Community 7.0: Possible CSRF attack noted when asserting referer header

michaelzietlow

I have a fresh community7.0 installation via zip distribution and ansible.
When enable SSL in /etc/nginx/conf.d/, the alfresco orange login page loads securely (https),  but when I attempt to authenticate,  I see the following CSRF errors in alfresco.log.

 2021-06-21 15:01:47,561  ERROR [alfresco.web.site] [http-nio-8080-exec-10] javax.servlet.ServletException: Possible CSRF attack noted when asserting referer header 'https://alfresco.domain.com/share/page/'. Request: POST /share/page/dologin, FAILED TEST: Assert referer POST /share/page/dologin :: referer: 'https://alfresco.domain.com/share/page/' vs server & context: http://127.0.0.1:8080/ (string) or  (regexp)

Is this something I need to fix in nginx config, alfresco.properties, or web-extension xml?

/etc/nginx/conf.d/alfresco.conf: 

server {
    access_log  /var/log/alfresco/access.log;
    error_log /var/log/alfresco/error.log error;

        listen 443 ssl;
        listen [::]:443 ssl;
        server_name alfresco.domain.com;
        ssl_certificate          /etc/certs/server.crt;
        ssl_certificate_key  /etc/certs/server.key;
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  5m;
      
        client_max_body_size 0;
        set  $allowOriginSite *;
        proxy_pass_request_headers on;
        proxy_pass_header Set-Cookie;

        # Protect access to SOLR APIs
        location ~ ^(/.*/service/api/solr/.*)$ {return 403;}
        location ~ ^(/.*/s/api/solr/.*)$ {return 403;}
        location ~ ^(/.*/wcservice/api/solr/.*)$ {return 403;}
        location ~ ^(/.*/wcs/api/solr/.*)$ {return 403;}

        location ~ ^(/.*/proxy/.*/api/solr/.*)$ {return 403 ;}
        location ~ ^(/.*/-default-/proxy/.*/api/.*)$ {return 403;}

        # Protect access to Prometheus endpoint
        location ~ ^(/.*/s/prometheus)$ {return 403;}

        location / {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass_header Set-Cookie;
            proxy_set_header X-Forwarded-Proto https;
        }

        # External settings, do not remove
        #ENV_ACCESS_LOG

        location /share/ {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass_header Set-Cookie;
            proxy_set_header X-Forwarded-Proto https;
        }

        location /alfresco/ {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass_header Set-Cookie;
            proxy_set_header X-Forwarded-Proto https;
        }

        location /api-explorer/ {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass_header Set-Cookie;
            proxy_set_header X-Forwarded-Proto https;
        }
    }

michaelzietlow

Much thanks Afaust!

Here is my now working SSL configuration through haproxy, Nginx, and alfresco/content-services!

/etc/nginx/conf.d/alfresco.conf:

...snip...
listen 443 ssl;
listen [::]:443 ssl;
server_name alfresco.domain.com;
ssl_certificate /etc/certs/server.crt;
ssl_certificate_key /etc/certs/server.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;

...snip...

location /share/ {
proxy_pass http://127.0.0.1:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-NginX-Proxy true;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_pass_header Set-Cookie;
proxy_set_header X-Forwarded-Proto https;

}

...snip...

/etc/opt/alfresco/content-services/classpath/alfresco-global.properties:

...snip...

# CSRF filter overrides
csrf.filter.enabled=true
csrf.filter.referer=^https?://alfresco\.domain\.com(/.*)?
csrf.filter.referer.always=false
csrf.filter.origin=^https?://alfresco\.domain\.com(/.*)?
csrf.filter.origin.always=false

...snip...

/etc/opt/alfresco/content-services/classpath/alfresco/web-extension/share-config-custom.xml:

...snip...
      <properties>

         <!-- There is normally no need to override this property -->
         <token>Alfresco-CSRFToken</token>

         <!--
            Override and set this property with a regexp that if you have placed Share behind a proxy that
            does not rewrite the Referer header.
         -->

         <referer>^https?://alfresco\.domain\.com(/.*)?</referer>

         <!--
            Override and set this property with a regexp that if you have placed Share behind a proxy that
            does not rewrite the Origin header.
         -->
         <origin>^https?://alfresco\.domain\.com(/.*)?</origin>
      </properties>

...snip...