Git+HTTP not working due to CSRF problems
After updating my local copy of GitLab CE I'm unable to use git+http protocol. The problem was introduced in !3361 (merged) - a commit before this was merged is working fine. In logs I can see:
gdk:
17:49:06 gitlab-workhorse.1 | gitlab.dev 172.17.0.1:59092 - - [2016-06-08 17:49:04.913695293 +0200 CEST] "GET /root/test-repo-1.git/info/refs?service=git-upload-pack HTTP/1.1" 401 27 "" "git/2.8.1" 2.082186
17:49:07 gitlab-workhorse.1 | gitlab.dev 172.17.0.1:59092 - - [2016-06-08 17:49:06.996146077 +0200 CEST] "GET /root/test-repo-1.git/info/refs?service=git-upload-pack HTTP/1.1" 200 310 "" "git/2.8.1" 0.232081
17:49:07 gitlab-workhorse.1 | gitlab.dev 172.17.0.1:59092 - - [2016-06-08 17:49:07.230025497 +0200 CEST] "POST /root/test-repo-1.git/git-upload-pack HTTP/1.1" 422 8622 "" "git/2.8.1" 0.023368development.log:
Started POST "/root/test-repo-1.git/git-upload-pack" for 127.0.0.1 at 2016-06-08 17:49:07 +0200
Processing by Projects::GitHttpController#git_upload_pack as application/x-git-upload-pack-result
Parameters: {"namespace_id"=>"root", "project_id"=>"test-repo-1.git"}
Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms)
ActionController::InvalidAuthenticityToken - ActionController::InvalidAuthenticityToken:
actionpack (4.2.6) lib/action_controller/metal/request_forgery_protection.rb:181:in `handle_unverified_request'
actionpack (4.2.6) lib/action_controller/metal/request_forgery_protection.rb:209:in `handle_unverified_request'
devise (4.1.1) lib/devise/controllers/helpers.rb:253:in `handle_unverified_request'
actionpack (4.2.6) lib/action_controller/metal/request_forgery_protection.rb:204:in `verify_authenticity_token'
activesupport (4.2.6) lib/active_support/callbacks.rb:432:in `block in make_lambda'
activesupport (4.2.6) lib/active_support/callbacks.rb:164:in `block in halting'
activesupport (4.2.6) lib/active_support/callbacks.rb:504:in `block in call'
activesupport (4.2.6) lib/active_support/callbacks.rb:504:in `call'
activesupport (4.2.6) lib/active_support/callbacks.rb:92:in `__run_callbacks__'
activesupport (4.2.6) lib/active_support/callbacks.rb:778:in `_run_process_action_callbacks'
activesupport (4.2.6) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (4.2.6) lib/abstract_controller/callbacks.rb:19:in `process_action'
actionpack (4.2.6) lib/action_controller/metal/rescue.rb:29:in `process_action'
actionpack (4.2.6) lib/action_controller/metal/instrumentation.rb:32:in `block in process_action'
activesupport (4.2.6) lib/active_support/notifications.rb:164:in `block in instrument'
activesupport (4.2.6) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
activesupport (4.2.6) lib/active_support/notifications.rb:164:in `instrument'
actionpack (4.2.6) lib/action_controller/metal/instrumentation.rb:30:in `process_action'
actionpack (4.2.6) lib/action_controller/metal/params_wrapper.rb:250:in `process_action'
activerecord (4.2.6) lib/active_record/railties/controller_runtime.rb:18:in `process_action'
actionpack (4.2.6) lib/abstract_controller/base.rb:137:in `process'
actionview (4.2.6) lib/action_view/rendering.rb:30:in `process'
actionpack (4.2.6) lib/action_controller/metal.rb:196:in `dispatch'
actionpack (4.2.6) lib/action_controller/metal/rack_delegation.rb:13:in `dispatch'
actionpack (4.2.6) lib/action_controller/metal.rb:237:in `block in action'
actionpack (4.2.6) lib/action_dispatch/routing/route_set.rb:74:in `dispatch'
actionpack (4.2.6) lib/action_dispatch/routing/route_set.rb:43:in `serve'
actionpack (4.2.6) lib/action_dispatch/journey/router.rb:43:in `block in serve'
actionpack (4.2.6) lib/action_dispatch/journey/router.rb:30:in `serve'
actionpack (4.2.6) lib/action_dispatch/routing/route_set.rb:817:in `call'
lib/gitlab/middleware/go.rb:16:in `call'
rack-cors (0.4.0) lib/rack/cors.rb:80:in `call'
rack-attack (4.3.1) lib/rack/attack.rb:106:in `call'
warden (1.2.6) lib/warden/manager.rb:35:in `block in call'
warden (1.2.6) lib/warden/manager.rb:34:in `call'
rack (1.6.4) lib/rack/etag.rb:24:in `call'
rack (1.6.4) lib/rack/conditionalget.rb:38:in `call'
rack (1.6.4) lib/rack/head.rb:13:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/params_parser.rb:27:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/flash.rb:260:in `call'
