Nethserver Update Fails with Server error Nethgui: 400 - Bad Request


(harry) #1

The update of:
kmod-xt_ndpi 2.03 1.ns.7
nethserver-firewall-base 3.2.10 1.ns.7
nethserver-firewall-base-ui 3.2.10 1.ns.7

fails with:
Server error

400 - Bad request


(Markus Neuberger) #2

Hi @harry,

I have these bad requests sometimes on my Android Google Chrome when reloading a page. Just logging in again works. I installed these packages on some Nethservers and don’t think it’s about the updates.
Does it work if you just go to Software Center again?
What happens if you try updating on command line with “yum update”?

(harry) #3

@mrmarkuz I beleive your diagnosis is correct. I installed the updates with Microsoft Edge with no errors. I did not try yum update, I wish I had time to try your suggestion of yum update, but I can’t spare the time.

Thanks for your help


(Markus Neuberger) #4

You’re welcome. Please mark the topic as solved as described here:

(Stéphane de Labrusse) #6

can you catch this error in /var/log/messages

[ERROR] Nethgui\Framework: CSRF token verification failed!

(harry) #7

I have 5 instances of that error message in /var/log/messages on the day I tried it.

Dec 7 14:17:20 tempest httpd: [ERROR] Nethgui\Framework: CSRF token verification failed!

(harry) #8


I am not sure it is resolved. If you have seen similar errors, and it happened to me, wouldn’t it be better to keep it as a bug, and make Nethserver more user friendly?

Maybe it’s a philosophy disagreement, but in my view the purpose of the Nethserver web interface is to make it accessible by non-computer geeks, in which case, as a long-term objective, the user shouldn’t ever have to clear the cache in their browser, or use a command shell to type in commands.

As an absolute minimum, the error message certainly isn’t user-friendly, as evidenced by the fact that you, the expert, so kindly had to intervene to tell me how to work-around the problem. But it doesn’t fix the underlying cause.

Best regards,


(Markus Neuberger) #9

You are right, I fully agree.

(Stéphane de Labrusse) #10

check if this error comes after a nethgui 400 Bad request, sometime I see them in my VM. I use firefox57

(harry) #11


The condition I reported was “Nethgui: 400 - Bad Request” I looked in the log as instructed and I had
httpd: [ERROR] Nethgui\Framework: CSRF token verification failed!

I tried updating multiple times using Chrome, and got 5 instances of the Nethgui token verification failed messages. I don’t know when exactly I got the browser message, so I don’t know which was first.

I launched Firefox (which I don’t think I had ever used with Nethserver so there were no cookies or cache entries, and it worked.

To my recollection, this is the only time I have ever gotten the “400 - Bad Request” error.

I dont know what you mean by “check if this error comes after…”

(Stéphane de Labrusse) #12

I see time to time this error in my VM, since it is vm for tests with development rpm, i did not much take attention. I think i can catch the error I pointed in /var/log/messages at the same time when I see the error in the server-manager.
IIRC it is not related to the software center, I can see the error in other panels.
Therefore, when you see the error, go to /var/log/messages or /var/log/httpd-admin/error and look after any errors.

(Davide Principi) #13

Filed a bug here

(Michael Kicks) #14

A little workaround could be login via SSH, do a yum update therefore try again to access on Nethgui…
Not always appliable when is the first login after install, of course.

(bob) #15

I also get this error message and have the “CSRF token failed” error in /var/log/messages.

It seems to occur if a page is left open for too long before clicking submit.

Netserver is running as a KVM virtual machine and I’m accessing it using FireFox52 on Linux (which is also a VM).

(Stéphane de Labrusse) #16

same for me, a long time without refreshing the page, then I save sattings and I got this error. It is not relative t a specific panel.
If you refresh the page then you can save the settings after

(Davide Principi) #17

Please look at httpd-admin access_log: can you see the evidence of a “background” request?

(Stéphane de Labrusse) #18

[Wed Apr 18 18:21:52.771927 2018] [:error] [pid 5264] [client] [ERROR] Nethgui\\Framework: CSRF token verification failed!, referer:

no much information :frowning:

I recall the first time I saw it , IIRC it was after you fixed the vulnerability in the server-manager, never saw it before

(Davide Principi) #19

Yes it’s a consequence of the CSRF implementation. The token is rotated at any HTML page request. I suspect some background request can rotate it too, invalidating the currently displayed page.

Please look at /var/log/httpd-admin/access_log

(Stéphane de Labrusse) #20 - - [18/Apr/2018:18:21:00 +0200] "POST /en-US/ProxyPass/ProxyPassVhost/delete/ HTTP/1.1" 200 1113 - - [18/Apr/2018:18:21:08 +0200] "GET /en-US/Help/Read/ProxyPass.html HTTP/1.1" 200 2234 - - [18/Apr/2018:18:21:43 +0200] "GET /en-US/ProxyPass/ProxyPassVhost/create.json?_=1524068391803 HTTP/1.1" 200 1391 - - [18/Apr/2018:18:21:52 +0200] "POST /en-US/ProxyPass/ProxyPassVhost/create.json HTTP/1.1" 400 59 - - [18/Apr/2018:18:21:57 +0200] "GET /en-US/ProxyPass HTTP/1.1" 200 26790 - - [18/Apr/2018:18:21:58 +0200] "GET /js/jquery-1.12.4.min.js HTTP/1.1" 304 - - - [18/Apr/2018:18:21:58 +0200] "GET /js/jquery-ui-1.8.23.min.js HTTP/1.1" 304 - - - [18/Apr/2018:18:21:58 +0200] "GET /js/percent.js HTTP/1.1" 304 -

(Stéphane de Labrusse) #21

maybe this ?