Horizon 403 on production

[shy7lo]

Hi, I have a production server provisioned by forge and a laravel 5.5 app with PHP 7.1. I installed horizon and configured it according to my needs including queues by Redis and Daemon according to laravel documentation. I have not enabled Auth for Horizon for now.

When I try to access /horizon, I get this whoops and the status code of request is 403. I am not sure what is the problem here.

On my local machine and development VPS (provisioned by forge and app is deployed by forge too), it is working perfectly.

Attached is a screenshot of the error.

Any help and guidance will be appreciated.

Thank you

[niclashedam]

I have not enabled Auth for Horizon for now.

If you do not provide a specific authentication callback, Horizon will only be available in the local environment. Horizon should never be publicly accessible, as this would be a major security issue.

[aditya-rewari-cb]

I have not enabled Auth for Horizon for now.

If you do not provide a specific authentication callback, Horizon will only be available in the local environment. Horizon should never be publicly accessible, as this would be a major security issue.

How to do this ? I mean how rather where do I provide this specific authentication callback? Thanks

[marcosdsdba]

I have not enabled Auth for Horizon for now.

If you do not provide a specific authentication callback, Horizon will only be available in the local environment. Horizon should never be publicly accessible, as this would be a major security issue.

How to do this ? I mean how rather where do I provide this specific authentication callback? Thanks

After register Horzion in config/app.php

providers[ ... App\Providers\HorizonServiceProvider::class,, ]

Add on HorizonServiceProvider.php use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;

In boot() function place this code:

Horizon::auth(function ($request) { if ($request->ajax()){ return true; } else if (isset($request->checkstatus) && $request->checkstatus == 'ok'){ return true; }else{ throw new UnauthorizedHttpException('Unauthorized'); }

Run php artisan config:clear

Acces Horizon sending querystring parameter: checkstatus=ok Ex.: mydomain.com/horizon/dashboard/?checkstatus=ok

Have a fun!

[niclashedam]

Acces Horizon sending querystring parameter: checkstatus=ok Ex.: mydomain.com/horizon/dashboard/?checkstatus=ok

This is not a very good authorization scheme. You should check that the user is logged in and is an administrator.