pgadmin-org / pgadmin-org/pgadmin4

CSRF token missing on Firefox Android (Mobile) due multi sessions

Open
#9,623 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug
Dominant language
Python
Stars
3.8k
Forks
891
Avg merge
4d 7h
Merged PRs (30d)
8

Description

Please note that security bugs or issues should be reported to security@pgadmin.org.

Describe the bug
I am running pgAdmin 4 (v9.12) behind Nginx. Login works perfectly on Firefox Desktop. However, on Firefox Android, the application generate multiple Session IDs leading to the error "CSRF session token is missing." while the problem a new session created with new CSRF

To Reproduce
I've attached the Nginx headers log for requests and responses from /pgadmin on both desktop and mobile to compare the reasons, aslo pgadmin error log to check the Flask server behavior when receive mobile requests

Screenshots
attached

If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

  • OS: Arch Linux
  • pgAdmin 9.12 built on server python venv
  • Mode: Server
  • Browser: Firefox Andorid mobile
  • Package type: Python

Image
Image
Image
Image
pgadmin4-bug-report.log.txt
pgadmin_debug_nginx_firefox_desktop.log
pgadmin_debug_nginx_firefox_mobile.log
pgadmin_error_firefox_desktop.log
pgadmin_error_firefox_mobile.log

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the attached Firefox Desktop and Firefox Android Nginx request logs, error logs, and bug-report log to trace when the session and CSRF values diverge. Reproduce the issue on Firefox Android behind Nginx; done means the mobile login flow no longer creates conflicting sessions or reports a missing CSRF session token.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.