search

snipe / snipe-it

A free open source IT asset/license management system
https://snipeitapp.com
GNU Affero General Public License v3.0
10.79k stars 3.12k forks source link

SESSION_DRIVER=cookie breaks the application #13701

Open vladimir-krstulja-ipf opened 11 months ago

vladimir-krstulja-ipf commented 11 months ago

Debug mode

Describe the bug

If the SESSION_DRIVER env is set to cookie, two things (that were tested here) stop working:

  1. Pre-flight check cannot create the first user
  2. Cannot login

In both cases, the pages just reload, with no error or message logged: not in the page, nor the JS console, nor the laravel log.

Reproduction steps

  1. configure SESSION_DRIVER=cookie
  2. recache the config (ie. php artisan config:cache)
  3. clear all cookies, go to your Snipe-IT application and try to login

Alternatively during the Pre-flight check:

  1. Run through the pre-flight check and try to create the first admin user

Expected behavior

Login working normally; pre-flight check creating the first user.

Screenshots

No response

Snipe-IT Version

6.1.2

Operating System

Debian 11 (Bullseye)

Web Server

nginx

PHP Version

7.4

Operating System

No response

Browser

No response

Version

No response

Device

No response

Operating System

No response

Browser

No response

Version

No response

Error messages

No response

Additional context

Installation from git, running natively on the server, not in a docker container.

snipe commented 11 months ago

I'd probably check that your COOKIE_DOMAIN and SECURE_COOKIES settings are correct for your application. We have not made any changes to cookie storage in some time.

snipe commented 11 months ago

(Also make sure there are no weird characters in your passwords in that file, etc. Trailing spaces and unenclosed characters can cause things to break in weird ways)

vladimir-krstulja-ipf commented 11 months ago

The COOKIE_DOMAIN and SECURE_COOKIES I checked, and they're both as they should be (correct domain, https only, proper public CA TLS cert (LetsEncrypt)). I'm also assuming that if those were incorrect, not even the file based session would work? The app is still setting cookies.

I'm sorry, I failed to mention in the report that when the session driver is set to file, the application works normally.