Invalid Security Token

[RethyLogiscool]

Hi, I have a problem with security token. I tried almost everything that I could find, but nothing helps.

A have a site "http://demo.dreamind.cz/". But my web hosting, has a weird folder structure, so if I want to access website I need to specify path like this "http://demo.dreamind.cz/domains/demo.dreamind.cz/". At this moment, everything is working great, but it look pretty weird and it is unusable for production. So I changed "custom_base_url" in "system.yaml" and website is looking normal, it is accessible with just "http://demo.dreamind.cz/", but administration isn't working. When I try to log in, "Invalid Security Token" error appears. So I even tried specify "session domain" in "system.yaml", but nothing works. When I delete "custom_base_url", log in is working, but with weird path "http://demo.dreamind.cz/domains/demo.dreamind.cz/".

Can someone help me? I even tried to change .htaccess "RewriteBase", but nothing happens.

Thank you very much for everything!

[mahagr]

Uhh, I would start by fixing the Apache/Nginx configuration. Maybe ask the support how to fix the domains.

[RethyLogiscool]

That was my first shot. They just told me, to put the website in /www folder, but that is not possible, because there are other production websites. The structure is:

> /www
> > /domains
> > > /demo.dreamind.cz
> > > 
> > /subdom
> > > /media (but this subdom folder makes it accessible from all alias domains that are attached to webhosting so it is useless) 

My other idea is to change webhosting provider, but that seems almost impossible right now because of dozens of production websites.

Is there any way to force insecure login? Because this is only testing domain for client and after production release, admin plugin will be removed. We have our own plugin that grabs content from headless API.

[mahagr]

It's all about apache configuration. You need to create vhosts for all the domains and point them to the correct folder. I have the setup even on my own computer; it's not hard to create these configurations, but if you're using cpanel/plesk/other management software, it basically means that you cannot use those anymore (though if you use them, they already provide the tools to create vhosts).

How apache has been set up depends on your flavor of OS, eg. if you use Debian/Ubuntu, Centos or if you manage your sites through some admin panel.

Here's an example from Ubuntu (slightly modified towards your needs, likely has mistakes, too):

/etc/apache2/sites-available/demo.dreamind.cz.conf:

# Replace with your user/group
Define site_user my_user
Define site_group my_group

# Replace with your ip
Define site_ip 127.0.0.1

Define site_domain demo.dreamind.cz
Define site_webmaster webmaster@dreamind.cz

# Replace with your path, though I recommend using this instead of /user
Define domain_root /home/${site_user}/www/${site_domain}
Define subdomain_root ${domain_root}/subdomains

<Macro DreamindSubdomain $(hostname) $(webmaster)>
    <VirtualHost ${site_ip}:80>
        # Redirect http to https
        ServerName $(hostname).${site_domain}

        Redirect 301 / https://$(hostname).${site_domain}/
    </VirtualHost>

    <VirtualHost ${site_ip}:443>
        ServerAdmin $(webmaster)
        DocumentRoot ${subdomain_root}/$(hostname)/public
        ServerName $(hostname).${site_domain}

        <IfModule mpm_itk_module>
            AssignUserId ${site_user} ${site_group}
        </IfModule>

    # You can also log to the domain_root, I don't need that in my local dev environment
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

    # Replace with your certs...
        SSLEngine on
        SSLCertificateFile /etc/apache2/certificate/apache-certificate.crt
        SSLCertificateKeyFile /etc/apache2/certificate/apache.key
    </VirtualHost>
</Macro>

<VirtualHost ${site_ip}:80>
    # Redirect www to without www and catch all non-existing subdomains
    ServerName ${site_domain}
    ServerAlias www.${site_domain}
    ServerAlias *.${site_domain}

    Redirect 301 / https://${site_domain}/
</VirtualHost>

<VirtualHost ${site_ip}:443>
    # Main domain (catch www and non-existing subdomains)
    ServerName ${site_domain}
    ServerAlias www.${site_domain}
    ServerAlias *.${site_domain}

    ServerAdmin ${site_webmaster}
    DocumentRoot ${domain_root}/public

    <IfModule mpm_itk_module>
        AssignUserId ${site_user} ${site_group}
    </IfModule>

    # You can also log to the domain_root, I don't need that in my local dev environment
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    # Replace with your certs...
    SSLEngine on
    SSLCertificateFile /etc/apache2/certificate/apache-certificate.crt
    SSLCertificateKeyFile /etc/apache2/certificate/apache.key
</VirtualHost>

# Include all the site specific configurations
IncludeOptional ${subdomain_root}/*/apache.conf

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Your main site root will be at ~/www/demo.dreamind.cz/public.

Additionally, you need something like this:

~/www/demo.dreamind.cz/subdomains/test:

apache.conf
public/

public/ contains symlinked version of grav (see bin/grav install -s ~/www/demo.dreamind.cz/subdomains/test/public with user/ folder replaced with your own) and configuration file:

~/www/demo.dreamind.cz/subdomains/test/apache.conf:

Use DreamindSubdomain subdomain webmaster@site.com

Of course, you also need wildcard support in DNS / ssl certs (cloudflare has those) etc....