pgadmin-org / pgadmin-org/pgadmin4
CSRF token missing on Firefox Android (Mobile) due multi sessions
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
Please note that security bugs or issues should be reported to security@pgadmin.org.
Describe the bug
I am running pgAdmin 4 (v9.12) behind Nginx. Login works perfectly on Firefox Desktop. However, on Firefox Android, the application generate multiple Session IDs leading to the error "CSRF session token is missing." while the problem a new session created with new CSRF
To Reproduce
I've attached the Nginx headers log for requests and responses from /pgadmin on both desktop and mobile to compare the reasons, aslo pgadmin error log to check the Flask server behavior when receive mobile requests
Screenshots
attached
If applicable, add screenshots to help explain your problem.
Desktop (please complete the following information):
- OS: Arch Linux
- pgAdmin 9.12 built on server python venv
- Mode: Server
- Browser: Firefox Andorid mobile
- Package type: Python
pgadmin4-bug-report.log.txt
pgadmin_debug_nginx_firefox_desktop.log
pgadmin_debug_nginx_firefox_mobile.log
pgadmin_error_firefox_desktop.log
pgadmin_error_firefox_mobile.log
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the attached Firefox Desktop and Firefox Android Nginx request logs, error logs, and bug-report log to trace when the session and CSRF values diverge. Reproduce the issue on Firefox Android behind Nginx; done means the mobile login flow no longer creates conflicting sessions or reports a missing CSRF session token.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100