topic Re: SSL NGINX reverse proxy configuration and CSRF attack in Alfresco Archive

SSL NGINX reverse proxy configuration and CSRF attack

dasddd — Tue, 19 May 2015 09:43:22 GMT

Hi,does anybody have a working configuration for nginx and/or alfresco, using https.I cannot set up nginx and/or alfresco without prompting CSRF attack in Alfresco logs (cannot log in).If i setproxy_set_header Host $host;the error isEVERE: Servlet.service() for servlet [Spring Surf Dispatcher Serv

Re: SSL NGINX reverse proxy configuration and CSRF attack

basti_g — Wed, 20 May 2015 13:30:00 GMT

I may be wrong but I think you're bypassing the CSRF protection entirely that way.

To answer your question: I'm running Alfresco with an Nginx SSL offloading proxy but I did not get it working using proxy_set_header directives either.

If you use your Tomcat for Alfresco only you may simply override the connector scheme in server.xml:


<Connector port="8080" protocol="org.apache.coyote.http11.Http11AprProtocol"
    connectionTimeout="20000" redirectPort="8443"
    scheme="https" proxyName="your-domain.com" proxyPort="443" />
‍‍‍‍‍

Another option would be to point your nginx upstream resource to the https Tomcat connector on port 8443.
I just don't know how efficient that would be … performance should be better following the first approach.

Cheers,
Basti

Re: SSL NGINX reverse proxy configuration and CSRF attack

i2aml8 — Wed, 20 May 2015 23:56:54 GMT

I took care of it by overriding. Attached is my share-config-custom.xml (replace my.site.com)