etsy / 411

An Alert Management Web Application
https://demo.fouroneone.io
MIT License
971 stars 112 forks source link

Login does not work (I followed the readme) #9

Closed norandom closed 8 years ago

norandom commented 8 years ago

Hey,

I cannot generate a successful login.

I installed 411 on a host and then:

:/var/www/411$ sudo sqlite3 data.db < db.sql
:/var/www/411$ sudo bin/create_site.php
Creating new site
Site name: test
Hostname: test
From email: test@test.com
From Error email: test@test.com
Default To email: test@test.com

Site created! ID: 1
marius@rkv-c3s-selks2:/var/www/411$ sudo bin/create_user.php
Creating new user
Username: user
Real name: User User
Password: 
Email: user@test.de
Admin (y/n): n

User created! ID: 1

So far, so good. Now I go to the site and voila:

capture

I have the distinct feeling that the hostname needs to be correct. Is that so?

I checked out the DB:

 sudo sqlite3 data.db
SQLite version 3.8.7.1 2014-10-29 13:59:56

sqlite> .tables
alert_logs      groups          report_targets  search_targets  users
alerts          jobs            reports         searches
config          lists           search_filters  sites
group_targets   meta            search_logs     slogs
sqlite> select * from users;
1|1|user|User User|$2y$10$EvfB6.2XkRcuobAEPnNLKuu5IqLx0BH/aQKXkrkRS9uzmaNcGHy9.|user@test.de|0|{}|0|1471875162|1471875162

I keep the hash here since it's obviously just a test in the lab ;). Anyways, I don't get a successful login with this.

missnebun commented 8 years ago

Hi @norandom . I had the same exact problem. The problem is the hostname part. You need to add the add the hostname: as the URL that you are accessing 411. So let's say that your URL: server1.example.com that is what you need to have hostname as server1.example.com.

kiwiz commented 8 years ago

Yup. Alternatively, you can the 411HOST Apache environment variable to the same value as the site (so test in your case).

norandom commented 8 years ago

I also changed the default port from 80 to 8081.

If I create a host with correct_hostname.local it does not work. If I use correct_hostname.local:8081 a load screen appears. The credentials are accepted but nothing happens. The loading does not finish, yet does also not consume CPU or memory.

The Apache error message is:

[Mon Aug 22 15:39:53.227926 2016] [:error] [pid 10139] [client 1.2.3.4:43639] except [NONE] FOO\\UnauthorizedException: "Invalid nonce specified" at [/var/www/411/phplib/REST.php:101]
0:[FOO\\REST->route() called at [/var/www/411/htdocs/api/login.php:6]], referer: http://correct_host.local:8081/login

I'd say the requirement is that we have to use a default port for now. I'd say this is a bug ;)

kiwiz commented 8 years ago

@norandom: Hmm, can you try clearing your cookies and seeing if that works?

missnebun commented 8 years ago

Can you do me a favor and add the hostname as the ip address of the 411 server and then use as URL the IP address. See if that works.

norandom commented 8 years ago

@kiwiz that had no effect. I switched the default port to 80 to avoid having the :port in the URL.

The error message - cookies have been cleared before the login - is:

[:error] [pid 26809] [client 127.0.0.1:59468] except [NONE] FOO\\UnauthorizedException: "Invalid nonce specified" at [/var/www/411/phplib/REST.php:101] 0:[FOO\\REST->route() called at [/var/www/411/htdocs/api/login.php:6]], referer: ... http://correct:hostname.local/login

@missnebun If I use the hostname instead of the qualified domain name I run into the same issue.

capture2 [:error] [pid 26809] [client 127.0.0.1:60754] except [NONE] FOO\\UnauthorizedException: "Invalid nonce specified" at [/var/www/411/phplib/REST.php:101] 0:[FOO\\REST->route() called at [/var/www/411/htdocs/api/login.php:6]], referer: http://correct-hostname/login

I guess I have to debug this a little... At this point I haven't gotten into the code enough to pinpoint where it steps our or why.

missnebun commented 8 years ago

@norandom take a look at this https://github.com/kiwiz/411/issues/5

norandom commented 8 years ago

Okay, I can confirm that setting the hostname here fixes the issue. Thanks a lot for the support!

kiwiz commented 8 years ago

Great! Going to close this issue since this is now resolved. :]