Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-14265

Enabling XSRF protection in Bamboo causes the Stash build Post-Receive WebHook request to fail

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Answered
    • Icon: Low Low
    • None
    • 5.3
    • None

      As already detailed in BAM-14129, we're also facing the same error with Stash and Bamboo. When Stash tries to trigger a build request over the Post-Receive WebHook and XSRF protection is enabled this request fails:

      Bamboo Log:
      2014-01-31 09:44:28,008 WARN [http-bio-8085-exec-19] [BambooXsrfTokenInterceptor] XSRF token validation failed in session:null due to XSRF_FAILURE_NO_TOKEN_IN_COOKIE
2014-01-31 09:44:28,008 ERROR [http-bio-8085-exec-19] [ExceptionMappingInterceptor] XSRF Token Validation failed (XSRF_FAILURE_NO_TOKEN_IN_COOKIE).
java.lang.IllegalArgumentException: XSRF Token Validation failed (XSRF_FAILURE_NO_TOKEN_IN_COOKIE).
	at com.atlassian.bamboo.ww2.interceptors.BambooXsrfTokenInterceptor.doIntercept(BambooXsrfTokenInterceptor.java:64)
	at com.atlassian.bamboo.ww2.interceptors.AbstractBambooInterceptor.intercept(AbstractBambooInterceptor.java:34)
	at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
	at com.atlassian.xwork.interceptors.AroundInterceptor.intercept(AroundInterceptor.java:25)
	at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
	at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:252)
	at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
	...

2014-01-31 09:44:28,013 ERROR [http-bio-8085-exec-19] [FiveOhOh] 500 Exception was thrown.
java.lang.IllegalArgumentException: XSRF Token Validation failed (XSRF_FAILURE_NO_TOKEN_IN_COOKIE).
	at com.atlassian.bamboo.ww2.interceptors.BambooXsrfTokenInterceptor.doIntercept(BambooXsrfTokenInterceptor.java:64)
	at com.atlassian.bamboo.ww2.interceptors.AbstractBambooInterceptor.intercept(AbstractBambooInterceptor.java:34)
	at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
	at com.atlassian.xwork.interceptors.AroundInterceptor.intercept(AroundInterceptor.java:25)
	at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
	at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:252)
	at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
	...

      After disabling XSRF protection the build starts just fine. We're using Stash v2.10.1 and Bamboo 5.3 behind a proxy.

            [BAM-14265] Enabling XSRF protection in Bamboo causes the Stash build Post-Receive WebHook request to fail

            Monique Khairuliana (Inactive) made changes -
            Workflow Original: Bamboo Workflow 2016 v1 - Restricted [ 1436754 ] New: JAC Bug Workflow v3 [ 3384370 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: Bamboo Workflow 2016 v1 [ 1418624 ] New: Bamboo Workflow 2016 v1 - Restricted [ 1436754 ]
            Marek Went (Inactive) made changes -
            Workflow Original: Bamboo Workflow 2014 v2 [ 621740 ] New: Bamboo Workflow 2016 v1 [ 1418624 ]
            Roger Barnes (Inactive) made changes -
            Link New: This issue relates to STASH-4355 [ STASH-4355 ]
            David Black made changes -
            Labels Original: csrf no-cvss-required security xsrf New: csrf no-cvss-required xsrf

            David Robakowski added a comment -

            jdumay thanks a lot for your detailed help!

            David Robakowski added a comment - jdumay thanks a lot for your detailed help!
            James Dumay made changes -
            Resolution New: Answered [ 9 ]
            Status Original: Needs Triage [ 10030 ] New: Resolved [ 5 ]

            James Dumay added a comment -

            You need to add the X-Atlassian-Token: no-check header to every POST requests to Bamboo. It looks like the post-recieve web hook is incapable of doing this, so I've created STASH-4355 to track this issue.

            We are looking at ways to make push triggering of builds possible with our Stash integration but it is still a while off.

            James Dumay added a comment - You need to add the X-Atlassian-Token: no-check header to every POST requests to Bamboo. It looks like the post-recieve web hook is incapable of doing this, so I've created STASH-4355 to track this issue. We are looking at ways to make push triggering of builds possible with our Stash integration but it is still a while off.
            Paul Kelcey (Inactive) made changes -
            Rank New: Ranked higher
            David Black made changes -
            Labels New: csrf no-cvss-required security xsrf

              Unassigned Unassigned
              12b7995459dd David Robakowski
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: