Server error, please contact an administrator

[Zooko Wilcox-O'Hearn]

I am trying to update a ticket and when I click "Post Comment" I get a pop-up that says:

Error
----
The following errors were encountered:
Server error, please contact an administrator.

The ticket I was trying to update is https://bugs.launchpad.net/ubuntu/+source/foolscap/+bug/388855

[Zooko Wilcox-O'Hearn (zooko)]

Okay I've reproduced this and I can tell that it happens when I have network.http.sendRefererHeader = 0 or = 1 but it does not happen when I have = 2. I set that configuration (for privacy and security reasons) by following these instructions: http://cafe.elharo.com/privacy/privacy-tip-3-block-referer-headers-in-firefox/

Suggestions:

1. Make the error message more clear in the case that this occurs. For example, the error message could say "I'm sorry, but launchpad requires Referer headers to perform this action and there is no Referer header present. Perhaps you have blocked Referer headers or perhaps you navigated to this URL in an unexpected way. Please unblock Referer headers for launchpad.net and try again, or contact $SUPPORT_CHANNEL for assistance."

2. Change launchpad to perform correctly without Referer headers. They are sometimes blocked by client-side privacy and security tools and relying on them is risky since launchpad coders may inadvertently come to rely on them for security when of course they can be easily forged by an attacker.

[Gary Poster (gary)]

We have consciously decided to require REFERER headers to combat CRSF attacks, despite the known annoyances. Agreed on suggestion 1.

[Gary Poster (gary)]

As an aside, this plugin may be of interest to you, as it allows you to more selectively control your REFERER header. That said, I know it only by its description and reviews.

https://addons.mozilla.org/en-US/firefox/addon/953