Jazz Forum Welcome to the Jazz Community Forum Connect and collaborate with IBM Engineering experts and users

IBM Jazz + Eclipse Lyo = CSRF problem

Questions
Tags
Users
Badges
Dmitry A. Lesin
(248●2●69●96) edited
Sep 20 '23, 1:45 p.m.

Hello!
We want to develop an OSLC Adapter based on Eclipse Lyo v5.1.1.Final to integrate our custom testing solution with IBM Jazz RM v.7.0.2. We created a toolchain model, generated the code. Everything works well until we deploy the adapter on the same server where Jazz is installed. But we need to deploy OSLC Testing Adapter on an external server. For that, we changed baseURI from localhost to centosflex in our case. After we changed localhost to another name, we get CSRF attack problem.


Problem description

Base URL of the adapter is in the whitelist of JTS.

oslc adapter in whitelist

I can not get how better to fix the problem. Could I please ask you guys give me an idea how better to go next?
Thank you!

0 votes

1 answer
4,558 views
0 votes

Accepted answer

Permanent link
Ralph Schoon
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER (64.6k●3●36●49) Sep 21 '23, 1:18 a.m.

 The most important information is missing - the call that causes this. Method? What did you send and what did you get. Headers you sent. One of my biggest struggles with Lyo has been that it is very hard to see the HTTP data it sends and receives. You need to use a proxy to trace the communication, I think.

Some hints.

  1. Always use a fully qualified host name. Never use localhost, except for the most basic testing. You can always add entries to the hosts file to fake full qualified host names on your localhost.
  2. As far as I can tell, Jazz Servers require the header X-Jazz-CSRF-Prevent with the JSESSIONID sent as value for POST requests. 
  3. I would consider to setup your server with HTTPS from the very beginning as well. You eventually want to have this and the earlier you try it out and get the certificates done, the better.

Dmitry A. Lesin selected this answer as the correct answer

0 votes

Comments
Ralph Schoon
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER Sep 21 '23, 1:19 a.m.
Here one of the may results if you google CSRF site:jazz.net: https://jazz.net/forum/questions/98072/x-jazz-csrf-prevent-header-is-required-to-create-a-work-item-via-oslc-on-version-4001 

Dmitry A. Lesin
Sep 21 '23, 10:04 a.m.
Ralph, sorry! You are right! I was trying to describe the case in detail and forgot to point where I started at. The steps were next: 1. Register OSLC adapter in JTS as a friend (it was successful). 2. Go to project area (no GC context) and create an association. 3. Provide administrator login and password defined in the adapter. 4. Confirm the administrator credentials. The request can be intercepted in Eclipse IDE if OSLC adapter app is strted in debugging mode. But the control is getting out quickly and apparently transferred to the level of Lyo libraries, I think, at least. Thank you!

Ralph Schoon
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER Sep 21 '23, 10:55 a.m.
The question is: Is this request a POST? If you know which call it is, you should be able to tell. I had to send the  X-Jazz-CSRF-Prevent in my Lyo code.  You can also ask in the Lyo project.

Dmitry A. Lesin
Sep 25 '23, 12:03 p.m.
It seems that Jazz doesn't participate in this communication. Apparently, CSRF case is detected by Oath application delivered within Eclipse Lyo libraries. This is the request analyzed in Chrome DevTools: It was simulated with only Postman and OSLC adapter (no Jazz): I have found that there's a class responsible for blocks of CSRF attacks: https://www.javatips.net/api/lyo.server-master/org.eclipse.lyo.server.oauth.webapp/src/main/java/org/eclipse/lyo/server/oauth/webapp/services/CSRFPrevent.java I believe that the main question can be now whether it's possible to add "X-CSRF-Prevent" header with Id of current session. Or I'm going in absolutely wrong way, I don't know.

Ralph Schoon
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER Sep 26 '23, 4:55 a.m.
If you use Lyo, you should be able to see the source code and be able to step through the authentication. You should also be able to see if you can add custom headers. I would also suggest to ask here: https://forum.open-services.net/c/sdks/lyo/  

Ralph Schoon
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER Sep 26 '23, 4:57 a.m.
You can also follow https://rsjazz.wordpress.com/2019/03/07/type-system-manager-part-2/ and find my code. Note that the code was created with an old version of lyo and the way I inject the header might no longer be available.  

Dmitry A. Lesin
Sep 28 '23, 2:16 p.m.
Due to your tip, I have written an Email to Lyo team. They gave me another recommendation aimed to debugging the embedded Oauth app delivered with libraries within Eclipse. So, the problem was very like you were speaking but only "X-CSRF-Prevent" header was needed. It must contain JSESSIONID value. This is because we send request to Lyo adapter, but not Jazz itself. Anyway, your two tips were very valuable for me and they moved me in right direction. Thank you very much!

1 vote

Dmitry A. Lesin
Oct 10 '23, 6:52 a.m.
 Yes, a lot of problems gone out after testing the solution locally with HTTPS and a self-signed certificate. Thanks!

Dmitry A. Lesin
Oct 10 '23, 6:54 a.m.
Yes, a lot of problems gone away after testing the solution locally with HTTPS and a self-signed certificate. Thanks! 

showing 5 of 9 show 4 more comments

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

Ask a question
Guidelines
FAQ
Search context
Follow this question

By Email: 

Once you sign in you will be able to subscribe for any updates here.

By RSS:

Answers
Answers and Comments
Question details
× 11,105
× 527
× 26
× 1

Question asked: Sep 20 '23, 1:44 p.m.

Question was seen: 4,558 times

Last updated: Oct 10 '23, 6:54 a.m.

Confirmation Cancel Confirm