Forbidden - CSRF header not found in request with bitbucket and tekton trigger with webhooks
Asked by anandjaisy:

I have set up the Tekton Trigger to auto-run the pipeline when certain code is pushed to the bitbucket repository.

    apiVersion: triggers.tekton.dev/v1beta1kind: EventListenermetadata:  name: bitbucket-listener  namespace: fetebird-commonspec:  serviceAccountName: tekton-triggers-example-sa  triggers:    - name: bitbucket-triggers      interceptors:        - ref:            name: "bitbucket"          params:            - name: secretRef              value:                secretName: git-ssh-key-secret                secretKey: ssh-privatekey            - name: eventTypes              value:                - repo:refs_changed      bindings:        - ref: bitbucket-trigger-binding      template:        ref: bitbucket-trigger-template

\<image removed to protect privacy\>

The details of the webhook

\<image removed to protect privacy\>

**Error** Forbidden - CSRF header not found in the request using the FREE trial version


Answers:
author: Ben
body: Hi Anand,

Thought I would jump in here as you have not received a response yet from our Community.

Based on the webhooks log you have provided - I can see that the error is being returned by Tekton itself and seems to indicate that the headers being sent by Webhooks are not considered valid by Tekton.

We do not have explicit knowledge of Tekton as it is a third-party platform, however - based on Tekton's documentation, I can see that it has a webhooks interceptor specifically made for this purpose: [https://tekton.dev/vault/triggers-v0.6.1/eventlisteners/#webhook-interceptor](https://tekton.dev/vault/triggers-v0.6.1/eventlisteners/#webhook-interceptors)[s](https://tekton.dev/vault/triggers-v0.6.1/eventlisteners/#webhook-interceptors)

Additionally, I notice that you are mentioning secrets in your YML configuration - at present, Webhooks does not support secrets although a feature request has been logged to track this with our development team:

* <https://jira.atlassian.com/browse/BCLOUD-14683>

Here is an example Webhooks header - Tekton will need to be configured to accept a header such as this, otherwise, it is likely that you will continue to encounter this issue:

```
Headersconnection Keep-Alivecontent-length 8668x-forwarded-server personal.webhooksx-forwarded-host personal.webhooksx-forwarded-for 18.246.31.226accept */*x-b3-sampled 1x-b3-spanid aa8d4ce456223054x-b3-traceid aa8d4ce456223054content-type application/jsonx-request-uuid a448af67-3068-4f20-bc32-2325a2edcf92x-attempt-number 1user-agent Bitbucket-Webhooks/2.0x-event-time Thu, 28 Sep 2023 12:27:26 GMTx-hook-uuid b956df39-eeb6-4fb0-8c0b-146d2c2131a5x-event-key repo:pushhost personal.webhooks
```

If you still encounter issues - I would suggest reaching out to the Tekton community for further assistance with configuring their platform-specific webhooks interceptor:  
<https://tekton.dev/community/>

Hope this helps steer you in the right direction.

Cheers!

- Ben (Bitbucket Cloud Support)

comments: author: anandjaisy
body: [@Ben](/t5/user/viewprofilepage/user-id/4537226) Any idea what is the webhook URL for tekton, I have put

### <http://34.173.33.220/v1/webhooks/bitbucket> where {#toc-hId-2063379476}

### 34.173.33.220 is Kubernetes public IP address {#toc-hId-255925013}


author: Ben
body: Hi [@anandjaisy](/t5/user/viewprofilepage/user-id/4220811)

Unfortunately, our knowledge is limited to how Bitbucket Webhooks sends events and the payload associated with them. Anything past that on the third-party side we would not be able to advise on, I would suggest contacting the Tekton community for this question.

Cheers!

- Ben (Bitbucket Cloud Support)


author: anandjaisy
body: [@Ben](/t5/user/viewprofilepage/user-id/4537226)

Now facing however bitbucket said 202

{"severity":"error","timestamp":"2023-10-17T11:56:04.801Z","logger":"eventlistener","caller":"sink/validate_payload.go:42","message":"Invalid event body format : unexpected end of JSON input","commit":"9498e02-dirty"}  
{"severity":"error","timestamp":"2023-10-17T11:56:32.548Z","logger":"eventlistener","caller":"sink/sink.go:438","message":"failed to ApplyEventValuesToParams: failed to replace JSONPath value for param gitrepositoryurl: $(body.repository.links.clone\[0\].href): clone is not found","commit":"9498e02-dirty","eventlistener":"bitbucket-listener","namespace":"fetebird-common","/triggers-eventid":"271a3671-a099-486d-9148-a05a1e6d7b47","eventlistenerUID":"199c84c0-1789-4784-8eba-55374a974e47","/triggers-eventid":"271a3671-a099-486d-9148-a05a1e6d7b47","/trigger":"bitbucket-triggers"}


Tags: bitbucket-cloud

cloud