ForestAdmin / forest-rails

💎 Ruby on Rails agent for Forest Admin to integrate directly to your existing Ruby on Rails backend application.
https://www.forestadmin.com
GNU General Public License v3.0
374 stars 77 forks source link

Impossible to log-in because of CORS error #339

Closed jean-damien closed 4 years ago

jean-damien commented 4 years ago

Expected behavior

Access my data with the Forest UI.

Actual behavior

My team has been using flawlessly Forest for several months. From one day to another, it became impossible for all my Forest users to log-in to Forest. From a developper perspective I haven't done anything on the Forest back-end for several months or my server configuration.

My Chrome Browser is showing this error : Access to XMLHttpRequest at 'https://admin.origo.energy/forest/sessions' from origin 'https://app.forestadmin.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

I updated my gems, rails and the forest-liana. My SSL certificate is up to date. My Nginx configuration hasn't changed and the server is running well.

I tried to modify my Nginx configuration and added ` location /forest { allow all; proxy_pass https://app.forestadmin.com; include /etc/nginx/proxy_params; }

It is still impossible to access : 'https://admin.origo.energy/forest/sessions'.

Failure Logs

I checked all the logs : Nginx, passenger and rails and there are no particular error to notice.

Context

TODO: Please provide any relevant information about your setup.

arnaudbesnier commented 4 years ago

Hi @jean-damien,

Sorry to hear that. From which initial gem version did you upgrade to v4.1.3?

If you upgrade major version did you follow the "how to upgrade" notes:

Let me know if it helps.

jean-damien commented 4 years ago

Hello Arnaud, Thanks for your answer, after a 2 days complete review of our configuration, we've found the error placed in the CORS headers configuration. I guessed it had something to do with a browser update that included a more strict RGPD compliance which blocked us the connection to Forest.

I am closing the issue.