Forbidden (403) CSRF verification failed. Request aborted. (Deploying Defect Dojo using Helm Chart In AKS Cluster)

[vivekkontham]

Kubernetes Cluster : Azure K8's
K8's Version: v1.28.5

Defect Dojo is running in AKS cluster installed via helm charts

Database used : postgressql

Modifications : Changed service type to clusterip to load balancer ,Added few environment variables in configmap defectdojo
CSRF_COOKIE_HTTPONLY: "true"
CSRF_COOKIE_SECURE: "true"
DD_ALLOWED_HOSTS: '*'

Steps followed to install the defect dojo using helm chart

1. git clone https://github.com/DefectDojo/django-DefectDojocd django-DefectDojo
2. helm install ./helm/defectdojo --name=defectdojo --namespace=dojo --set django.replicas=2 --set celery.replicas=2 --set rabbitmq.replicas=2

Forbidden (403) CSRF verification failed. Request aborted. While Logging to the application

Tried adding DD_CSRF_TRUSTED_ORIGINS: '*' in ConfigMaps but still facing the same issue in logs we are able to see below warning 'WARNING [django.security.csrf:241] Forbidden (CSRF cookie not set.): /login'

[kiblik]

Hi @vivekkontham.

At first, for CSRF_, add prefix DD_ like

DD_CSRF_COOKIE_HTTPONLY: "true"
DD_CSRF_COOKIE_SECURE: "true"

I see that page is "Not secure". So secure cookie will not be sent to your page (if it is on HTTP and not on HTTPS).

[vivekkontham]

Hi @kiblik ,

I would like to thank for the quick response ,

I have Also Tried adding prefix DD_ to both the variables but still we are facing the same issue While accessing the application.

Yes the page is Not secure as we haven't attached any Certificate for secure connection as of now .

[kiblik]

Not secure connection might not be compatible with secure cookie. So until you will not enable HTTPS, set DD_CSRF_COOKIE_SECURE to false.

[vivekkontham]

Hi @kiblik ,

I have tried changing it but after changing we are not able to login , I have made another one change by adding below variable to false and it started working .
- name: DD_SESSION_COOKIE_SECURE
value: "False"

But now we are facing another issue were pod is currently getting restarted below is the error we tried to find from the logs

nginx 2024/04/22 07:37:12 [error] 10#10: *5029 connect() to unix:///run/defectdojo/uwsgi.sock failed (111: Connection refused) while connecting to upstrea │
│ m, client: XX.XX.XX, server: , request: "GET /alerts/count HTTP/1.1", upstream: "uwsgi://unix:///run/defectdojo/uwsgi.sock:", host: "XX.XX.XX", r │
│ eferrer: "http://XX.XX.XX/user/add" │
│ nginx XX.XX.XX- - [22/Apr/2024:07:37:12 +0000] "GET /alerts/count HTTP/1.1" 502 497 "http://XX.XX.XX/user/add" "Mozilla/5.0 (Windows NT 10.0; Wi │
│ n64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" │
│ nginx 2024/04/22 07:37:12 [error] 10#10: *5031 connect() to unix:///run/defectdojo/uwsgi.sock

[kiblik]

Nginx is not able to contact uwsgi but from your logs is not possible to identify why.