jwilder NGINX proxy issue with Confluence
Asked by gaurav:

Installed Confluence in Dockerise enviroment .

* Using jwilder nginx proxy  

* Let's Encrypt
* Postgres 6.9 Docker
* Confluence in Docker

<br />

<br />

<br />

<br />

<br />

*https redirection working fine secure connection when base url is <http://confluence.domain.com>*

<br />

Problem is when i set base url to <https://confluence.domain.com> Confluence displays the following message to administrators:

**Can't check your base URL**   
There may be a problem with your proxy configuration.

If set to  
<http://confluence.domain.com> no warning message working fine  
Everything is working fine . Accepting some thing which i found till now .

* Plugin not able to install
* Not able to set base URL to https , only working fine when set to http

<br />

<br />

> **Warning logs**   
> WARN \[http-nio-8090-exec-58\] \[common.security.jersey.XsrfResourceFilter\] passesAdditionalBrowserChecks Additional XSRF checks failed for request: <http://confluence.domain.com/rest/analytics/1.0/publish/bulk> , origin: <https://confluence.domain.com> , referrer: <https://confluence.domain.com/> , credentials in request: true , allowed via CORS: false

```
Proxy Setting in Confluence
<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
maxThreads="48" minSpareThreads="10"
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
protocol="org.apache.coyote.http11.Http11NioProtocol"
proxyName="confluence.domain.com" proxyPort="443" scheme="https"/>
```

```
jwilder-nginx proxy setting
# confluence.domain.com
upstream confluence.domain.com {
## Can be connect with "docker_intranet" network
# confluence
server 172.19.0.6:8090;
}
server {
server_name confluence.domain.com;
listen 80 ;
access_log /var/log/nginx/access.log vhost;
return 301 https://$host$request_uri;
}
server {
server_name confluence.domain.com;
listen 443 ssl http2 ;
access_log /var/log/nginx/access.log vhost;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-R$
ssl_prefer_server_ciphers on;
ssl_session_timeout 5m;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_certificate /etc/nginx/certs/confluence.domain.com.crt;
ssl_certificate_key /etc/nginx/certs/confluence.domain.com.key;
ssl_dhparam /etc/nginx/certs/confluence.domain.com.dhparam.pem;
add_header Strict-Transport-Security "max-age=31536000";
include /etc/nginx/vhost.d/default;
location / {
proxy_pass http://confluence.domain.com;
}
}
```


Answers:
author: AnnWorley
body: Hi Gaurav,

I understand you are getting XSRF errors when you access Confluence over https through your NGINX proxy. Please see this article for conditions that cause XSRF errors: [Cross Site Request Forgery (CSRF) protection changes in Atlassian REST](https://confluence.atlassian.com/kb/cross-site-request-forgery-csrf-protection-changes-in-atlassian-rest-779294918.html)

For an example of how to set up the NGINX proxy to work with Confluence, please refer to [Running Confluence behind NGINX with SSL](https://confluence.atlassian.com/confeap/running-confluence-behind-nginx-with-ssl-849150880.html).

I look forward to hearing how it goes.

Thanks,

Ann

PS - I think there is a typo on your PostgreSQL version, as 9.6 is commonly used and 6.9 is quite old.

comments: author: gaurav
body: Thanks, @\[deleted\]  
I did a fresh install with all recommendation.

Install Confluence in Production with Docker everything is was working fine.

First thing I did was change proxy in server.xml.  
Updated base URL in Confluence <https://confluence.domain.com/>  
The problem which I troubleshoot is from NGINX configuration.

<br />

Postgres 9.6 is on different docker.  
Confluence is on different docker.

But both are on the same server. so I used network so that they can talk. But problem is when updating Nginx with suggested configuration it is not working problem is  
nginx: \[emerg\] upstream "confluence.domain.com" may not have port 8091 in /etc/nginx/conf.d/default.conf:123

updated Nginx configuration  
# confluence.domain.com 8091  
upstream confluence.domain.com {  
## Can be connect with "docker_intranet" network  
# confluence  
server 172.19.0.8:8090;  
}  
server {  
server_name confluence.domain.com;  
listen confluence.domain.com:80 ;  
access_log /var/log/nginx/access.log vhost;  
return 301 https://$host$request_uri;  
}  
server {  
server_name confluence.domain.com;  
listen 443 default ssl;  
access_log /var/log/nginx/access.log vhost;  
ssl_protocols SSLv2 SSLv3 TLSv1;  
ssl_ciphers HIGH:!aNULL:!MD5;  
ssl_prefer_server_ciphers on;  
ssl_session_timeout 5m;  
ssl_session_cache shared:SSL:50m;  
ssl_session_tickets off;  
ssl_certificate /etc/nginx/certs/confluence.domain.com.crt;  
ssl_certificate_key /etc/nginx/certs/confluence.domain.com.key;  
ssl_dhparam /etc/nginx/certs/confluence.domain.com.dhparam.pem;  
add_header Strict-Transport-Security "max-age=31536000";  
location / {  
client_max_body_size 100m;  
proxy_set_header X-Forwarded-Host $host;  
proxy_set_header X-Forwarded-Server $host;  
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
proxy_pass <http://confluence.domain.com>;  
}  
location /synchrony {  
proxy_set_header X-Forwarded-Host $host;  
proxy_set_header X-Forwarded-Server $host;  
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
proxy_pass <http://confluence.domain.com:8091/synchrony>;  
proxy_http_version 1.1;  
proxy_set_header Upgrade $http_upgrade;  
proxy_set_header Connection "Upgrade";  
}  
}


Tags: confluence-administration