Re: Invalid origin null

Hi Tom:

In message <CO3PR08MB7957EC3A6271E42FECC87029CAA39@CO3PR08MB7957.namprd08.prod.
outlook.com>,
Tom Ekberg writes:
>My boss recently was saving an issue and got this error in his browser:
>
>Invalid Origin null
>
>The relevant code in roundup/cgi/client.py (v2.2) is:
> [...]
>     if enforce in ('required', 'yes'):
>       logger.error(self._("csrf Origin header check failed for user%s. Value=%s"), current_user, origin)
        raise Unauthorised(self._("Invalid Origin %s"%origin))
>
>He says this was a new login.

Are these the steps he took:

  1. navigated to the tracker https://....
  2. logged in
  3. chose to create a new issue (*)
  4. submitted/saved the new issue
  5. got this error

If so, I can say I have never seen it.

What browser does he use? Are there any plugin/addons? Some browser
plugins/web blockers can affect the origin header. Is this
reproducible in his same browser? How about a different browser logged
in as him?  Can you repoduce it in your browser? If so, try pulling up
dev tools and recording the POST operation to see what the Origin
header is set to to make sure it's the browser and not something else
(firewall, proxy ....).

Does the logger.error output match the reported error?

Did he login then navigate to a new issue, or was he logged in and
used a bookmark to get a new issue page.

(Using a bookmark shouldn't be an issue as a GET usually doesn't send
an origin header. But if it did, I think the Origin header would be
null.  In any case the code that rejects a null origin requires a POST
not a GET so....)

The "null" origin header has a specific set of conditions when it's
sent especially when doing a POST to the same origin:

  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin#description

That page also links to a stack overflow expansion of the MDN answer.

The first thing that occurred to me was something setting the referer
header to no-referer. Either in the http headers returned from your
server or with something like:

  <meta name="referrer" content="no-referrer">

in the head/body of the page.

However, that should not affect the Origin header, but at least one
person (on the stack overflow page referenced above) reported this
interaction.

Also (*) check the link he used to open the new issue. Does it have a

   referrerpolicy="no-referrer"

or

   rel="noreferrer"

attribute? I am not sure what effect those could have on the new issue
page's operation.

>We can turn this checking off in the config.ini file, but I'd rather
>not.

I agree, turning off csrf protection code is not a good solution.

>Have you gotten this error when saving an issue? More importantly,
>does the new roundup code address this problem?

A null origin should be rejected. Also nothing in the html indicates
to the browser that it shouldn't be sending a valid origin header
especially on same-origin POST requests. So there is nothing to
address.

>The code in
>https://github.com/roundup-tracker/roundup/blob/master/roundup/cgi/client.py
>looks about the same, but I don't know if that's the bleeding edge
>roundup code.

The git repo has the newest code as of about 30 minutes ago. Better to
check out the sourceforge repo though. But nothing in the flow control
has changed there.

I have some pending changes to that code to extract error and logging
messages and change the flow a bit for REST. But for html, flow/checks
are the same.

Have a great afternoon.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.