403 Forbidden

[yudong5740]

Environment

self-hosted

Steps to Reproduce

My version is 21.10.0

http://****:9000/api/3/envelope/?sentry_key=ac3e2aa6d71041058386b58ef1fab76b&sentry_version=7&sentry_client=sentry.javascript.vue%2F7.45.0

Expected Result

{id:******}

Actual Result

Return Results ：Request URL: http://*****:9000/api/3/envelope/?sentry_key=ac3e2aa6d71041058386b58ef1fab76b&sentry_version=7&sentry_client=sentry.javascript.vue%2F7.45.0 Request Method: POST Status Code: 403 Forbidden Referrer Policy: origin

Return Results： CSRF verification failed The security token does not exist or is invalid If you constantly see this issue, you can try the following steps: Clear cookies (at least cookies under the Sentry domain name).

Reload the page you are attempting to submit (do not resubmit data).

Reenter the information and resubmit the form.

Read more about CSRF on Wikipedia.

Product Area

Unknown

Link

No response

DSN

No response

Version

No response

[getsantry[bot]]

Assigning to @getsentry/support for routing, due by Wednesday, April 26th at 5:00 pm (sfo). ⏲️

[getsantry[bot]]

Routing to @getsentry/issue-experience for triage, due by Friday, April 28th at 12:13 pm (sfo). ⏲️

[getsantry[bot]]

Routing to @getsentry/open-source for triage, due by Friday, April 28th at 1:04 pm (sea). ⏲️

[hubertdeng123]

@yudong5740 Are you using the docker compose version of self-hosted Sentry?

[rowan-wang]

How was it solved? I had the same problem

[github-actions[bot]]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[HenryXuTao]

I have the same problem, how to fix it?

[chadwhitacre]

Interesting that multiple people are hitting this. We're gonna need a lot more info to help you all debug. As @hubertdeng123 asked, are you using the stock Docker Compose version of self-hosted or something derivative? What's your network topology?

[LeanderD]

Same issue here. Also using the Docker compose version of self-hosted. It was working before I switched to https.

[hubertdeng123]

It's difficult to tell what might be going wrong without additional info. Are there any logs that are useful?

[djoeycl]

We got an similar problem.

We got it on the url: /api/0/internal/options/ response is 403 forbidden

Tried to change ratelimit from 1000 to 2000, but it cant be saved.

Version: Sentry 23.7.0.dev 02f14632

Nginx 9000 proxied to https

Which logs would be useful for you?

[hubertdeng123]

I suspect this may be a proxying issue since it seems that multiple people are only hitting this when using https. Is there any logs in your nginx or web containers that you can share?

[djoeycl]

I tried with an VPN that is running on this server, so i can access it on port 9000. Still /api/0/internal/options/ returns an 403 forbidden without any info.

How can i enable the logs for nginx on the docker image?

[LeanderD]

Sorry for my late reply.

The error I'm seeing in the logs is: 2023-07-08T05:28:45.630030Z ERROR relay_server::actors::upstream: authentication encountered error error=could not send request to upstream error.sources=[error sending request for url (http://web:9000/api/0/relays/register/challenge/): error trying to connect: tcp connect error: Connection refused (os error 111), error trying to connect: tcp connect error: Connection refused (os error 111), tcp connect error: Connection refused (os error 111), Connection refused (os error 111)]

I did change all the settings to switch to https, but somehow it's still using http internally.

[hubertdeng123]

How can i enable the logs for nginx on the docker image?

You can just use docker compose logs web to find the logs

I did change all the settings to switch to https, but somehow it's still using http internally.

Did you try to set a system.url-prefix?

[djoeycl]

How can i enable the logs for nginx on the docker image?

You can just use docker compose logs web to find the logs

I did change all the settings to switch to https, but somehow it's still using http internally.

Did you try to set a system.url-prefix?

