Login Hang/Invalid CSRF Token

rmeany80

I have a weird issue where when I try to log into the agent portal for the first time in the morning, the page will hang forever trying to log in. If I press the login button a second time, I get an 'invalid CSRF token' error. I then refresh the login page and am able to log in fine.I'm not sure it's an osTicket-specific issue because we have a couple other systems that authenticate using our Active Directory that exhibit a similar problem, where clicking to log in for the first time will cause the login process to hang forever... But pressing the login button a second time immediately logs the user in. I'm just wondering if anyone else has encountered this problem before? It could potentially be a config problem with our AD or some sort of compatibility problem with php-ldap and the way it tries to connect to AD, but I have no idea where to begin to look.

ntozier

Please help us to help you by reading and following the posting guidelines located in this thread:

http://www.forum.osticket.com/d/discussion//please-read-before-requesting-assistance#latest

The more information you give us the better we will be able to assist you. Thank you.

rmeany80

About this osTicket InstallationServer InformationosTicket Version v1.10.1 (9ae093d) — Up to dateWeb Server Software Apache/2.4.25 (Debian)MySQL Version 10.1.26PHP Version 7.0.27-0+deb9u1PHP Extensionsgdlib Used for image manipulation and PDF printingimap Used for email fetchingxml XML APIxml-dom Used for HTML email processingjson Improves performance creating and processing JSONmbstring Highly recommended for non western european language contentphar Highly recommended for plugins and language packsintl Highly recommended for non western european language contentfileinfo Used to detect file types for uploadsAPCu Improves overall performanceZend Opcache Improves overall performancePHP Settingscgi.fix_pathinfo "1" is recommended if AJAX is not workingdate.timezone America/New_YorkDatabase Information and UsageSchema osticket (localhost)Schema Signature 98ad7d550c26ac44340350912296e673Space Used 80.53 MiBSpace for Attachments 0.01 MiBTimezone EDT (Interpreted as America/New_York)

rmeany80

I've looked through the apache logs and there is no information relevant to the problem I am having.

KevinTheJedi

@[deleted]0How are you loading the site in the morning? Opening a new browser and visiting the page in a new tab or reloading an old tab/browser? Also, what is your Admin Panel > Settings > Agents > Agent Session Timeout setting? If you set this to "0" (disabled) then your sessions will last 24 hours; this might help with the CSRF issues.Also, I'd recommend upgrading to v1.10.4 as it contains the latest and important security updates for the 1.10.x series.Cheers.

rmeany80

It happens when opening a new browser window or using an existing one.. doesn't matter.. Agent session timeout was default 30 minutes, now set to 0.

ramrajone

@[deleted]0 I had that issue, I found this fix from Githubhttps://github.com/osTicket/osTicket/commit/424bfc99d93b920f6162b602eeea41125086425don file: include/class.ostsession.phpLine 188 catch (DoesNotExist $e) { $this->data = new SessionData(); $this->data->session_data = "";

rmeany80

@[deleted] yeah I actually had that issue as well, and resolved it with that particular code update.. I believe 'invalid CSRF token' is a general error that can indicate multiple underlying problems. I think it's a bit of a red herring here because it is being thrown due to authentication not completing on the first login attempt. Before the code update, it would happen all the time and right away on the first try.

KevinTheJedi

@[deleted]0Didn't notice you were using PHP 7....my bad. PHP 7 is not fully supported as most people report issues or fatal errors (we are addressing the PHP 7 issues and the csrf issue in the official release of 1.11.0 non-release candidate). With that being said if you want to use PHP 7 you have to implement the above fix mentioned by @[deleted], otherwise sessions will crap out at some point.Cheers.

rmeany80

@[deleted] Yep I already had that issue and applied the fix @[deleted] mentioned..