etesync / etesync-web

An EteSync web client
https://www.etesync.com
GNU Affero General Public License v3.0
245 stars 29 forks source link

Error 400 "Field validations failed" on login #191

Open saierd opened 3 years ago

saierd commented 3 years ago

I am trying to update my self-hosted setup to Etebase and the master branch of etesync-web. I use REACT_APP_DEFAULT_API_PATH to change the default API path to / (thanks for fixing that recently, btw). This works exactly once to create the account. Afterwards, when I try to log in, I get the error 400 "Field validations failed".

Unfortunately, the UI does not show any details. But decoding the server response gives

{
  "code": "field_errors",
  "detail": "Field validations failed.",
  "errors": [
    {
      "field": "host",
      "code": "blank",
      "detail": "This field may not be blank."
    }
  ]
}

and indeed, if I enable advanced settings and specify the server URL explicitly, everything works as expected.

tasn commented 3 years ago

/ is not supported (though cool trick!), you should use the full server URL in this environment variable.

saierd commented 3 years ago

Why not? That was the original intention from my pull request (#130) and it actually does work on the legacy branch with the EteSync server.

The request also goes to the correct server, only the field validation on the server fails.

The actual server URL is not known in advance, because I want include this in my general Docker image.

tasn commented 3 years ago

Because we now enforce the host is correct on login. The server also checks it elsewhere with the ALLOWED_HOSTS setting. I guess the web client could be fixed to automatically use the hostname with sanitising the / you passed based on the current hostname. It shouldn't be too hard to do, we already have URL.js included in the build. It's just a matter of passing document.baseURI and the content of the env var to sanitise the URL. Also verifying that full URLs in the env var still work. I don't have time to do it at the moment, but it's really a quick fix + testing, so if you want to take a jab at it, I'm happy to accept such a PR.