Summary

On attempting to establish an OAuth connection with Bitbucket, the following error is received after clicking the 'Accept' button:

Welcome to Bitbucket
Xsrf token validation failed

Environment

• Bitbucket Server/Data Center
• Third-party plugins have been installed

Diagnosis

On first being directed to Bitbucket, if you open Chrome Developer Tools (F12) → Network → authorize?oauth_callback... and review the Response Headers section, the following cookie should be getting set:

However - instead, the following cookies are the only ones present when the request is submitted to Bitbucket on hitting the 'approve' button:

          "cookies": [
            {
              "name": "BITBUCKETSESSIONID",
              "value": "REALLYLONGHEXADECIMALSTRING",
              "expires": null,
              "httpOnly": false,
              "secure": false
            },
            {
              "name": "_atl_bitbucket_remember_me",
              "value": "ANOTHERREALLYLONGRANDOMSTRING",
              "expires": null,
              "httpOnly": false,
              "secure": false
            },
            {
              "name": "wit-announce-token",
              "value": "REALLYLONGHEXADECIMALSTRING-BUT-THIS-TIME-WITH-DASHES",
              "expires": null,
              "httpOnly": false,
              "secure": false
            }
          ],

Cause

The expected atl.xsrf.token cookie is not being set due to an installed third-party plugin that is removing the cookie or blocking it from being set in the first place.

In previously seen instances of this issue, the following plugins have resulted in this issue:

Announcer for Bitbucket

com.wittified.atl-announcer-stash

Solution

Attempt to disable the faulting plugin, and see if the issue can still be reproduced. If the issue is resolved, it's recommended to check the offending plugin to see if any upgrades are available, or to reach out to the support resources for this plugin listed on the Atlassian Marketplace.

If your team is unsure which plugin could be causing the issue, it's recommended to try enabling 'Safe Mode' and then to try reproducing the issue using the following steps:

1. Navigate to Administration > Add-ons > Manage add-ons.
2. Click on the Enter safe mode link at the bottom of the page.
3. Click on Enter safe mode when you are prompted to confirm the operation.
4. Attempt to reproduce the issue in question.
5. When finished, you can exit safe mode by clicking on Exit Safe Mode and restore the previous configuration back on the Manage add-ons page.