Recommendation to support CSRF check in Atlassian products?

[collinbarrett]

Likely related to #328 , but different enough that maybe opening a new issue is better. I currently use the below referer settings in user.js. However, Atlassian products (specifically JIRA and Confluence) show "XSRF check failed" in the Firefox console when the application makes some REST API POST calls. I was exploring some docs like here, but I am not super familiar with how CSRF works. Can anyone recommend how to try tweaking my user.js settings to support these applications? Maybe, @fmarier ?

Note that these apps are self-hosted and the API calls are made to the same domain and port on which the web application runs.

My Current Referer Config:

• network.http.referer.spoofSource=false
• network.http.referer.XOriginPolicy=1

Screenshots of the API Call:

Thanks!

[fmarier]

How about this?

• network.http.referer.spoofSource=false (Firefox default)
• network.http.referer.XOriginPolicy=0 (Firefox default)
• network.http.referer.XOriginTrimmingPolicy=2

[collinbarrett]

That config works! Thanks, @fmarier . Am I sacrificing substantial privacy guards by loosening these policies up this much?

[fmarier]

Am I sacrificing substantial privacy guards by loosening these policies up this much?

With this config, you're essentially telling unrelated sites the hostname you came from. That's worst then telling unrelated sites nothing, but it's better than the default of telling them everything.

With this config for example, ads on a news site can't use the Referer header to tell which article you're reading but they can tell which news site you're on.

[fmarier]

@collinbarrett Does JIRA/Confluence work with this config?

• network.http.referer.spoofSource=true
• network.http.referer.XOriginPolicy=0 (Firefox default)
• network.http.referer.XOriginTrimmingPolicy=0 (Firefox default)

[collinbarrett]

Hi @fmarier ,

I can confirm that that config does work for Atlassian products. But, I cannot personally use it because Hangouts does not work with that config. (#328)

[fmarier]

Thanks @collinbarrett. I was asking so I could update my blog post with these new examples of broken websites that you have discovered.