REST API Posting two request simultaneously with different properties fails with 403 status code due to CSRF check

Question

I'm sending two post requests using the REST API: http://localhost:8111/app/rest/buildQueue but my second request fails with

403 Forbidden: Responding with 403 status code due to failed CSRF check: no "Origin" header is present and no authentication provided with the request, consider adding "Origin: http://localhost:8111" header.

I'm wondering why is this happening since if I run the build in the UI and change the params ex. build1 has %version=2% and build2 has %version=3% it will run parallel with each other running on different available agents.

Here's my json request:

REST API endpoint: http://localhost:8111/app/rest/buildQueue

JSON body:

{
  "branchName": "master",
  "buildType": {
    "id": "DockerBuild",
    "projectId": "Test"
  },
  "properties": {
    "property": [
      {
        "name": "DOCKER_IMAGE_NAME",
        "value": "test-3"
      },
      {
        "name": "SNAPSHOT_DEPENDENCY_VERSION",
        "value": "0.6"
      }
    ]
  }
}

Am I missing a parameter to be able to run builds in parallel with each other?

Answer 1

When you face problems regarding CSRF protection in TeamCity (for example, you get the "Responding with 403 status code due to failed CSRF check" response from the server), you can follow these steps:

• If you use a reverse proxy, make sure you correctly configure Host/Origin headers, as described above. In the meantime, you may want to add the public URL of your server to CORS-enabled origins.

• You can temporary disable CSRF protection at all by setting the teamcity.csrf.origin.check.enabled=logOnly internal property.

• Information about failed CSRF attempts are logged into TeamCity/logs/teamcity-auth.log files. For more detailed diagnostics of the requests, enable debug-auth logging preset.

Try pass in the request header -H 'Origin: http://localhost:8111'