Invalid CSRF Token

Swen

I have a user he can't login without issues. I found now this issue into log:

Everytime he tried to login, after logout, he can't login again. He must delete cache and everything else. This happens on Android, iPhone and Desktop based systems with all browsers he use: Chrome, Firefox, Brave...

KevinTheJedi

Swen

The issue is probably due to the port number in the URL. Maybe Apache/NGINX is including the port when the redirect happens. Please consult your webserver documentation on how to prevent this. Also, if you are using HAproxy you need to add the X-Forwarded-For header.

Cheers.

Swen

OK token issue is fixed. Found a setting to solve this, but:
The problems with login of this user stay. He must clean cache that he can login. If he was logged in and thereafter logged out, he can't loggin again. He get the login page again but blank.

Thanks.

ntozier

If you are getting a blank page then there is a PHP error, check your PHP error logs.

TAS

Same problem.

Error log shows " Invalid CSRF Token CSRFToken"
Invalid CSRF token [17379xxxxxxxxxxxxxxxxxxxxxxxxxx73a99] on https://www.xxxxxxx.xxxxxx.xxx:443/scp/login.php

Not a blank page.
Page is delivered but fields are blank...
Red "Authentication Required" above fields.

Seems to happen randomly.
Kinda like something is not connecting in time to deliver a token...

TAS

After further review, I am not sure that the CSFR token warning has to do with the login behavior...
A deep dive into the logs shows the warning message from before update to 1.17
Behavior only started with update.

I am redirecting to https://forum.osticket.com/d/101799-login-cache-after-update

ntozier

I would recommend that you start your own thread.

Start by reading and following the posting guidelines located in this thread: Please read before requesting assistance. The more information you give us the better we will be able to assist you. Thank you.

Environment details? (see Admin panel -> Dashboard -> Information)
etc