upgrade 1.7.0 -> 1.7.1 Invalid CSRF Token __CSRFToken__

upgrade 1.7.0 -> 1.7.1 Invalid CSRF Token CSRFToken

syscom

Hello,

Did the upgrade today, no big deal, went smooth except i'm not able to login with IE9 (HTTP 400 bad request after submitting the password) or Opera (Invalid CSRF Token __CSRFToken__)

In the system logs, all of the attempts are logged with "Invalid CSRF Token __CSRFToken__".

The only way to access our ticket system is with Chrome.

Tested with 4 different PC's and servers. Did not test with Firefox, will do...

Any ideas?

Thanks.

jared@osticket.com

Are you accessing the osTicket site by http://localhost(http://localhost) by chance?

syscom

Hello,

No, accessing via http://ticket.domainname.tld/ticket/scp(http://ticket.domainname.tld/ticket/scp) which resolves to an external IP.

syscom

update: tested with firefox, this works also.

syscom

Valid CSRF Token Required

Hello,

I've upgrade to the lastest version osTicket (v1.7.1.4), everything went fine but now I can't login, I get the Valid CSRF Token Required message.

The strange thing is, I can login via IE but not via Chrome or Firefox.

I can however do a login via IP instead of hostname ticket.companyname.tld/ticket/scp

I would like to fix this for all browsers.

Via phpmyadmin I can see a lot of table in ost_sessions

0 - 199 ( 44,205 total, Query took 0.0008 s)

Should I delete them, will this help?

Please advice, it seems after every upgrade there is something broken.

Thank you.

syscom

AFter upgrade to 1.7.4 the same thing, only now it works in IE and not in Chrome.

I'm really confused...

ntozier

This appears to pretty much be a continuation of your post at:

http://osticket.com/forums/showthread.php?t=16807(http://osticket.com/forums/showthread.php?t=16807)

Going to merge this thread with that one.

jared@osticket.com

Sorry about your continued troubles in upgrading your osTicket installation. Could you send the Set-Cookie header line from the Http response when you access the login page? (You'll likely have to clear cookies and refresh the page, or, after you submit the login, the server should send a new Set-Cookie header.)