Re: Invalid origin null

Thank you John for your detailed response. This 'Invalid Origin null' problem has happened twice in about a year, both times to the same person.

I have logged it in our tracker and will pursue if becomes a problem.

Tom Ekberg
Senior Computer Specialist
Department of Laboratory Medicine and Pathology
4th Floor, Pat Steel Building, currently WFH
Home: (253) 561-2509
Email: [email protected]


-----Original Message-----
From: [email protected] <[email protected]> 
Sent: Wednesday, February 15, 2023 12:36 PM
To: Tom Ekberg <[email protected]>
Cc: Roundup Users ([email protected]) <[email protected]>
Subject: Re: [Roundup-users] Invalid origin null

Hi Tom:

In message <CO3PR08MB7957EC3A6271E42FECC87029CAA39@CO3PR08MB7957.namprd08.prod.
outlook.com>,
Tom Ekberg writes:
>My boss recently was saving an issue and got this error in his browser:
>
>Invalid Origin null
>
>The relevant code in roundup/cgi/client.py (v2.2) is:
> [...]
>     if enforce in ('required', 'yes'):
>       logger.error(self._("csrf Origin header check failed for user%s. 
>Value=%s"), current_user, origin)
        raise Unauthorised(self._("Invalid Origin %s"%origin))
>
>He says this was a new login.

Are these the steps he took:

  1. navigated to the tracker https://....
  2. logged in
  3. chose to create a new issue (*)
  4. submitted/saved the new issue
  5. got this error

If so, I can say I have never seen it.

What browser does he use? Are there any plugin/addons? Some browser plugins/web blockers can affect the origin header. Is this reproducible in his same browser? How about a different browser logged in as him?  Can you repoduce it in your browser? If so, try pulling up dev tools and recording the POST operation to see what the Origin header is set to to make sure it's the browser and not something else (firewall, proxy ....).

Does the logger.error output match the reported error?

Did he login then navigate to a new issue, or was he logged in and used a bookmark to get a new issue page.

(Using a bookmark shouldn't be an issue as a GET usually doesn't send an origin header. But if it did, I think the Origin header would be null.  In any case the code that rejects a null origin requires a POST not a GET so....)

The "null" origin header has a specific set of conditions when it's sent especially when doing a POST to the same origin:

  https://urldefense.com/v3/__https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin*description__;Iw!!K-Hz7m0Vt54!ibWLEvf-V-J6Uyx9peCso_e1OPyMDl7aQaw4eSf2q2q68nYAr7SdL3lWu8yIufF-aAJh6mXKf9ur0Ukx$ 

That page also links to a stack overflow expansion of the MDN answer.

The first thing that occurred to me was something setting the referer header to no-referer. Either in the http headers returned from your server or with something like:

  <meta name="referrer" content="no-referrer">

in the head/body of the page.

However, that should not affect the Origin header, but at least one person (on the stack overflow page referenced above) reported this interaction.

Also (*) check the link he used to open the new issue. Does it have a

   referrerpolicy="no-referrer"

or

   rel="noreferrer"

attribute? I am not sure what effect those could have on the new issue page's operation.

>We can turn this checking off in the config.ini file, but I'd rather 
>not.

I agree, turning off csrf protection code is not a good solution.

>Have you gotten this error when saving an issue? More importantly, does 
>the new roundup code address this problem?

A null origin should be rejected. Also nothing in the html indicates to the browser that it shouldn't be sending a valid origin header especially on same-origin POST requests. So there is nothing to address.

>The code in
>https://urldefense.com/v3/__https://github.com/roundup-tracker/roundup/
>blob/master/roundup/cgi/client.py__;!!K-Hz7m0Vt54!ibWLEvf-V-J6Uyx9peCso
>_e1OPyMDl7aQaw4eSf2q2q68nYAr7SdL3lWu8yIufF-aAJh6mXKfylU3C0p$
>looks about the same, but I don't know if that's the bleeding edge 
>roundup code.

The git repo has the newest code as of about 30 minutes ago. Better to check out the sourceforge repo though. But nothing in the flow control has changed there.

I have some pending changes to that code to extract error and logging messages and change the flow a bit for REST. But for html, flow/checks are the same.

Have a great afternoon.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.