Additional XSRF checks failed

[Michael Wolfe]

I'm using Apache to proxy connections over SSL.  Once I got this working I noticed that I wasn't able to update add-ons.  Here is the error message that appears in the logs. 

Additional XSRF checks failed for request: https://bitbucket.domain.com:7443/rest/plugins/1.0/ , origin: https://bitbucket.domain.com , referrer: https://bitbucket.domain.com/plugins/servlet/upm , credentials in request: true , allowed via CORS: false

Here is what I have configured in .properties

server.port=7990
server.address=<ipAddress>
server.redirect-port=7443
server.ssl.enabled=true

server.port=7443
server.address=<ipAddress>
server.secure=true
server.scheme=https
server.ssl.protocol=TLSv1.2
server.ssl.enabled=true
server.ssl.key-store=/usr/local/java/jre1.8.0_171/lib/security/cacerts
server.ssl.key-store-password=Passw0rd
server.ssl.key-password=Passw0rd
server.proxy-port=7443
server.proxyName=bitbucket.domain.com
#server.additional-connector.1.ssl.client-auth=want
server.ssl.key-store-type=jks

Can someone tell me what I'm missing?

[Rodrigo M]

Hello Michael

Looking at bitbucket.properties, it seems that you have a few duplicated parameters set, such as server.port. You need to set additional connectors using the prefix server.additional-connector.#, where # is the connector number. Please take a look at Server Connectors properties which describes the necessary connectors parameters.

We also have a KB for the XSRF errors, you may review it after setting the correct parameters on bitbucket.properties.

Rodrigo

[Michael Wolfe]

If I add server.additional-connector.1.port=7443 for SSL, bitbucket doesn't load in a web browser.  I'm currently proxying connections via Apache, so maybe there is something not working together as it should.  Seeing that I would rather my connections go over SSL I've even omitted 7990 and only specified 7443 for SSL, but ElasticSearch still fails to start.  Based on my Apache config for Bitbucket, and my .properties file, what do you suggest I change?  What I have configured below is what is working for the most part, but I still see errors about ElasticSearch failing.

<VirtualHost bitbucket.domain.com:80>
ServerName bitbucket.domain.com
Redirect / https://bitbucket.domain.com/

</VirtualHost>

<VirtualHost bitbucket.domain.com:443>
ServerName bitbucket.domain.com

SSLEngine on
SSLCertificateFile /etc/ca-certificates/bitbuckettestssl.cer
SSLCertificateKeyFile /etc/ca-certificates/bitbuckettestssl.key
SSLCertificateChainFile /etc/ca-certificates/root.crt

ProxyRequests Off
ProxyPreserveHost On

<Proxy *>
Order deny,allow
Allow from all
</Proxy>

SSLProxyEngine On
ProxyPass / https://bitbucket.domain.com:7443/
ProxyPassReverse / https://bitbucket.domain.com:7443/

</VirtualHost>

#server.port=7990
server.address=ipAddress
#server.redirect-port=7443
server.ssl.enabled=true

server.port=7443
server.secure=true
server.scheme=https
server.ssl.protocol=TLSv1.2
server.ssl.enabled=true
server.ssl.key-store=/usr/local/java/jre1.8.0_171/lib/security/cacerts
server.ssl.key-store-password=Passw0rd
server.ssl.key-password=Passw0rd
#server.proxy-port=7443
server.proxyName=bitbucket.domain.com
#server.additional-connector.1.ssl.client-auth=want
server.ssl.key-store-type=jks

[Rodrigo M]

Hi Michael

Are you attempting to terminate SSL on your proxy or Bitbucket level? 
We have an example on how to configure an apache proxy. Please take a look at the documents below:
Proxying and securing Bitbucket Server
Securing your Atlassian applications with Apache using SSL
Migrate server.xml customizations to bitbucket.properties

If you want to add an additional connector, you can add the server.additional-connector.1.port=7990 parameter for example. This way you could also access the application through port 7990 via HTTP.

Regarding elasticsearch, what is the error that is shown on the logs? You also may want to look at the Troubleshooting Connection Issues for Elasticsearch.

Regards
Rodrigo