Alfresco 5 community edition CSRF error when using load balancer in AWS

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

samis

Hey!

We are having an issue with Alfresco 5 community edition and CSRF protection. We are trying to deploy Alfresco into AWS where a load balancer is forwarding the traffic to Alfresco.

As you can see from this error the issue seems to be that we are using https when connecting to the load balancer and alfresco is configured to use http.

javax.servlet.ServletException: Possible CSRF attack noted when asserting referer header 'https://ourdomain/alfresco/s/admin/admin-nodebrowser'. Request: POST /alfresco/s/admin/admin-nodebrowser, FAILED TEST: Assert referer POST /alfresco/s/admin/admin-nodebrowser :: referer: 'https://ourdomain/alfresco/s/admin/admin-nodebrowser' vs server & context: http://ourdomain/ (string) or  (regexp)

I found this file which contains some configurations related to CSRF (web-scripts-config-custom.xml)

<alfresco-config>
    <config evaluator="string-compare" condition="CSRFPolicy">
        <filter>
            <rule>
                <request>
                    <method>GET</method>
                    <path>/service/admin/.*</path>
                </request>
                <action name="generateToken">
                    <param name="session">{token}</param>
                    <param name="cookie">{token}</param>
                </action>
            </rule>
            <rule>
                <request>
                    <method>GET</method>
                    <path>/s/admin/.*</path>
                </request>
                <action name="generateToken">
                    <param name="session">{token}</param>
                    <param name="cookie">{token}</param>
                </action>
            </rule>
        </filter>
    </config>
</alfresco-config>

So my question is that can I configure Alfresco to ignore the difference between http and https or should I rather just try to configure Alfresco to use https? (I am not sure how to approach the https solution, should the load balancer and alfresco use the same certificate?)

If there is any more information I can give or if I didn't explain this well enought please let me know.

(also sorry if this is the wrong forum section, I wasn't able to find any description what should go where)

abhinavmishra14

If loadbalancer is configured to use https, you should check and setup https configs. The error might be due to that. 

here is a doc: https://docs.alfresco.com/5.2/tasks/configure-ssl-prod.html

You can also try disabling the CSRF, add the following in share config and try again:

 <config evaluator="string-compare" condition="CSRFPolicy" replace="true">
        <filter/>
</config>  

 you can also disable CSRF via alfresco-global.properties by adding following property:

csrf.filter.enabled=false

You can find the documentation about CSRF here: https://docs.alfresco.com/5.2/concepts/csrf-policy.html