Rails web monitoring and authenticity_token

[arndtt]

I thought it's better to start a new thread out of https://www.zabbix.com/forum/showthread.php?t=10661

I would like to monitor a Rails application that uses a simple authentication with username and password and the common Rails security feature authenticity_token which is a hidden field and contains a hash that is generated automatically with every website visit.

I managed to extract the token with a relative new feature on our Zabbix 2.2.5 server system:

https://www.zabbix.org/wiki/Docs/specs/ZBXNEXT-1597

http://blog.zabbix.com/zabbix-2-2-features-part-8-reusing-content-in-web-monitoring/2298/

But sometimes (not everytime) the login step in the web scenario fails if there are special characters in the hash....

my variable definition:

{token}=regex:input name="authenticity_token" type="hidden" value="(.{44})"

my post:

authenticity_token={token}

Rails Log:

Started POST "/login" for x.x.x.x at 2014-08-13 10:01:19 +0200
Processing by AccountController#login as */*
  Parameters: {"utf8"=>"✓", "back_url"=>"https://bla.bla.bla/", "authenticity_token"=>"DczPoEpy0I/Aojo9AF7W0LnqW2yt1 pmVm2nbIzdnQc=", "username"=>"zabbix", "password"=>"[FILTERED]", "login"=>"Anmelden »"}
WARNING: Can't verify CSRF token authenticity
  Rendered common/error.html.erb within layouts/base (0.3ms)
  Rendered plugins/redmine_banner/app/views/banner/_project_body_bottom.html.erb (0.0ms)
Filter chain halted as :verify_authenticity_token rendered or redirected
Completed 422 Unprocessable Entity in 10.7ms (Views: 9.1ms | ActiveRecord: 0.7ms)

=> Can you see the whitespace in the authenticity_token in the logfile ? I think but I'm not sure the website is giving the token hash in a format that can not be stored in a variable. Might be a special character like % or has something to to with url encoding...

How do I get out of this ? I'm not a regex expert but I think it's correct for my goal.

[richlv]

you are taking 44 characters, and "DczPoEpy0I/Aojo9AF7W0LnqW2yt1 pmVm2nbIzdnQc=" is 44 chars long.
what do you mean by "special characters" - can you post an exact example that fails ?

[arndtt]

Thanks for your reply. The example I already posted is the one that is failing. Sorry for making that not clear enough.

If you take a look at "DczPoEpy0I/Aojo9AF7W0LnqW2yt1 pmVm2nbIzdnQc=" you can see that between "1" and the "p" is a whitespace. I believe this is the problem here. No whitespaces within an authenticity_token are allowed...

My guess what happens here is the Rails authenticity_token that is required is actually "DczPoEpy0I/Aojo9AF7W0LnqW2yt1%pmVm2nbIzdnQc=" but my automated Zabbix login posts "DczPoEpy0I/Aojo9AF7W0LnqW2yt1 pmVm2nbIzdnQc="

I don't know why Zabbix or my regex is doing this but a possible reason could be Zabbix doesn't allow storing URL encoded strings in a variable if I interpret https://www.zabbix.com/documentation...web_monitoring in the right way. And as you know the "%" is a central charactar in the area of URL-encoding.

[richlv]

no, i meant the input case that results in the failure - are you sure it's "DczPoEpy0I/Aojo9AF7W0LnqW2yt1%pmVm2nbIzdnQc=" or is that just a guess ?
can you trace a failing case and see what exactly is contained in the page that makes it all fail ?

[arndtt]

Right now I'm only guessing. Give me some time if I'm able to debug this...

[richlv]

ok, let's see the input that results in this - until then it's unclear what the problem might be

[arndtt]

O.k. I'v edited the relevant ruby function according to this post:

http://stackoverflow.com/questions/1...ifferent-times

This results in the following log files (2 authentication attempts are shown):

Processing by AccountController#login as */*
Parameters: {"utf8"=>"✓", "back_url"=>"https://bla.bla.bla/", "authenticity_token"=>"fSdoIF/Aj380peiu1RL2H QfESk/8/55Jnaf3OxL0sA=", "username"=>"zabbix", "password"=>"[FILTERED]", "login"=>"Anmelden »"}
printing info from `verified_request?` ...
request_forgery_protection_token = authenticity_token
form_authenticity_token = fSdoIF/Aj380peiu1RL2H+QfESk/8/55Jnaf3OxL0sA=
params[request_forgery_protection_token] = fSdoIF/Aj380peiu1RL2H QfESk/8/55Jnaf3OxL0sA=
request.headers['X-CSRF-Token'] = 
WARNING: Can't verify CSRF token authenticity


Processing by AccountController#login as */*
Parameters: {"utf8"=>"✓", "back_url"=>"https://bla.bla.bla/", "authenticity_token"=>"jgExECYdNvfS0N8c jnaxAfTW7kS83JlmZapnwseexw=", "username"=>"zabbix", "password"=>"[FILTERED]", "login"=>"Anmelden »"}
printing info from `verified_request?` ...
	request_forgery_protection_token = authenticity_token
	form_authenticity_token = jgExECYdNvfS0N8c+jnaxAfTW7kS83JlmZapnwseexw=
	params[request_forgery_protection_token] = jgExECYdNvfS0N8c jnaxAfTW7kS83JlmZapnwseexw=
	request.headers['X-CSRF-Token'] = 
WARNING: Can't verify CSRF token authenticity

=> The '+' character is filtered out by my regex definition...

[richlv]

according to wiper, this is likely to be caused by server not url-encoding sent data - which would be https://support.zabbix.com/browse/ZBXNEXT-2074

[fserve]

i have a similar problem, but when i tried what you did, i got another problem.
i just can't use any kind of regex in my zabbix.

the variables
{username}=admin
{password}=pass
{token}=regex:input name="authenticity_token" type="hidden" value="(.{44})"
{utf8}=✓
{login}=Sign in »

give to me:
Error: error in scenario variables "{username}=admin {password}=pass {token}=regex:input name="authenticity_token" type="hidden" value="(.{44})" {utf8}=✓ {login}=Sign in»": cannot extract the value of "{token}" from response