title: JasperServer proxy CSRF error
body: <p>I have a new installation of JasperReports Server 6.2 using the bundled Tomcat on Ubuntu 14.04 LTS with an Nginx proxy so I can access <a href="https://mydomain.xyz/jasperserver" rel="nofollow noreferrer">https://mydomain.xyz/jasperserver</a>. It mostly works, but I'm not able to manage users and roles. If I bypass Nginx and go straight to Tomcat <a href="http://123.123.123.123:8080/jasperserver" rel="nofollow noreferrer">http://123.123.123.123:8080/jasperserver</a>, everything works perfectly. The log indicates:</p>
  
  <blockquote>
    <p>2016-02-28 19:44:08,024 ERROR CsrfGuard,http-nio-8080-exec-3:44 - potential cross-site request forgery (CSRF) attack thwarted (user:, ip:127.0.0.1, uri:/jasperserver/flow.html, error:required token is missing from the request)</p>
  </blockquote>
  
  <p>This is exactly the same as this older question: <a href="https://stackoverflow.com/questions/17920949/running-jasperserver-behind-nginx-potential-csrf-attack">Running jasperserver behind nginx: Potential CSRF attack</a>. But I've tried both mitigations suggested, and it's still not working. </p>
  
  <ul>
  <li>I tried setting <code>underscores_in_headers on;</code>, first in just <code>http</code>, then in <code>server</code>, then in both.</li>
  <li>When that didn't work, I removed the underscores from <code>JASPER_CSRF_TOKEN</code> and <code>OWASP_CSRFTOKEN</code> in <code>WEB-INF/esapi/Owasp.CsrfGuard.properties</code></li>
  </ul>
  
  <p>I rebooted the server just to be sure everything was cleared and restarted, but still not working.</p>
  
  <p>I'm seeking suggestions for a resolution and/or guidance on where to look to diagnose the problem better. I'm new to Jasper and my Java/Tomcat skills are rusty.</p>