Nethserver Update Fails with Server error Nethgui: 400 - Bad Request

Bug
, , ,
1

The update of:
kmod-xt_ndpi 2.03 1.ns.7
nethserver-firewall-base 3.2.10 1.ns.7
nethserver-firewall-base-ui 3.2.10 1.ns.7

fails with:
Server error
Nethgui:

400 - Bad request

1504102184+1504102187

1 Like
2

Hi @harry,

I have these bad requests sometimes on my Android Google Chrome when reloading a page. Just logging in again works. I installed these packages on some Nethservers and don’t think it’s about the updates.
Does it work if you just go to Software Center again?
What happens if you try updating on command line with “yum update”?

3

@mrmarkuz I beleive your diagnosis is correct. I installed the updates with Microsoft Edge with no errors. I did not try yum update, I wish I had time to try your suggestion of yum update, but I can’t spare the time.

Thanks for your help

Harry

1 Like
4

You’re welcome. Please mark the topic as solved as described here:

https://community.nethserver.org/t/howto-mark-a-topic-as-solved/1750

6

can you catch this error in /var/log/messages

[ERROR] Nethgui\Framework: CSRF token verification failed!

7

I have 5 instances of that error message in /var/log/messages on the day I tried it.

Dec 7 14:17:20 tempest httpd: [ERROR] Nethgui\Framework: CSRF token verification failed!

8

Markus,

I am not sure it is resolved. If you have seen similar errors, and it happened to me, wouldn’t it be better to keep it as a bug, and make Nethserver more user friendly?

Maybe it’s a philosophy disagreement, but in my view the purpose of the Nethserver web interface is to make it accessible by non-computer geeks, in which case, as a long-term objective, the user shouldn’t ever have to clear the cache in their browser, or use a command shell to type in commands.

As an absolute minimum, the error message certainly isn’t user-friendly, as evidenced by the fact that you, the expert, so kindly had to intervene to tell me how to work-around the problem. But it doesn’t fix the underlying cause.

Best regards,

Harry

1 Like
9

You are right, I fully agree.

1 Like
10

check if this error comes after a nethgui 400 Bad request, sometime I see them in my VM. I use firefox57

11

Stephdl,

The condition I reported was “Nethgui: 400 - Bad Request” I looked in the log as instructed and I had
httpd: [ERROR] Nethgui\Framework: CSRF token verification failed!

I tried updating multiple times using Chrome, and got 5 instances of the Nethgui token verification failed messages. I don’t know when exactly I got the browser message, so I don’t know which was first.

I launched Firefox (which I don’t think I had ever used with Nethserver so there were no cookies or cache entries, and it worked.

To my recollection, this is the only time I have ever gotten the “400 - Bad Request” error.

I dont know what you mean by “check if this error comes after…”

1 Like
12

I see time to time this error in my VM, since it is vm for tests with development rpm, i did not much take attention. I think i can catch the error I pointed in /var/log/messages at the same time when I see the error in the server-manager.
IIRC it is not related to the software center, I can see the error in other panels.
Therefore, when you see the error, go to /var/log/messages or /var/log/httpd-admin/error and look after any errors.

13

Filed a bug here

1 Like
14

A little workaround could be login via SSH, do a yum update therefore try again to access on Nethgui…
Not always appliable when is the first login after install, of course.

15

I also get this error message and have the “CSRF token failed” error in /var/log/messages.

It seems to occur if a page is left open for too long before clicking submit.

Netserver is running as a KVM virtual machine and I’m accessing it using FireFox52 on Linux (which is also a VM).

2 Likes
16

same for me, a long time without refreshing the page, then I save sattings and I got this error. It is not relative t a specific panel.
If you refresh the page then you can save the settings after

1 Like
17

Please look at httpd-admin access_log: can you see the evidence of a “background” request?

18

[Wed Apr 18 18:21:52.771927 2018] [:error] [pid 5264] [client 192.168.56.1:38528] [ERROR] Nethgui\\Framework: CSRF token verification failed!, referer: https://192.168.56.10:980/en-US/ProxyPass

no much information :frowning:

I recall the first time I saw it , IIRC it was after you fixed the vulnerability in the server-manager, never saw it before

1 Like
19

Yes it’s a consequence of the CSRF implementation. The token is rotated at any HTML page request. I suspect some background request can rotate it too, invalidating the currently displayed page.

Please look at /var/log/httpd-admin/access_log

1 Like
20 
192.168.56.1 - - [18/Apr/2018:18:21:00 +0200] "POST /en-US/ProxyPass/ProxyPassVhost/delete/tata.com.json HTTP/1.1" 200 1113
192.168.56.1 - - [18/Apr/2018:18:21:08 +0200] "GET /en-US/Help/Read/ProxyPass.html HTTP/1.1" 200 2234
192.168.56.1 - - [18/Apr/2018:18:21:43 +0200] "GET /en-US/ProxyPass/ProxyPassVhost/create.json?_=1524068391803 HTTP/1.1" 200 1391
192.168.56.1 - - [18/Apr/2018:18:21:52 +0200] "POST /en-US/ProxyPass/ProxyPassVhost/create.json HTTP/1.1" 400 59
192.168.56.1 - - [18/Apr/2018:18:21:57 +0200] "GET /en-US/ProxyPass HTTP/1.1" 200 26790
192.168.56.1 - - [18/Apr/2018:18:21:58 +0200] "GET /js/jquery-1.12.4.min.js HTTP/1.1" 304 -
192.168.56.1 - - [18/Apr/2018:18:21:58 +0200] "GET /js/jquery-ui-1.8.23.min.js HTTP/1.1" 304 -
192.168.56.1 - - [18/Apr/2018:18:21:58 +0200] "GET /js/percent.js HTTP/1.1" 304 -
21

maybe this ?