Here are some logs when trying to update the rate limit

sentry-self-hosted-web-1 | 08:04:40 [INFO] sentry.access.api: api.access (method='GET' view='sentry.api.endpoints.internal.stats.InternalStatsEndpoint' response=200 user_id='1' is_app='None' token_type='None' is_frontend_request='True' organization_id='None' auth_id='None' path='/api/0/internal/stats/' caller_ip='xxxxxx' user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0' rate_limited='False' rate_limit_category='None' request_duration_seconds=1.1136538982391357 rate_limit_type='DNE' concurrent_limit='None' concurrent_requests='None' reset_time='None' group='None' limit='None' remaining='None') sentry-self-hosted-web-1 | 08:04:41 [INFO] sentry.superuser: superuser.request (url='http://localhost/api/0/internal/options/' method='GET' ip_address='xxxxxxx' user_id=1) sentry-self-hosted-web-1 | 08:04:41 [INFO] sentry.access.api: api.access (method='GET' view='sentry.api.endpoints.system_options.SystemOptionsEndpoint' response=200 user_id='1' is_app='None' token_type='None' is_frontend_request='True' organization_id='None' auth_id='None' path='/api/0/internal/options/' caller_ip='xxxxx' user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0' rate_limited='False' rate_limit_category='None' request_duration_seconds=0.07998847961425781 rate_limit_type='DNE' concurrent_limit='None' concurrent_requests='None' reset_time='None' group='None' limit='None' remaining='None') sentry-self-hosted-web-1 | 08:04:45 [INFO] sentry.superuser: superuser.request (url='http://localhost/api/0/internal/options/' method='PUT' ip_address='xxxxxx' user_id=1) sentry-self-hosted-web-1 | 08:04:45 [INFO] sentry.access.api: api.access (method='PUT' view='sentry.api.endpoints.system_options.SystemOptionsEndpoint' response=403 user_id='1' is_app='None' token_type='None' is_frontend_request='True' organization_id='None' auth_id='None' path='/api/0/internal/options/' caller_ip='xxxxxx' user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0' rate_limited='False' rate_limit_category='None' request_duration_seconds=0.730161190032959 rate_limit_type='DNE' concurrent_limit='None' concurrent_requests='None' reset_time='None' group='None' limit='None' remaining='None') sentry-self-hosted-web-1 | 08:04:45 [WARNING] django.request: Forbidden: /api/0/internal/options/ (status_code=403 request=<WSGIRequest: PUT '/api/0/internal/options/'>)

[devops-tavus]

I am also facing same issue but still didn't get any solution I installed sentry on Ubuntu not in docker directly on ec2

[LeanderD]

Did you try to set a system.url-prefix?

I think that's what I did, but I'm not sure.

I did manage to get everything working on https now. No idea what I did differently this time, but somehow it just worked and now everything is running on https like it should. No issues at all.

I did remove "everything" and started over from scratch. I thought I deleted everything using the nuclear option from the docs (https://develop.sentry.dev/self-hosted/troubleshooting/#nuclear-option), but after cloning the repo and installing Sentry the data from previous installs was still there. This time Sentry is running on https though.

I wish I could tell you what I did wrong the previous times, but unfortunately I have no idea. It's possible I tried setting the system.url-prefix. I'm sure I tried that at some point, but I'm also sure I didn't do that this time.

I just uncommented the lines for SSL/TLS in sentry.conf.py, changed my nginx config and that's about it.

[hubertdeng123]

I just uncommented the lines for SSL/TLS in sentry.conf.py, changed my nginx config and that's about it.

Well, thanks for the data point here. Glad to hear you got it working somehow

[kaustavb79]

Environment

self-hosted

Steps to Reproduce

My version is 21.10.0

http://****:9000/api/3/envelope/?sentry_key=ac3e2aa6d71041058386b58ef1fab76b&sentry_version=7&sentry_client=sentry.javascript.vue%2F7.45.0

Expected Result

{id:******}

Actual Result

Return Results ：Request URL: http://*****:9000/api/3/envelope/?sentry_key=ac3e2aa6d71041058386b58ef1fab76b&sentry_version=7&sentry_client=sentry.javascript.vue%2F7.45.0 Request Method: POST Status Code: 403 Forbidden Referrer Policy: origin

Return Results： CSRF verification failed The security token does not exist or is invalid If you constantly see this issue, you can try the following steps: Clear cookies (at least cookies under the Sentry domain name).

