SSL NGINX reverse proxy configuration and CSRF attack

[dasddd]

Hi,

does anybody have a working configuration for nginx and/or alfresco, using https.

I cannot set up nginx and/or alfresco without prompting CSRF attack in Alfresco logs (cannot log in).

If i set
proxy_set_header Host $host;

the error is:

SEVERE: Servlet.service() for servlet [Spring Surf Dispatcher Servlet] in context with path [/share] threw exception [Possible CSRF attack noted when asserting referer header 'https://ABC.ABC/share/page'. Request: POST /share/page/dologin, FAILED TEST: Assert referer POST /share/page/dologin :: referer: 'https://ABC.ABC/share/page' vs server & context: http://ABC.COM/ (string) or  (regexp)] with root cause

without the proxy_set_header Host $host;

the error is

SEVERE: Servlet.service() for servlet [Spring Surf Dispatcher Servlet] in context with path [/share] threw exception [Possible CSRF attack noted when asserting referer header 'https://ABC.ABC/share/page'. Request: POST /share/page/dologin, FAILED TEST: Assert referer POST /share/page/dologin :: referer: 'https://ABC.ABC/share/page' vs server & context: http://localhostort/ (string) or  (regexp)] with root cause

tried
proxy_set_header Host $http_host;  same result as first error

tried proxy_set_header Host $host$uri;

i get the error

SEVERE: Servlet.service() for servlet [Spring Surf Dispatcher Servlet] in context with path [/share] threw exception [Possible CSRF attack noted when asserting referer header 'https://ABC.ABC/share/page'. Request: POST /share/page/dologin, FAILED TEST: Assert referer POST /share/page/dologin :: referer: 'https://ABC.ABC/share/page' vs server & context: http://ABC.ABC/share/page/dologin/ (string) or  (regexp)] with root cause


I circumvented the problem by telling NGINX to revirte all the headers in certain manner

proxy_set_header Referer http://ABC.COM:XXXX/;
proxy_set_header Origin http://ABC.COM:XXXX/;

I guess i am asking how to tell nginx to write "https://ABC.ABC/share/page" and not "http://ABC.ABC/"

I have:
Alfresco 5.0d
Windows server 2008 R2
Nginx 1.9

[basti_g]

I may be wrong but I think you're bypassing the CSRF protection entirely that way.

To answer your question: I'm running Alfresco with an Nginx SSL offloading proxy but I did not get it working using proxy_set_header directives either.

If you use your Tomcat for Alfresco only you may simply override the connector scheme in server.xml:

<Connector port="8080" protocol="org.apache.coyote.http11.Http11AprProtocol"
    connectionTimeout="20000" redirectPort="8443"
    scheme="https" proxyName="your-domain.com" proxyPort="443" />
‍‍‍‍‍

Another option would be to point your nginx upstream resource to the https Tomcat connector on port 8443.
I just don't know how efficient that would be … performance should be better following the first approach.

Cheers,
Basti

[i2aml8]

I took care of it by overriding. Attached is my share-config-custom.xml (replace my.site.com)