IBM Jazz + Eclipse Lyo = CSRF problem

Dmitry A. Lesin (246●2●49●94) | asked Sep 20, 1:44 p.m.
edited Sep 20, 1:45 p.m.

Hello!
We want to develop an OSLC Adapter based on Eclipse Lyo v5.1.1.Final to integrate our custom testing solution with IBM Jazz RM v.7.0.2. We created a toolchain model, generated the code. Everything works well until we deploy the adapter on the same server where Jazz is installed. But we need to deploy OSLC Testing Adapter on an external server. For that, we changed baseURI from localhost to centosflex in our case. After we changed localhost to another name, we get CSRF attack problem.

Base URL of the adapter is in the whitelist of JTS.

oslc adapter in whitelist

I can not get how better to fix the problem. Could I please ask you guys give me an idea how better to go next?
Thank you!

Accepted answer

permanent link

Ralph Schoon (62.7k●3●36●43) | answered Sep 21, 1:18 a.m.
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER

The most important information is missing - the call that causes this. Method? What did you send and what did you get. Headers you sent. One of my biggest struggles with Lyo has been that it is very hard to see the HTTP data it sends and receives. You need to use a proxy to trace the communication, I think.

Some hints.

Always use a fully qualified host name. Never use localhost, except for the most basic testing. You can always add entries to the hosts file to fake full qualified host names on your localhost.
As far as I can tell, Jazz Servers require the header X-Jazz-CSRF-Prevent with the JSESSIONID sent as value for POST requests.
I would consider to setup your server with HTTPS from the very beginning as well. You eventually want to have this and the earlier you try it out and get the certificates done, the better.

Dmitry A. Lesin selected this answer as the correct answer

Comments

Ralph Schoon commented Sep 21, 1:19 a.m.

FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER

Here one of the may results if you google CSRF site:jazz.net: https://jazz.net/forum/questions/98072/x-jazz-csrf-prevent-header-is-required-to-create-a-work-item-via-oslc-on-version-4001

Dmitry A. Lesin commented Sep 21, 10:04 a.m.

Ralph, sorry! You are right! I was trying to describe the case in detail and forgot to point where I started at.

The steps were next:
1. Register OSLC adapter in JTS as a friend (it was successful).
2. Go to project area (no GC context) and create an association.

3. Provide administrator login and password defined in the adapter.

4. Confirm the administrator credentials.

The request can be intercepted in Eclipse IDE if OSLC adapter app is strted in debugging mode. But the control is getting out quickly and apparently transferred to the level of Lyo libraries, I think, at least.
Thank you!

Ralph Schoon commented Sep 21, 10:55 a.m.

FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER

The question is: Is this request a POST? If you know which call it is, you should be able to tell. I had to send the X-Jazz-CSRF-Prevent in my Lyo code.

You can also ask in the Lyo project.

Dmitry A. Lesin commented Sep 25, 12:03 p.m.

It seems that Jazz doesn't participate in this communication. Apparently, CSRF case is detected by Oath application delivered within Eclipse Lyo libraries.
This is the request analyzed in Chrome DevTools:

It was simulated with only Postman and OSLC adapter (no Jazz):

I have found that there's a class responsible for blocks of CSRF attacks:

https://www.javatips.net/api/lyo.server-master/org.eclipse.lyo.server.oauth.webapp/src/main/java/org/eclipse/lyo/server/oauth/webapp/services/CSRFPrevent.java

I believe that the main question can be now whether it's possible to add "X-CSRF-Prevent" header with Id of current session. Or I'm going in absolutely wrong way, I don't know.

Ralph Schoon commented Sep 26, 4:55 a.m.

FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER

If you use Lyo, you should be able to see the source code and be able to step through the authentication. You should also be able to see if you can add custom headers.

I would also suggest to ask here: https://forum.open-services.net/c/sdks/lyo/

Ralph Schoon commented Sep 26, 4:57 a.m.

FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER

You can also follow https://rsjazz.wordpress.com/2019/03/07/type-system-manager-part-2/ and find my code. Note that the code was created with an old version of lyo and the way I inject the header might no longer be available.

Dmitry A. Lesin commented Sep 28, 2:15 p.m. | edited Sep 28, 2:16 p.m.

Due to your tip, I have written an Email to Lyo team. They gave me another recommendation aimed to debugging the embedded Oauth app delivered with libraries within Eclipse. So, the problem was very like you were speaking but only "X-CSRF-Prevent" header was needed. It must contain JSESSIONID value. This is because we send request to Lyo adapter, but not Jazz itself.

Anyway, your two tips were very valuable for me and they moved me in right direction.
Thank you very much!

Dmitry A. Lesin commented Oct 10, 6:52 a.m.

Yes, a lot of problems gone out after testing the solution locally with HTTPS and a self-signed certificate. Thanks!

Dmitry A. Lesin commented Oct 10, 6:54 a.m.

Yes, a lot of problems gone away after testing the solution locally with HTTPS and a self-signed certificate. Thanks!

showing 5 of 9 show 4 more comments

It's all about the answers!

Related questions

IBM Jazz + Eclipse Lyo = CSRF problem

Accepted answer

Your answer