{"action":"opened","issue":{"url":"https://api.github.com/repos/znc/znc/issues/946","labels_url":"https://api.github.com/repos/znc/znc/issues/946/labels{/name}","comments_url":"https://api.github.com/repos/znc/znc/issues/946/comments","events_url":"https://api.github.com/repos/znc/znc/issues/946/events","html_url":"https://github.com/znc/znc/issues/946","id":68414721,"number":946,"title":"CSRF Check fails while using nginx as reverse proxy and basic auth","user":{"login":"xpac1985","id":6882771,"avatar_url":"https://avatars.githubusercontent.com/u/6882771?v=3","gravatar_id":"","url":"https://api.github.com/users/xpac1985","html_url":"https://github.com/xpac1985","followers_url":"https://api.github.com/users/xpac1985/followers","following_url":"https://api.github.com/users/xpac1985/following{/other_user}","gists_url":"https://api.github.com/users/xpac1985/gists{/gist_id}","starred_url":"https://api.github.com/users/xpac1985/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xpac1985/subscriptions","organizations_url":"https://api.github.com/users/xpac1985/orgs","repos_url":"https://api.github.com/users/xpac1985/repos","events_url":"https://api.github.com/users/xpac1985/events{/privacy}","received_events_url":"https://api.github.com/users/xpac1985/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-14T15:36:54Z","updated_at":"2015-04-14T15:36:54Z","closed_at":null,"body":"Hey,\r\n\r\nI'm using znc 1.6.0 on Debian Jessie, together with nginx 1.6.2 as a reverse proxy.\r\nIt works fine, as long as I don't try to change anything ;-)\r\nWhenever I send a form, it fails with:\r\n\r\nAccess denied: POST requests need to send a secret token to prevent cross-site request forgery attacks.\r\n\r\nAs far as I can see the reason is in the nginx basic auth that I configured for that website.\r\nThe user and password are the same as for webadmin page, which results in me being automatically logged in when entering the credentials for the htaccess auth.\r\n\r\nBut this seems to lead to a behaviour that every request creates a new session id, which seems to kill the CSRF access token.\r\n\r\nI can see the following when running znc -Df\r\n\r\n[2015-04-14 17:18:13.334322] _LISTENER == ConnectionFrom(127.0.0.1, 51534) [Allowed]\r\n[2015-04-14 17:18:13.334991] There are [1] clients from [127.0.0.1]\r\n[2015-04-14 17:18:13.335437] =================== CWebSock::OnLogin(), basic auth? true\r\n[2015-04-14 17:18:13.335564] Remote IP:   (external IP); discarding session [ce6d19f5c3debd0ae8b4047ea6b00c3a3f7926465942dd68d5d6921bea807b29]\r\n[2015-04-14 17:18:13.335664] Auto generated session: [18bacfc287b33311601ecc14a2141d7535e0c8339ea92ba97b440b30814b7448]\r\n[2015-04-14 17:18:13.335788] Page Request [/znc/pub/_default_.css]\r\n[2015-04-14 17:18:13.335950] CTemplate::AppendPath(/usr/local/share/znc/webskins/_default_//) == [/usr/local/share/znc/webskins/_default_/]\r\n[2015-04-14 17:18:13.336041] CTemplate::AppendPath(/usr/local/share/znc/webskins/_default_//) == [/usr/local/share/znc/webskins/_default_/]\r\n[2015-04-14 17:18:13.336135]     Found  [/usr/local/share/znc/webskins/_default_/pub/_default_.css]\r\n[2015-04-14 17:18:13.336203] About to print [/usr/local/share/znc/webskins/_default_/pub/_default_.css]\r\n[2015-04-14 17:18:13.336351] - 200 (OK) [text/css; charset=utf-8]\r\n[2015-04-14 17:18:13.337658] - ETag: [] / If-None-Match []\r\n[2015-04-14 17:18:13.337823] Successful login attempt ==> USER [admin] ==> SESSION [18bacfc287b33311601ecc14a2141d7535e0c8339ea92ba97b440b30814b7448]\r\n\r\nThis keeps going on (especially the \"discarding session - generating session\" part) for every request that is being made.\r\n\r\nWhen I turn basic auth off, it looks like this:\r\n\r\n[2015-04-14 17:18:39.451747] _LISTENER == ConnectionFrom(127.0.0.1, 51545) [Allowed]\r\n[2015-04-14 17:18:39.451820] There are [0] clients from [127.0.0.1]\r\n[2015-04-14 17:18:39.452067] Page Request [/znc/login]\r\n[2015-04-14 17:18:39.452109] Found existing session from cookie: [b576a3461e12f0ad97abb3ca57d18d16dcc5d8775ac7ee456ec9be1d532b6972] IsLoggedIn(false)\r\n[2015-04-14 17:18:39.452163] =================== CWebSock::OnLogin(), basic auth? false\r\n[2015-04-14 17:18:39.452191] - Redirect to [/znc/?cookie_check=true] with prefix [/znc]\r\n[2015-04-14 17:18:39.452217] - 302 (Found) [text/html; charset=utf-8]\r\n[2015-04-14 17:18:39.452413] Successful login attempt ==> USER [xpac] ==> SESSION [b576a3461e12f0ad97abb3ca57d18d16dcc5d8775ac7ee456ec9be1d532b6972]\r\n\r\nSo, maybe the login-thingie needs to check if a user is already logged in and not recreate the session each time the browser submits the login data because of htaccess.\r\n\r\nBut this is just my interpretation of what is happening ;-)\r\n\r\nThanks for your great work!"}}