Reload the page you are attempting to submit (do not resubmit data).

Reenter the information and resubmit the form.

Read more about CSRF on Wikipedia.

Product Area

Unknown

Link

No response

DSN

No response

Version

No response

If you are serving it from http:// schema then comment the SSL/TLS config mentioned below in sentry.conf.py

###########
# SSL/TLS #
###########
# If you're using a reverse SSL proxy, you should enable the X-Forwarded-Proto
# header and enable the settings below
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SOCIAL_AUTH_REDIRECT_IS_HTTPS = True
# End of SSL/TLS settings

Save the file and restart docker: systemctl restart docker

[csvan]

In my case, the logs indicated this is a cookie issue:

 | 11:24:27 [WARNING] django.security.csrf: Forbidden (CSRF cookie not set.): /api/2/envelope (status_code=403 request=<WSGIRequest: POST '/api/2/envelope?

So this may give deeper insights to what is going wrong: https://forum.djangoproject.com/t/getting-forbidden-csrf-cookie-not-set-while-trying-to-login-to-django-admin-page/20645/11

[WilenChen]

same issue.

sentry-self-hosted-web-1 | 03:20:35 [WARNING] django.request: Forbidden: /api/0/internal/options/ (status_code=403 request=<WSGIRequest: PUT '/api/0/internal/options/'>)

[hubertdeng123]

@WilenChen That is an entirely different issue. That endpoint is internal and is used by admins. You are likely trying to access a page that only superusers can access.

[Erokos]

Did you try to set a system.url-prefix?

I think that's what I did, but I'm not sure.

I did manage to get everything working on https now. No idea what I did differently this time, but somehow it just worked and now everything is running on https like it should. No issues at all.

I did remove "everything" and started over from scratch. I thought I deleted everything using the nuclear option from the docs (https://develop.sentry.dev/self-hosted/troubleshooting/#nuclear-option), but after cloning the repo and installing Sentry the data from previous installs was still there. This time Sentry is running on https though.

I wish I could tell you what I did wrong the previous times, but unfortunately I have no idea. It's possible I tried setting the system.url-prefix. I'm sure I tried that at some point, but I'm also sure I didn't do that this time.

I just uncommented the lines for SSL/TLS in sentry.conf.py, changed my nginx config and that's about it.

Hi we're experiencing a similar issue with self-hosted sentry versions 24.1.0 and 24.1.1 deployed via the install script and docker-compose: [WARNING] django.security.csrf: Forbidden (CSRF token missing.): /api/1/envelope/ (status_code=403 request=<WSGIRequest: POST '/api/1/envelope/?sentry_key=<REDACTED>&sentry_version=7&sentry_client=sentry.javascript.react%2F7.98.0'>)

how did you change your nginx.conf? This info would be much appreciated.

[azaslavsky]

Does adding this (uncommented, and with your domain names) to your sentry.conf.py help? You'll need to restart the server.

[Erokos]

Thanks, in the end it was due to something else and we managed to solve the issue. Nevertheless this is good to know and thank you for the info.

[axelgenus]

I've been struggling with this for two hours. The CSRF_TRUSTED_ORIGINS array MUST INCLUDE the schema!

CSRF_TRUSTED_ORIGINS = ["example.com", "127.0.0.1:9000"]

should be

CSRF_TRUSTED_ORIGINS = ["https://www.example.com", "http://127.0.0.1:9000"]

[chadwhitacre]

Thanks for pushing through and posting back @axelgenus. 🙌

@Sweet-KK @theremoon-j Does the above help with your comments at https://github.com/getsentry/self-hosted/issues/2751#issuecomment-1952183896?

[getsantry[bot]]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you remove the label Waiting for: Community, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[caseyduquettesc]

If you're willing to accept the security risks, either because you have other infrastructure in front of sentry or because you just don't care, I found this to be the easiest way forward. In sentry's settings.py:

CSRF_TRUSTED_ORIGINS = [
    "http://*",
    "https://*",
]