Invalid origin null

My boss recently was saving an issue and got this error in his browser:

Invalid Origin null

The relevant code in roundup/cgi/client.py (v2.2) is:


        enforce=config['WEB_CSRF_ENFORCE_HEADER_ORIGIN']

        if 'HTTP_ORIGIN' in self.env and enforce != "no":

            if not self.is_origin_header_ok(api=api):

                origin = self.env['HTTP_ORIGIN']

                if enforce in ('required', 'yes'):

                    logger.error(self._("csrf Origin header check failed for user%s. Value=%s"), cu\

rrent_user, origin)

                    raise Unauthorised(self._("Invalid Origin %s"%origin))

He says this was a new login. We can turn this checking off in the config.ini file, but I'd rather not.

Have you gotten this error when saving an issue? More importantly, does the new roundup code address this problem?

The code in https://github.com/roundup-tracker/roundup/blob/master/roundup/cgi/client.py looks about the same, but I don't know if that's the bleeding edge roundup code.

Tom Ekberg
Senior Computer Specialist
Department of Laboratory Medicine and Pathology
4th Floor, Pat Steel Building, currently WFH
Home: (253) 561-2509
Email: [email protected]<mailto:[email protected]>

_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users