403 when opening a new ticket....sometimes

need4swede

Hi osTicket Team,

Been trying to figure this one out for a few weeks now. On occasion, seemingly at random, submitting a new ticket results in a 403 Forbidden screen for the user. The logs reveal a Invalid CSRF Token __CSRFToken__ error.
While refreshing the page doesn't solve the issue, closing the browser window / tab and opening a new one does seem to allow tickets to be submitted.

Here is my Dashboard - from what I've read, osTicket may have issues with Lightspeed, but I am not 100% sure about that.

Everything else seems to work just fine, apart from this issue. My folder permissions seem fine - again, this issue happens at random, so it's difficult to trace. I did manage to snag a HAR file, if needed.

Thanks,
Swede

KevinTheJedi

need4swede

Litespeed should be fine as it’s a drop-in replacement for Apache. One thing I noticed is you aren’t using the latest version. I would recommend upgrading and retesting.

Do you have a cron configured so the system cleans expired sessions more often? If not it will only run on auto-cron which is quite seldom and requires an Agent to be logged in.

Cheers.

need4swede

KevinTheJedi

Hi Kevin,

Thanks for the reply. I don't believe I do, and I'm not familiar with how to set that up. How would I go about implementing this?

Thanks!

KevinTheJedi

need4swede

Here are the docs:

https://docs.osticket.com/en/latest/Getting%20Started/POP3-IMAP%20Settings.html

Just skip the email settings part and jump straight to the cron section.

Cheers.

KevinTheJedi

need4swede

Reading your post again it doesn’t seem like session issues; rather the server is blocking said requests.

You should also reach out to your hosting provider as they could have security rules that are blocking the requests. Maybe it only does it sometimes as only sometimes tickets contain certain things that triggers the rules. We’ve seen this before especially with strict hosts. They should have some sort of audit log or some kind of logs that tracks when requests get blocked by the security rules.

Cheers.

need4swede

KevinTheJedi

Hi Kevin,

My host is Namecheap and I've reached out to their support about this before, but I get the old "Oh I'm not familiar with that software, you should contact their support. Everything looks ok to me." Maybe it was just the rep I spoke to, but I haven't gotten very far with this in the past.

It's strange, because I've had users create the same ticket twice and the second time it works. What's interesting is that if I try to access open.php in the same browser tab, it doesn't work. If I open a new tab and copy/paste the URL, it works fine. The aforementioned error is all I have to go by - I don't see anything else in my cpanel logs. I did collect a HAR file, but not much more to go by.

need4swede

@KevinTheJedi

It has been a few months, but I've returned to share what I've found.
As I mentioned, my host is Namecheap. There's a setting in cPanel for 'ModSecurity'.
Read more about it here: https://www.namecheap.com/support/knowledgebase/article.aspx/9542/22/what-is-modsecurity-and-why-do-we-need-it/

After disabling it, the issue was fixed. There are also ways to whitelist requests, but you need to reach out to support to handle that.

After several months of testing, I can confirm that this has resolved the issue. If anyone else encounters this problem, I hope this proves insightful.

KevinTheJedi

need4swede

That's awesome! Yes, usually ModSecurity is a big culprit in stuff like this (mainly used on shared hosts). Usually they make the ModSecurity logs easy to access so you can review them and make needed adjustments though. Not sure why they didn't point this out to you sooner. 🤷‍♂️

Cheers.