxxx/wwwroot/nextcloud/nextcloud/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php","Line":224,"message":"CSRF check failed","exception":{},"CustomMessage":"CSRF check failed"}}Additional info
Nextcloud 27.1.0
The text was updated successfully, but these errors were encountered: