REST API Posting two request simultaneously with different properties fails with 403 status code due to CSRF check

user_10841169 0
Viewed 1652

'm sending two post request using the REST API: http://localhost:8111/app/rest/buildQueue but my second request fails with 403 Forbidden: Responding with 403 status code due to failed CSRF check: no "Origin" header is present and no authentication provided with the request, consider adding "Origin: http://localhost:8111" header. I'm wondering why is this happening since if i run the build in the UI and change the params ex. build1 has %version=2% and build2 has %version=3% it will run parallel with each other running on different available agents.

Here's my json request that i send

REST API:http://localhost:8111/app/rest/buildQueue JSON BODY:

{ "branchName":"master", "buildType":{ "id":"DockerBuild", "projectId":"Test" }, "properties":{ "property":[ { "name":"DOCKER_IMAGE_NAME", "value":"test-3" }, { "name":"SNAPSHOT_DEPENDENCY_VERSION", "value":"0.6" } ] } }

Am i missing a parameter to be able to run build in parallel with each other?

403 Forbidden: Responding with 403 status code due to failed CSRF check: no "Origin" header is present and no authentication provided with the request, consider adding "Origin: http://localhost:8111" header.

teamcity-rest-api teamcity json
3 Answers

When you face problems regarding CSRF protection in TeamCity (for example, you get the "Responding with 403 status code due to failed CSRF check" response from the server), you can follow these steps:

  • If you use a reverse proxy, make sure you correctly configure Host/Origin headers, as described above. In the meantime, you may want to add the public URL of your server to CORS-enabled origins.

  • You can temporary disable CSRF protection at all by setting the teamcity.csrf.origin.check.enabled=logOnly internal property.

  • Information about failed CSRF attempts are logged into TeamCity/logs/teamcity-auth.log files. For more detailed diagnostics of the requests, enable debug-auth logging preset.

Try pass in the request header -H 'Origin: http://localhost:8111'

user_63005550

Maybe this can be useful for someone, I got the same error with a single POST using Postman:

403 Forbidden: Responding with 403 status code due to failed CSRF check: no "Origin" header is present and no authentication provided with the request, consider adding "Origin: http://teamcity:20011" header.

So I followed the recommendation of the error message, and in Header I added "Origin" with the value "http://teamcity:20011" and that fixed the issue. BTW, in Authorization I selected "Bearer Token" and I pasted the token generated previously through TeamCity. This is the call:

http://teamcity:20011/app/rest/buildQueue

I was just testing how to trigger a build using the API and it worked successfully. Now the following step is to implement this call using JavaScript.

user_37354500

Request a CSRF header with the appropriate request: https://teamcity/authenticationTest.html?csrf

and set it in the "X-TC-CSRF-TOKEN" header of your POST request

user_52886670
Related