Crowd XSRF Check failed with proxy script
Asked by Christopher_Armstrong:

I'm trying to use Crowd to authenticate users using a local MAC application. In my first question, I wanted to know how I can authenticate the user, and this is resolved. I was told, that I should write a proxy web application, so that the application user and application password is not exposed in the MAC application.

See:

[https://community.atlassian.com/t5/Crowd-questions/Atlassian-Crowd-Authentication-with-FAT-client/qaq-p/926346?utm_source=atlcomm\&utm_medium=email\&utm_campaign=solution_to_question\&utm_content=topic](https://community.atlassian.com/t5/Crowd-questions/Atlassian-Crowd-Authentication-with-FAT-client/qaq-p/926346?utm_source=atlcomm&utm_medium=email&utm_campaign=solution_to_question&utm_content=topic)

I have created a PHP script, which acts as proxy, however now I get an XSRF Check Failed 403 Forbidden message when sending a post to the API, even though the IP has been configured as valid.

I was reading through the documentation and found this:

How to call protected REST APIs from third party websites  
It is not possible to call protected APIs from third party websites as this would pose a security risk.

So how can I write a proxy application, when Atlassian doesn't allow third party websites?

Thanks,

Chris


Answers:
author: Bruno Vincent
body: Hi [@Christopher_Armstrong](/t5/user/viewprofilepage/user-id/580692)
> How to call protected REST APIs from third party websites  
> It is not possible to call protected APIs from third party websites as this would pose a security risk.

The [documentation](https://confluence.atlassian.com/cloudkb/xsrf-check-failed-when-calling-cloud-apis-826874382.html) you are referring to applies to Atlassian Cloud APIs. It does not apply to Crowd's REST API.

The problem you are facing here is due to the [Httpful client library](http://phphttpclient.com/) which sends a regular browser user-agent header along with the HTTP request. Thus, Crowd thinks the HTTP request comes from a regular browser and responds with a XSRF Check failed error.

You just need to change the value of the User-Agent header here (for instance *PHP* or even a blank value will work):

```
->addHeader('User-Agent','PHP')
```

![Screen Shot 2018-11-04 at 20.45.39.png](https://community.atlassian.com/t5/image/serverpage/image-id/36719i7CA0DDED5EBE0F3E/image-size/large?v=v2&px=999 "Screen Shot 2018-11-04 at 20.45.39.png")

![Screen Shot 2018-11-04 at 20.46.43.png](https://community.atlassian.com/t5/image/serverpage/image-id/36720iEC811A7911BD6B8C/image-size/large?v=v2&px=999 "Screen Shot 2018-11-04 at 20.46.43.png")

comments: author: Christopher_Armstrong
body: Thanks a lot Bruno Vincent. That solved it. Your fast feedback is much appreciated guys.


author: Gonchik Tsymzhitov
body: Hi!

I use in my code parameter 'X-Atlassian-Token': 'no-check' like this

<https://github.com/atlassian-api/atlassian-python-api/blob/master/atlassian/rest_client.py#L14>

Hope it helps

Cheers,

Gonchik Tsymzhitov

comments: author: Christopher_Armstrong
body: Thanks a lot for this. I tried, but it didn't work. Still same message. Below my php code executed through Chrome.

\<?php  
include('./httpful.phar');

$uri = "<http://thecrowd.url:8095/crowd/rest/usermanagement/1/session>";  
$body = "{\\"username\\": \\"myuser\\", \\"password\\":\\"mypassword\\", \\"validation-factors\\": { \\"validationFactors\\": \[{\\"name\\": \\"remote_address\\", \\"value\\":\\"127.0.0.1\\"}\]}}";

$response = \\Httpful\\Request::post($uri)  
-\>authenticateWith('myappuser', 'myapppass')  
-\>addHeader('Content-Type', 'application/json')  
-\>addHeader('Accept', 'application/json')  
-\>addHeader('X-Atlassian-Token', 'no-check')  
-\>body($body)  
-\>send();

/\*  
// Get Groups  
$uri = "<http://milk.tendswiss.ch:8095/crowd/rest/usermanagement/1/user/group/direct?username=christopher.armstrong@tend.swiss>";

$response = \\Httpful\\Request::get($uri)  
-\>authenticateWith('christest', '123456')  
-\>addHeader('Content-Type', 'application/json')  
-\>addHeader('Accept', 'application/json')  
-\>send();  
\*/  
/\*  
$response = \\Httpful\\Request::post($uri)  
-\>authenticateWith('christest', '123456')  
-\>addHeader('Content-Type', 'application/json')  
-\>addHeader('Accept', 'application/json')  
-\>send();  
\*/  
echo "Done\<br\>";

var_dump($response);  
?\>


author: Gonchik Tsymzhitov
body: Hi!

Is it possible to set header variable in all request?

Cheers,

Gonchik Tsymzhitov


author: Christopher_Armstrong
body: What do you mean by "in all request"?

Currently I try to get this working, and this contains the X-Atlassian-Token header.

$uri = "<http://thecrowd.url:8095/crowd/rest/usermanagement/1/session>";  
$body = "{\\"username\\": \\"myuser\\", \\"password\\":\\"mypassword\\", \\"validation-factors\\": { \\"validationFactors\\": \[{\\"name\\": \\"remote_address\\", \\"value\\":\\"127.0.0.1\\"}\]}}";

$response = \\Httpful\\Request::post($uri)  
-\>authenticateWith('myappuser', 'myapppass')  
-\>addHeader('Content-Type', 'application/json')  
-\>addHeader('Accept', 'application/json')  
-\>addHeader('X-Atlassian-Token', 'no-check')  
-\>body($body)  
-\>send();


Tags: atlassian-support