{"action":"created","issue":{"url":"https://api.github.com/repos/sharelatex/web-sharelatex/issues/264","repository_url":"https://api.github.com/repos/sharelatex/web-sharelatex","labels_url":"https://api.github.com/repos/sharelatex/web-sharelatex/issues/264/labels{/name}","comments_url":"https://api.github.com/repos/sharelatex/web-sharelatex/issues/264/comments","events_url":"https://api.github.com/repos/sharelatex/web-sharelatex/issues/264/events","html_url":"https://github.com/sharelatex/web-sharelatex/issues/264","id":162149477,"number":264,"title":"CSRF not working","user":{"login":"the-glu","id":4920043,"avatar_url":"https://avatars.githubusercontent.com/u/4920043?v=3","gravatar_id":"","url":"https://api.github.com/users/the-glu","html_url":"https://github.com/the-glu","followers_url":"https://api.github.com/users/the-glu/followers","following_url":"https://api.github.com/users/the-glu/following{/other_user}","gists_url":"https://api.github.com/users/the-glu/gists{/gist_id}","starred_url":"https://api.github.com/users/the-glu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/the-glu/subscriptions","organizations_url":"https://api.github.com/users/the-glu/orgs","repos_url":"https://api.github.com/users/the-glu/repos","events_url":"https://api.github.com/users/the-glu/events{/privacy}","received_events_url":"https://api.github.com/users/the-glu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-06-24T13:43:32Z","updated_at":"2016-06-27T14:56:27Z","closed_at":null,"body":"Hello,\r\n\r\nI have issues trying to setup the docker image (0.2.0 or the latest).\r\n\r\nI have 403 responses when I try to login or reset password.\r\n\r\nLogs show that the CSRF token is invalid:\r\n\r\n`{\"name\":\"web-sharelatex\",\"hostname\":\"34c1f93eba77\",\"pid\":76,\"level\":40,\"err\":{\"message\":\"invalid csrf token\",\"name\":\"ForbiddenError\",\"stack\":\"ForbiddenError: invalid csrf token\\n  at csrf (/var/www/sharelatex/web/node_modules/csurf/index.js:112:19)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at session (/var/www/sharelatex/web/node_modules/express-session/index.js:398:7)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at cookieParser (/var/www/sharelatex/web/node_modules/cookie-parser/index.js:34:14)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at serveStatic (/var/www/sharelatex/web/node_modules/express/node_modules/serve-static/index.js:74:16)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at Function.handle (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:176:3)\\n  at router (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:46:12)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:615:15\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:256:14)\\n  at Function.handle (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:176:3)\\n  at router (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:46:12)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at /var/www/sharelatex/web/app/js/infrastructure/Server.js:168:14\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at app.use.res.render.title (/var/www/sharelatex/web/app/js/infrastructure/Server.js:158:12)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at module.exports (/var/www/sharelatex/web/app/js/infrastructure/OldAssetProxy.js:27:14)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at module.exports (/var/www/sharelatex/web/app/js/infrastructure/RedirectManager.js:23:14)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at /var/www/sharelatex/web/node_modules/metrics-sharelatex/http.coffee:30:3\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at methodOverride (/var/www/sharelatex/web/node_modules/method-override/index.js:79:5)\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at /var/www/sharelatex/web/node_modules/multer/index.js:218:19\\n  at Layer.handle [as handle_request] (/var/www/sharelatex/web/node_modules/express/lib/router/layer.js:95:5)\\n  at trim_prefix (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:312:13)\\n  at /var/www/sharelatex/web/node_modules/express/lib/router/index.js:280:7\\n  at Function.process_params (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:330:12)\\n  at next (/var/www/sharelatex/web/node_modules/express/lib/router/index.js:271:10)\\n  at /var/www/sharelatex/web/node_modules/body-parser/lib/read.js:129:5\\n  at invokeCallback (/var/www/sharelatex/web/node_modules/body-parser/node_modules/raw-body/index.js:262:16)\\n  at done (/var/www/sharelatex/web/node_modules/body-parser/node_modules/raw-body/index.js:251:7)\\n  at IncomingMessage.onEnd (/var/www/sharelatex/web/node_modules/body-parser/node_modules/raw-body/index.js:307:7)\\n  at IncomingMessage.emit (events.js:92:17)\\n  at _stream_readable.js:944:16\\n  at process._tickDomainCallback (node.js:502:13)\\n\",\"code\":\"EBADCSRFTOKEN\"},\"url\":\"/login\",\"method\":\"POST\",\"msg\":\"invalid csrf\",\"time\":\"2016-06-24T13:36:46.314Z\",\"v\":0}`\r\n\r\nChecking headers, no cookie is set, so I assume this may be the problem, my old sharelatex install set a `sharelatex.sid` cookie.\r\n\r\nI'm behing an ssl nginx proxy, configured as said on the wiki. Using direct access don't works either. I also tried direct access into the container on the port 3000, no cookie is set.\r\n\r\nI tried to set (or unset) `SHARELATEX_BEHIND_PROXY` and `SHARELATEX_BEHIND_PROXY` but with the same error.\r\n\r\n`SHARELATEX_SITE_URL` is set to the external endpoint on the ngnix with ssl.\r\n\r\nI tried differents browsers, same error.\r\n\r\nAny advice ? Thanks !"},"comment":{"url":"https://api.github.com/repos/sharelatex/web-sharelatex/issues/comments/228770671","html_url":"https://github.com/sharelatex/web-sharelatex/issues/264#issuecomment-228770671","issue_url":"https://api.github.com/repos/sharelatex/web-sharelatex/issues/264","id":228770671,"user":{"login":"the-glu","id":4920043,"avatar_url":"https://avatars.githubusercontent.com/u/4920043?v=3","gravatar_id":"","url":"https://api.github.com/users/the-glu","html_url":"https://github.com/the-glu","followers_url":"https://api.github.com/users/the-glu/followers","following_url":"https://api.github.com/users/the-glu/following{/other_user}","gists_url":"https://api.github.com/users/the-glu/gists{/gist_id}","starred_url":"https://api.github.com/users/the-glu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/the-glu/subscriptions","organizations_url":"https://api.github.com/users/the-glu/orgs","repos_url":"https://api.github.com/users/the-glu/repos","events_url":"https://api.github.com/users/the-glu/events{/privacy}","received_events_url":"https://api.github.com/users/the-glu/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T14:56:26Z","updated_at":"2016-06-27T14:56:26Z","body":"Ok, I found my problem.\r\n\r\nIf I don't set `SHARELATEX_SECURE_COOKIE`, set it to 0, false, False or what ever, it's dosen't works.\r\n\r\nBut if I edit https://github.com/sharelatex/sharelatex-docker-image/blob/master/settings.coffee#L132 to `secureCookie: false` it's works.\r\n\r\nSo it's an issue with environment variables in the docker image :)"}}
{"actor":{"display_login":"the-glu"}}