Bitbucket Push Webhook fails invoking REST endpoint - XSRF check failed

[shivaarava]

I created a "Push" webhook in Bitbucket and when I try testing the URL, I come back with this error.

When I test the connection with the details below.  the test fails with "XSRF check failed" message.

However, when I have the REST service deployed on my local tomcat instance, such as - http://localhost:8080/bb_v1/api/webhook/postcommit, the call works.

Failure scenario

URL - http://machinename:7990/rest/v1_4_bb/1.1/webhook/postcommit

Request details

Event type:

Test connection event

URL endpoint:

http://machinename:7990/rest/v1_4_bb/1.1/webhook/postcommit

Headers

X-Request-Id: fd3c22ca-23b3-486a-9ad5-a1f5c5f5b4f1
X-Event-Key: diagnostics:ping

Body

No body

Response details

HTTP status:

403

Headers

X-AREQUESTID: @15H2BMUx691x42x1
Transfer-Encoding: chunked
X-ASEN: SEN-L9863425
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Date: Mon, 12 Mar 2018 15:31:23 GMT
Via: 1.1 localhost (Apache-HttpClient/4.4.1 (cache))
Content-Type: text/html

Body

XSRF check failed

[Rodion Alukhanov]

Bitbucket sends the requests. What service receives this request? It it is an Atlassian product like Atlassian Bamboo, the solution is described here:

https://confluence.atlassian.com/cloudkb/xsrf-check-failed-when-calling-cloud-apis-826874382.html

You need to add a additional Header. 

    X-Atlassian-Token: no-check

I would expect BitBucket sets such a header by default. Is it possible, you have some old version or some proxy server in between?

Alternately - in case of Bamboo - you can disable the XSRF protection in Security Settings. 

[Rodrigo M]

Hey Shivaarava

Usually XSRF check failed errors are related to proxy configuration.

Can you please take a look at the Cross Site Request Forgery (CSRF) protection changes in Atlassian REST and try the resolutions mentioned on that article?

Regards!

Rodrigo.