Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-39291

Rest endpoints returning 403 for incorrect content type

XMLWordPrintable

      In Confluence 5.8 we have integration tests that validate that our rest endpoints return a 415 when they are given an invalid content type. In 5.9.1-pluginsfour013 these endpoints are returning a 403 for the same tests.

            [CONFSERVER-39291] Rest endpoints returning 403 for incorrect content type

            Shannon Krebs added a comment - - edited

            It seems to be related to the new XSRF checks. Possibly that is returning 403 when it fails and not a more accurate message in some cases. I've only seen it with some rest end points provided by a plugin, haven't been able to reproduce with a confluence endpoint. There is no error in the confluence log.

            Example 5.8.10:

            curl -D- -u admin:admin -X POST http://localhost:1990/confluence/rest/cw/latest/workflows/ds/workflowParameter
HTTP/1.1 415 Unsupported Media Type
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=08E571811595069B2EC57B68BFEC6FDB; Path=/
X-Seraph-LoginReason: OK
X-AUSERNAME: admin
X-Content-Type-Options: nosniff
Content-Type: text/html;charset=utf-8

<html><head><title........

            5.9.1-pluginsfour013

            curl -D- -u admin:admin -X POST http://localhost:1990/confluence/rest/cw/latest/workflows/ds/workflowParameter
HTTP/1.1 403 Forbidden
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=BA414C125E8008AADA95281DE15E05D3; Path=/confluence/; HttpOnly
X-Seraph-LoginReason: OK
X-AUSERNAME: admin
X-Content-Type-Options: nosniff
Content-Type: text/html;charset=ISO-8859-1

XSRF check failed

            Shannon Krebs added a comment - - edited It seems to be related to the new XSRF checks. Possibly that is returning 403 when it fails and not a more accurate message in some cases. I've only seen it with some rest end points provided by a plugin, haven't been able to reproduce with a confluence endpoint. There is no error in the confluence log. Example 5.8.10: curl -D- -u admin:admin -X POST http: //localhost:1990/confluence/ rest /cw/latest/workflows/ds/workflowParameter HTTP/1.1 415 Unsupported Media Type Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=08E571811595069B2EC57B68BFEC6FDB; Path=/ X-Seraph-LoginReason: OK X-AUSERNAME: admin X-Content-Type-Options: nosniff Content-Type: text/html;charset=utf-8 <html><head><title........ 5.9.1-pluginsfour013 curl -D- -u admin:admin -X POST http: //localhost:1990/confluence/ rest /cw/latest/workflows/ds/workflowParameter HTTP/1.1 403 Forbidden Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=BA414C125E8008AADA95281DE15E05D3; Path=/confluence/; HttpOnly X-Seraph-LoginReason: OK X-AUSERNAME: admin X-Content-Type-Options: nosniff Content-Type: text/html;charset=ISO-8859-1 XSRF check failed

            Minh Tran added a comment -

            Dear shannon1,

            Thanks for submitting the ticket
            Could you please tell me the REST endpoint and the corresponding exception inside Confluence?

            Thanks,
            Minh Tran
            Confluence BugMaster
            Atlassian

            Minh Tran added a comment - Dear shannon1 , Thanks for submitting the ticket Could you please tell me the REST endpoint and the corresponding exception inside Confluence? Thanks, Minh Tran Confluence BugMaster Atlassian

              79302268a842 Ana Viseu
              931615b5eee2 Shannon Krebs
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated: