Open Sjors opened 2 years ago
I get the same error (firefox on linux). Closing and opening the specter tap usually helps.... But It would be great to fix that.
It is probably related to https://github.com/cryptoadvance/specter-desktop/issues/1469
This is probably due to some weird combination of
/spc
(`config.py?)config.py
)In @moneymanolis case, it was not only while using hwi but almost in any request. The "solution" is to delete all cookies on localhost:25441
or de-/activating a auth-scheme and/or explicitely logout/-in again.
Does this help? Assigned the bug label but probably won't fix it if the solution is as simple as this.
I'm only seeing one cookie and deleting it doesn't help:
de-/activating a auth-scheme and/or explicitely logout/-in again
What do you mean by this? I'm running on localhost without any authentication.
Quick fix seems to be to login (enable authentication under http://127.0.0.1:25441/spc/settings/auth for that). @Sjors @relativisticelectron
That worked!
I'm still a bit puzzled that cookie deletion didn't work but regarding that this is a one-time issue with a workaround on Development only, i'll close this issue.
Ok, I'll let you know if I ever run into this in production mode (haven't tried yet).
I'm now able to reproduce this. I also now how it happens but not exactly why. If the fetch-API is calling hwi-endpoints, those are post-requests and the endpoint sets a new cookie with a csrf-token in the session. Those are cookies which have the scope /spc
but they lack the csrf-token.
When this token is sent with the post-request which is creating the device, the The CSRF session token is missing
indeed.
If authentication is activated, the hwi-endpoints for some reason no longer send any cookies and so the csrf-token in the first cookie is preserved and the issue doesn't happen.
As this persists if you switch back to "non-auth", this is a bug. Reopening. Helpfull was this: https://github.com/noraj/flask-session-cookie-manager
On master @ a3b73f2d8bbea147148a0c57d7d5474471c2acd1. I keep getting "Session expired" messages, including when I try to import (more) keys from a Ledger. Refreshing the browser doesn't help. Seeing this in both Safari and Chrome on macOS.
Some log: