You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "abdulsalam3105 (via GitHub)" <gi...@apache.org> on 2025/02/20 17:40:01 UTC
[I] Uprading issue in 9.2.X [trafficserver]
abdulsalam3105 opened a new issue, #12048:
URL: https://github.com/apache/trafficserver/issues/12048
am upgrading from 8.1.11 to 9.2.8 and found that while accessing trafficserver url, it throws once it reaches the auth url
error_code: _csrf_attack
error_message: CRJSA0001E A potential cross-site request forgery (CSRF) attack was detected.
error_message_explanation: Either a CSRF attack occurred or, in rare cases, a defect caused the system to falsely detect one.
error_message_useraction: If an attack occurred, the system denied it and no further action is required.
my setup is trafficserver is placed in front of IBM httpd server and my application (origin) is placed behind httpd server.
my remap.config looks like below
map https://trafficserverurl.com https://ibmhttpd.com
reverse_map https://ibmhttpd.com https://trafficserverurl.com
i have header_rewrite.config file
cond %{SEND_REQUEST_HDR_HOOK}
set-header Host "trafficserfqdn"
this works in 8.1.11 but not works in 9.2.8, can anyone help to figureout the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "abdulsalam3105 (via GitHub)" <gi...@apache.org>.
abdulsalam3105 commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2683877889
Thank you @mlibbey for the quick response, why am suspect ATS version, it works in 8.1.11 and it doesnt work in 9.2.8
Traffic Server v9.0.0 and beyond, URL rewrites specified in remap.config are now performed before any plugins are executed. This is a shift from previous behavior, where plugins could modify URLs and headers before the rewrite occurred. As a result, plugins that modify the cache key or rely on the original URL could behave differently.
am thinking above change affects my current setup that i have set host header in plugin . in my remap.config where actual origin is set like below
map https://trafficserverurl.com/ https://ibmhttpd.com/
reverse_map https://ibmhttpd.com/ https://trafficserverurl.com/
in my network console i see host as https://ibmhttpd.com/ but it should be trafficserverurl,
Any suggestion here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "abdulsalam3105 (via GitHub)" <gi...@apache.org>.
abdulsalam3105 commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2683800003
@mlibbey i saw you have answered related question, could you please consider my query
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "abdulsalam3105 (via GitHub)" <gi...@apache.org>.
abdulsalam3105 commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2679401921
@bryancall can you redirect me to any support forum if any,
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "mlibbey (via GitHub)" <gi...@apache.org>.
mlibbey commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2685572415
In your header_rewrite, you use `cond %{SEND_REQUEST_HDR_HOOK}`. To act at the time of remap, you'd need to use
`REMAP_PSEUDO_HOOK`
https://docs.trafficserver.apache.org/en/latest/admin-guide/plugins/header_rewrite.en.html#hook-conditions
The cachekey plugin definitely still works, and definitely happens before sending requests to the origin.
Also, fwiw, the [proxy.config.url_remap.pristine_host_hdr](https://docs.trafficserver.apache.org/en/latest/admin-guide/files/records.yaml.en.html#proxy-config-url-remap-pristine-host-hdr) chooses the inbound vs "outbound" host: header to use when going to origin.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "abdulsalam3105 (via GitHub)" <gi...@apache.org>.
abdulsalam3105 commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2675139517
@bryancall , Is below change cause isssue?
Traffic Server v9.0.0 and beyond, URL rewrites specified in remap.config are now performed before any plugins are executed. This is a shift from previous behavior, where plugins could modify URLs and headers before the rewrite occurred. As a result, plugins that modify the cache key or rely on the original URL could behave differently.
i see my redirect-url in response in ihsurl but it should be trafficserverurl . Is there any possible to delay remap.config
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "abdulsalam3105 (via GitHub)" <gi...@apache.org>.
abdulsalam3105 commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2685321457
also what i understand in the version,
Since URL rewrites in remap.config now occur before plugins execute, any modifications of plugin makes (such as setting the Host header) happen after the URL has already been rewritten. This can cause unintended behavior, like the incorrect Host header being used.
can we set like this
map https://trafficserverurl.com/ https://ibmhttpd.com/ @plugin=header_rewrite.so @pparam=host_rewrite.config
reverse_map https://ibmhttpd.com/ https://trafficserverurl.com/
to pass the plugin in remap.config itself,
my setup is trafficserverurl sends request to application url via IHS url i.e https://ibmhttpd.com/ and it send the request to auth server and auth server send request to application url as redirect uri as trafficserver url, but in this version it is passed with IHS url.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "mlibbey (via GitHub)" <gi...@apache.org>.
mlibbey commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2683865511
I can't imagine that the version of ATS would matter here. The browser has security rules around Cross Site scripting attacks so you'd need to put CORS solutions in place:
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
The header rewrite you show just sets the Host header for the request to the origin. The error message implies its from the client, and implies that it got (correct) content/that the origin request went ok.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "bryancall (via GitHub)" <gi...@apache.org>.
bryancall commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-4828270775
I am closing this out as a configuration question rather than a Traffic Server defect. The behavior you are seeing, where the origin (IHS) host appears instead of your Traffic Server fully qualified domain name, is controlled behavior, and the mechanisms to get what you want all still exist in current Traffic Server. As mlibbey noted, two settings cover this: act at remap time in header_rewrite with `cond %{REMAP_PSEUDO_HOOK}`, and use [proxy.config.url_remap.pristine_host_hdr](https://docs.trafficserver.apache.org/en/latest/admin-guide/files/records.yaml.en.html#proxy-config-url-remap-pristine-host-hdr) to choose whether the inbound or the remapped host header is sent to origin. The remaining piece, your authentication server emitting the redirect uniform resource identifier with the IHS hostname, is a function of how that auth server is configured rather than Traffic Server, since it derives the redirect from the request it actually receives. There is no open code defect to trac
k here, so I am closing this. If you can reproduce a case where Traffic Server itself rewrites a value it should not, please open a fresh issue with your full remap.config, header_rewrite configuration, and a request and response capture, and we will take another look.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "abdulsalam3105 (via GitHub)" <gi...@apache.org>.
abdulsalam3105 commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2685813377
so, i need to use header_rewrite.config as
cond %{REMAP_PSEUDO_HOOK}
set-header Host "trafficserfqdn"
and set proxy.config.url_remap.pristine_host_hdr as 1 in records.config ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "abdulsalam3105 (via GitHub)" <gi...@apache.org>.
abdulsalam3105 commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-2685873990
I have set above mentioned one in my system, but still auth server pass redirect_uri as IHS url, not an trafficserver url.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "bryancall (via GitHub)" <gi...@apache.org>.
bryancall closed issue #12048: Upgrading issue in 9.2.X
URL: https://github.com/apache/trafficserver/issues/12048
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrading issue in 9.2.X [trafficserver]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #12048:
URL: https://github.com/apache/trafficserver/issues/12048#issuecomment-3970333464
This issue has been automatically marked as stale because it has not had recent activity. Marking it stale to flag it for further consideration by the community.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org