Handling CSRF Header Check Issues

Overview

Customers may encounter a "CSRF Header check failed" message in their Mattermost Server logs. This article clarifies the issue, its implications, and recommended actions to resolve it.

Error Message

You may see the following error message in your logs:

CSRF Header check failed for request - Please upgrade your web application or custom app to set a CSRF Header

Cause of the Error

This error typically appears as a debug message, indicating that authentication attempts are occurring without a CSRF header. By default, this message does not enforce any action but serves as a warning that authentication is occurring incorrectly.

If ExperimentalStrictCSRFEnforcement is set to true, this error escalates from a debug message to a warning, and incoming requests without a valid CSRF header get rejected.

Solutions and Recommendations

1. Verify and Update Client Authentication:
   • Ensure that all Mattermost clients and custom applications are updated to the latest versions.
   • Our clients are designed to set CSRF headers correctly. If they are not, an update might resolve this issue.
2. Review External Integrations:
   • For external integrations using cookie-based authentication, explicitly add CSRF headers to requests.
   • It is recommended to move away from cookie-based authentication and instead use more secure methods like bot account tokens or Personal Access Tokens (PATs).
3. Review Documentation and Code:
   • Check that your implementation aligns with the latest security practices recommended in Mattermost's API documentation.

For further assistance, please contact Mattermost support.