TeamCity CSRF error on login

Hi Raman,

If you are now unable to log in through your reverse proxy, consider the following:

1. To narrow down this issue, could you please temporarily disable CSRF protection by setting the internal property teamcity.csrf.origin.check.enabled=logOnly to check it?

2. What type of reverse proxy are you using? Ensure there are no issues with your reverse proxy configuration.

3. If you are using NGINX, you need to check the `X-Forwarded-Host` header, as it is related to the TeamCity CSRF check.

proxy_set_header X-Forwarded-Host $http_host; # Necessary for proper absolute redirects and TeamCity CSRF check

For more detailed information, please refer to Configuring Proxy Server (https://www.jetbrains.com/help/teamcity/configuring-proxy-server.html#NGINX) in the TeamCity documentation.

Thank you for your reply Tom Sun .

1. With that internal property, the error is different. I now see the following error on the frontend:

Clear the browser cookies or restart the browser to log in.

(And of course doing so makes no difference)

And in the auth log I see this:

[2024-06-21 11:50:09,718]  DEBUG [ no auth; http-nio-8111-exec-5] - [Presigned-Token Authentication] Authentication scheme is not applicable. jetbrains.buildServer.controllers.filters.DisableSessionCookieTokenAuthFilter$WrappedRequest@92df519
[2024-06-21 11:50:09,718]  DEBUG [ no auth; http-nio-8111-exec-5] - Request from origin http://ci.internal.example.com:80 is allowed by HTTP-Authentication scheme disabling logins from forbidden domain
[2024-06-21 11:50:09,718]  DEBUG [ no auth; http-nio-8111-exec-5] - No scheme was matched

Given this error, it seems maybe the problem is that I'm accessing the server over http and not https? Since the server is now on a private network, the nginx reverse proxy now listens on http port 80 rather than https port 443.

2. Nginx. The configuration looks good to me.

3. Yes, `X-Forwarded-Host` is set as documented. I didn't specify this because I gave the output logs from the auth log in the OP, and in those logs you can see the `X-Forwarded-Host` header is set and has the correct value.

> After configuring the proxy, please make sure that you have changed the Server URL value in TeamCity Global Settings to the proxy URL.

Tom Sun Yes, I had already done that. The server URL value matches the x-forwarded-host.

> Could you please share the NGINX config file? Files can be uploaded via https://uploads.jetbrains.com/. Please let us know the exact id after the upload.

I have uploaded the output of `nginx -T` to:

Upload id: 2024_06_21_wA8aWMmuywSCkX2sg9ubDq (file: nginx-config.txt)

The domain name was elided in the posts above, but the config you are looking for is server_name starting with “ci” listening on port 80. This server is not accessible from the Internet, you will get a 403 if trying to access it directly. Only the `/app/hooks/` endpoint is exposed to the Internet.

Thanks!

Since this is an internal server, I've tried bypassing the reverse proxy internally and logging in directly to the TeamCity port 8111. I've updated the Server URL in global settings to match.

Logging in to http://localhost:8111 works (via ssh port tunneling) but http://ci.internal.example.com:8111 fails with the same errors previously reported, including the CSRF error when CSRF is enabled again. Since no reverse proxy is involved in the connection to http://ci.internal.example.com:8111, that seems to prove the reverse proxy is not the issue here.

I see this error on the console log for the login.html page which I do not see when using localhost:8111:

setupServiceWorker.ts:17 Error cleaning caches ReferenceError: caches is not defined
   at Object.l [as cleanServiceWorkerCaches] (setupServiceWorker.ts:12:5)
   at login.html:297:30

It definitely has something to do with TeamCity not allowing requests from http except over localhost – when I issue a certificate for the internal server and connect to it over https through the reverse proxy, everything works fine. When connecting to it over http, TeamCity denies the request.

See the message I posted above:

[2024-06-21 11:50:09,718]  DEBUG [ no auth; http-nio-8111-exec-5] - Request from origin http://ci.internal.example.com:80 is allowed by HTTP-Authentication scheme disabling logins from forbidden domain
[2024-06-21 11:50:09,718]  DEBUG [ no auth; http-nio-8111-exec-5] - No scheme was matched

I'll probably just leave https enabled, though I suspect I could “fool” TeamCity by changing my reverse proxy to set x-forwarded-proto https so that TeamCity thinks the proxy request was secure. But it would still be nice to understand why this is happening.

Tom Sun I figured out the problem – my TeamCity Tomcat configuration `server.xml` contained “secure=true” and “scheme=https” for the Connector. This is why switching to http was not working.