rack (1.6.4) lib/rack/session/abstract/id.rb:225:in `context'
rack (1.6.4) lib/rack/session/abstract/id.rb:220:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/cookies.rb:560:in `call'
activerecord (4.2.6) lib/active_record/query_cache.rb:36:in `call'
activerecord (4.2.6) lib/active_record/connection_adapters/abstract/connection_pool.rb:653:in `call'
activerecord (4.2.6) lib/active_record/migration.rb:377:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/callbacks.rb:29:in `block in call'
activesupport (4.2.6) lib/active_support/callbacks.rb:88:in `__run_callbacks__'
activesupport (4.2.6) lib/active_support/callbacks.rb:778:in `_run_call_callbacks'
activesupport (4.2.6) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (4.2.6) lib/action_dispatch/middleware/callbacks.rb:27:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/reloader.rb:73:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/remote_ip.rb:78:in `call'
better_errors (1.0.1) lib/better_errors/middleware.rb:84:in `protected_app_call'
better_errors (1.0.1) lib/better_errors/middleware.rb:79:in `better_errors_call'
better_errors (1.0.1) lib/better_errors/middleware.rb:56:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/debug_exceptions.rb:17:in `call'
web-console (2.3.0) lib/web_console/middleware.rb:28:in `block in call'
web-console (2.3.0) lib/web_console/middleware.rb:18:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/show_exceptions.rb:30:in `call'
railties (4.2.6) lib/rails/rack/logger.rb:38:in `call_app'
railties (4.2.6) lib/rails/rack/logger.rb:20:in `block in call'
activesupport (4.2.6) lib/active_support/tagged_logging.rb:68:in `block in tagged'
activesupport (4.2.6) lib/active_support/tagged_logging.rb:26:in `tagged'
activesupport (4.2.6) lib/active_support/tagged_logging.rb:68:in `tagged'
railties (4.2.6) lib/rails/rack/logger.rb:20:in `call'
quiet_assets (1.0.3) lib/quiet_assets.rb:23:in `call_with_quiet_assets'
request_store (1.3.0) lib/request_store/middleware.rb:9:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/request_id.rb:21:in `call'
rack (1.6.4) lib/rack/methodoverride.rb:22:in `call'
rack (1.6.4) lib/rack/runtime.rb:18:in `call'
rack (1.6.4) lib/rack/lock.rb:17:in `call'
actionpack (4.2.6) lib/action_dispatch/middleware/static.rb:120:in `call'
lib/gitlab/middleware/static.rb:9:in `call'
rack (1.6.4) lib/rack/sendfile.rb:113:in `call'
sentry-raven (0.15.6) lib/raven/integrations/rack.rb:53:in `call'
railties (4.2.6) lib/rails/engine.rb:518:in `call'
railties (4.2.6) lib/rails/application.rb:165:in `call'
railties (4.2.6) lib/rails/railtie.rb:194:in `method_missing'
rack (1.6.4) lib/rack/urlmap.rb:66:in `block in call'
rack (1.6.4) lib/rack/urlmap.rb:50:in `call'
unicorn (4.9.0) lib/unicorn/http_server.rb:580:in `process_client'
unicorn (4.9.0) lib/unicorn/http_server.rb:674:in `worker_loop'
unicorn (4.9.0) lib/unicorn/http_server.rb:529:in `spawn_missing_workers'
unicorn (4.9.0) lib/unicorn/http_server.rb:140:in `start'
unicorn (4.9.0) bin/unicorn_rails:209:in `<top (required)>'
() home/git/src/gitlab/.bundle/ruby/2.1.0/bin/unicorn_rails:23:in `<top (required)>'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/cli/exec.rb:63:in `kernel_load'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/cli/exec.rb:24:in `run'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/cli.rb:304:in `exec'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/vendor/thor/lib/thor/command.rb:27:in `run'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/vendor/thor/lib/thor/invocation.rb:126:in `invoke_command'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/vendor/thor/lib/thor.rb:359:in `dispatch'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/vendor/thor/lib/thor/base.rb:440:in `start'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/cli.rb:11:in `start'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/exe/bundle:27:in `block in <top (required)>'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/lib/bundler/friendly_errors.rb:98:in `with_friendly_errors'
/usr/local/rbenv/versions/2.1.8/lib/ruby/gems/2.1.0/gems/bundler-1.12.5/exe/bundle:19:in `<top (required)>'
/usr/local/rbenv/versions/2.1.8/bin/bundle:23:in `<main>'