CSRF Verification Failed(token was not found or was invalid)

On-Premise
1

Hello everyone,

I’m having trouble setting up a new Sentry Native(crashpad) client in combination with an on-premise Sentry installation that has been running great for other clients.

In code the DSN is set with the following format:

sentry_options_set_dsn(options, "https://<KEY>@<ON_PREMISE_DOMAIN>/<PROJECT_ID>");

When I try to send an event with sentry_capture_event() the following error is given:
CSRF Verification Failed
A required security token was not found or was invalid.

I’ve tried multiple DSN formats and I’ve looked at other posts on this forum but I am unable to find a solution. I hope you can help me with this problem, thanks in advance!

2

Can you please share your logs from the on-premise instance and the version you are using?

3

Versions:

  • Sentry native 0.4.4
  • Sentry server 9.0.0

Logs(anonymized):

<IP_ADDRESS> - - [18/Dec/2020:10:04:05 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
<IP_ADDRESS> - - [18/Dec/2020:10:04:05 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
<IP_ADDRESS> - - [18/Dec/2020:10:04:10 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
<IP_ADDRESS> - - [18/Dec/2020:10:04:20 +0000] "GET /api/0/broadcasts/ HTTP/1.1" 200 495 "https://sentry.<COMPANY_NAME>.com/<COMPANY_NAME>/" "Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0"
<IP_ADDRESS> - - [18/Dec/2020:10:04:35 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
<IP_ADDRESS> - - [18/Dec/2020:10:04:36 +0000] "GET /api/0/projects/<COMPANY_NAME>/<NATIVE_PROJECT_NAME>/issues/?sort=date&query=is%3Aunresolved&limit=25&statsPeriod=24h&shortIdLookup=1&cursor=0:0:1 HTTP/1.1" 200 741 "https://sentry.<COMPANY_NAME>.com/<COMPANY_NAME>/<NATIVE_PROJECT_NAME>/" "Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0"
<IP_ADDRESS> - - [18/Dec/2020:10:04:38 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
<IP_ADDRESS> - - [18/Dec/2020:10:04:39 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
<IP_ADDRESS> - - [18/Dec/2020:10:04:42 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
<IP_ADDRESS> - - [18/Dec/2020:10:04:42 +0000] "POST /api/2/store/ HTTP/1.1" 200 366 "-" "sentry-cocoa"
10:04:58 [WARNING] django.request: Forbidden (Referer checking failed - no Referer.): /api/20/envelope/ (status_code=403 request=<WSGIRequest: POST u'/api/20/envelope/'>)
<IP_ADDRESS> - - [18/Dec/2020:10:04:58 +0000] "POST /api/20/envelope/ HTTP/1.1" 403 6655 "-" "sentry.native/0.4.4"
10:04:59 [WARNING] django.request: Forbidden (Referer checking failed - no Referer.): /api/20/envelope/ (status_code=403 request=<WSGIRequest: POST u'/api/20/envelope/'>)
<IP_ADDRESS> - - [18/Dec/2020:10:04:59 +0000] "POST /api/20/envelope/ HTTP/1.1" 403 6655 "-" "sentry.native/0.4.4"

Thank you for your quick response, I hope this information is helpful.

4

Hello Bert,
Hello Ernie,

I don’t know how your onpremise setup looks like, but those requests are supposed to go to the nginx or relay container, not to the Python webserver. Those endpoints are not implemented in Python at all.

5

Hello untitaker,

We have followed the docker onpremise setup guide from version 9.0.0, it seems the up to date version of onpremise is running with another container structure if I look at https://github.com/getsentry/onpremise/blob/9a80a19fd1ffbddfe795f51fc620ce012fca15db/docker-compose.yml

But if I understand correctly, you think that this is a reverse proxy issue? Is it possible that version 9.0.0 is not supported by sentry native?

We are planning to upgrade the onpremise installation but this will be delayed until January.

6

Yes, sentry-native specifically needs the envelope endpoint which has been added in sentry 10

7

That explains a lot haha, thank you for your help

8

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.