Rails2 and authenticity_token

[craig.taverner]

Rails2.0 added an 'authenticity_token' to all web-forms to prevent some types of attack to web applications. I have been unable to get zabbix to perform form submissions (POST) to these sites. For example, this is the difference between a rails1.2 and rails2.0 login form, as seen from zabbix.

rails1.2. I simply add 'login=xxx&password=yyy' to the POST fields of the http://my.host.com/login url. I add the response content test for 'logged in' and this succeeds. So my web-site availability scenario can include login, perform some user action, and logout.

rails2.0. Needs something like 'login=xxx&password=yyy&authenticity_token=zzz' in the POST fields. The problem is that the authenticity token is found from a hidden field in the form itself (generated by the form builder). So zabbix needs to read the previous page, use a regex to find and extract the field into a variable, and then add that to the POST fields with authenticity_token={auth_token}.

I am using zabbix-server 1.4.2 on ubuntu hardy-heron (the choice of zabbix version is based on what ubuntu provides by default).

So, any ideas how to do this?

[Alexei]

It is not supported currently. This is something I'd like to see implemented in future releases.

[craig.taverner]

Suggested solution

Hi Alexei,

I was thinking of a conceptual solution, and that is that since the check on page output is done using regular expressions, if the user uses brackets '(' and ')' in the regex, you could save the groups as variables, and reference them in later pages as {1}, {2}, etc. This would solve the problem perfectly.

So, for my example, I would first have a stage that goes to the page with the login form, eg. a GET to http://my.domain/login, and then check the output for the text
authenticity_token=\"([\w\d]+)\"
and then in the next stage I could use the post variables:
login={user}&password={pwd}&authenticity_token={1}
assuming {user} and {pwd} were defined in the normal way for the scenario.

So, what are the odds of this getting into an upcoming release? What about the chance of my coding a patch? I'm not sure if I have the time, but if I did squeeze it in, do you have pointers for where in the code I should look?

Cheers, Craig

[kokomo]

Any solution?

Hello,

Does anybody have a workaround? (for making variables taken from regex of the previous output data) That would be super.

[vesal]

Hello,

Is this feature supported yet with Zabbix 2.2.2? If it is how I can implement it?

[vesal]

Hello,

Is this feature supported yet with Zabbix 2.2.2? If it is how I can implement it?

Looks like it is implemented now. https://www.zabbix.org/wiki/Docs/specs/ZBXNEXT-1597

I'm just wondering how one can match following meta content with it:

<meta content="authenticity_token" name="csrf-param" />
<meta content="e9c9p1jcvcnt6MQ7v5Pkc98plga8g2dMGX6xC35vwFUS2OY=" name="csrf-token" />

[vesal]

Looks like it is implemented now. https://www.zabbix.org/wiki/Docs/specs/ZBXNEXT-1597

I'm just wondering how one can match following meta content with it:

<meta content="authenticity_token" name="csrf-param" />
<meta content="e9c9p1jcvcnt6MQ7v5Pkc98plga8g2dMGX6xC35vwFUS2OY=" name="csrf-token" />

Answer to my own question is. One would match authenticity token with following regex

content="(.+?)" name="csrf-token"

[arndtt]

Vesal - is it possible you post some more details how you solved this in Zabbix ? I'm very interested how your web scenario steps look like in detail in order to monitor a Rails application.

We are using Zabbix for a few weeks now, but haven't found a solution in this area so far.

This URL here was my first reference:

http://blog.zabbix.com/zabbix-2-2-features-part-8-reusing-content-in-web-monitoring/2298/

This is my variable definition:

{user}=zabbix
{password}=blablabla
{token}=regex:name="authenticity_token" type="hidden" value="(.+?)"
{utf8}=✓
{login}=Anmelden »

And this the post data I'm sending via Zabbix:

utf8={utf8}&authenticity_token={token}&username={user}&password={password}&login={login}

However my the Rails App log says:

Processing by AccountController#login as */*
  Parameters: {"utf8"=>"✓", "back_url"=>"https://blablabla/", "authenticity_token"=>"i TCMHQqOzQeGtR17ChlefoQ9CVVv06hlAm6wm1keyM=\" /></div>\n\n<table>\n<tr>\n    <td style=\"text-align:right", "\"><label for"=>"\"password\">Kennwort:</label></td>\n    <td style=\"text-align:left", "\"><input id"=>"\"password\" name=\"password\" tabindex=\"2\" type=\"password\...

I can see that authenticity_token is actually posted correctly but afterwards the whole website code is posted also...

[arndtt]

I made some huge steps in this issue but it's not completely solved

https://www.zabbix.com/forum/showthread.php?t=46413