422 Unprocessable Entity, JS Files, gitlab 8.17, apache ssl - apache

Question

yesterday a make a new gitlab 8.17.0 installation on ubuntu 16.04 installation and confgure it like the old one which I have documented. I am running a apache2 which letsencrypt as a proxy. It looks as if everything runs well, but a few JS files are not loaded. I get "422 Unprocessable Entity" https at
domain/assets/webpack/application-XXX.js
domain/assets/webpack/lib_dX.js
domain/assets/webpack/users-X.js
domain/assets/webpack/lib_d3-X.js
domain/assets/webpack/users-X.js
/etc/gitlab/gitlab.rb
external_url 'https://gitlab.example.com'
nginx['listen_address'] = 'localhost'
nginx['listen_port'] = 8080
nginx['listen_https'] = false
web_server['external_users'] = ['www-data']
nginx['enable'] = false
/etc/apache2/sites-available/gitlab.example.com.conf
<VirtualHost *:80>
ServerName gitlab.example.com
ServerAdmin mail#gitlab.example.com
ErrorLog /var/log/apache2/gitlab.example.com/error.log
CustomLog /var/log/apache2/gitlab.example.com/access.log combined
Redirect 301 / https://gitlab.example.com/
</VirtualHost>
<VirtualHost *:443>
ServerName gitlab.example.com
ServerAdmin mail#gitlab.example.com
ErrorLog /var/log/apache2/gitlab.example.com/error.log
CustomLog /var/log/apache2/gitlab.example.com/access.log combined
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
ProxyPreserveHost On
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/gitlab.example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/gitlab.example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/gitlab.example.com/chain.pem
<Proxy http://localhost:8080/>
Order deny,allow
Allow from all
</Proxy>
</VirtualHost>
Does anyone have ideas to solve the problem?
Thank you! I wish you a nice Sunday.

Answer 1

I had same problem with serving mentioned static files but behind nginx proxy. In /var/log/gitlab/gitlab-rails/production.log file there were errors:
Started GET "/assets/webpack/application-0b895f7016d93748393a-v2.js" for 127.0.0.1 at 2017-03-05 11:14:21 +0100
Processing by ApplicationController#route_not_found as JS
Parameters: {"unmatched_route"=>"assets/webpack/application-0b895f7016d93748393a-v2"}
Security warning: an embedded <script> tag on another site requested protected JavaScript.
If you know what you're doing, go ahead and disable forgery protection on this action to
permit cross-origin JavaScript embedding.
Completed 422 Unprocessable Entity in 28ms (ActiveRecord: 1.8ms)
ActionController::InvalidCrossOriginRequest (Security warning: an embedded
<script> tag on another site requested protected JavaScript. If you know
what you're doing, go ahead and disable forgery protection on this action to
permit cross-origin JavaScript embedding.):
lib/gitlab/middleware/multipart.rb:93:in `call'
lib/gitlab/request_profiler/middleware.rb:14:in `call'
lib/gitlab/middleware/go.rb:16:in `call'
So I've made changes in /opt/gitlab/embedded/service/gitlab-rails/config/environments/production.rb:
config.action_controller.allow_forgery_protection = false
# Disable Rails's static asset server (Apache or nginx will already do this)
config.serve_static_files = true
and restarted gitlab (gitlab-ctl restart). Now it works, however I suppose that security of my server is weakened.

Answer 2

This is an issue in 8.17 thas hasn't been fixed yet.
Just downgrade to 8.16 sudo apt-get install gitlab-ce=8.16.6-ce.0