Re: configuring lighttpd proxy for standalone roundup server

Sorry forgot to add:

127.0.0.1 - - [15/Apr/2023 22:28:00] "GET
/name/@@file/glyphicons-halflings.png HTTP/1.1" 200 -
127.0.0.1 - - [15/Apr/2023 22:28:03] "GET
/name/user?@template=forgotten HTTP/1.1" 200 -
2023-04-15 22:28:08,610 ERROR csrf Referer header check failed for
user2. Value=https://example.com/tracker/name/user?@template=forgotten

On Sat, Apr 15, 2023 at 10:35 PM Dave Bender <[email protected]> wrote:
>
> On Sat, Apr 15, 2023 at 10:16 PM John P. Rouillard <[email protected]> wrote:
> >
> > Hello Dave:
> >
> > I'm sorry you're running into trouble. This is an odd error.
> >
> > In message
> > <CAETHaKrG1RYBycsdL6n4p3YAc6UJKKcKS3sBKxf-KhJ-tCSeOw@mail.gmail.com> ,
> > Dave Bender writes:
> >
> > >  I am running into an issue with proxying to a roundup server
> > >Upon clicking "Lost your login", I correctly get routed to
> > >
> > >https://example.com/tracker/name/user?@template=forgotten
> > >
> > >However, when I click I get "Request password reset" I get
> > >
> > >Invalid Referer
> > >https://example.com/tracker/name/user?@template=forgotten,
> > >http://example.com/tracker/
> > >
> > >It seems that the referer attribute is not set properly.
> >
> > Interesting. I can't reproduce this on my trackers.
> >
> > I don't recognize this error message. I expect:
> >
> >   Invalid Referer: https://example.com/tracker/name/user?@template=forgotten
> >
> > The second URL, comma and lack of ':' in the message doesn't match
> > what's in the code. Am I correct that this error message is
> > displayed in the web interface and is not from the log file.
> >
>
> This is displayed in the web interface with red text and a pink
> background. Both URLs are present.
>
> > What is the value of web set to in the tracker section of config.ini?
> > I assume:
> >
> >   web = https://example.com/tracker/name
>
> The name is actually missing from the tracker. I have
>
> http://example.com/tracker/
>
> (I added the name of the tracker but no change in behaviour)
> >
> > where name is the name of the tracker and all trackers are clustered
> > under /tracker.
> >
> > Also which version of Roundup are you using?
>
> I am using Roundup version 2.1.0 with python version 3.10.10
>
> >
> > >Does anyone have a set of lighttpd rules working for a proxy to
> > >standalone server solution?
> > >
> > >This is my present entry for my site in my lighttpd.conf
> > >
> > >        $HTTP["host"] =~ "(^|\.)example\.com$" {
> > >
> > >                proxy.header += (
> > >                        "map-urlpath" => ( "/tracker/" => "/" )
> > >                        ,"https-remap" => "enable"
> > >                )
> > >
> > >                proxy.server = (
> > >                        "/tracker" => (("host" => "127.0.0.1", "port" => 10220))
> > >                )
> > >        }
> >
> > I haven't used lighttpd in a while. Does the proxy.header
> > section modify the URL
> >
> >    https://example.com/tracker/name/user?@template=forgotten
> >
> > to
> >
> >    http://example.com/name/user?@template=forgotten
> >
> > when it passes it to the standalone Roundup server?
>
> I think it is properly translating the URL?
>
> 127.0.0.1 - - [15/Apr/2023 22:28:00] "GET
> /name/@@file/glyphicons-halflings.png HTTP/1.1" 200 -
> 127.0.0.1 - - [15/Apr/2023 22:28:03] "GET
> /name/user?@template=forgotten HTTP/1.1" 200 -
>
>
> >
> > Your original error message included an http: url, I wonder if this
> > config is incorrectly modifying the Referer header somehow. The CSRF
> > prevention code requires a matching prefix and "https:" != "http:".
> >
> > Can you submit the "Request password reset" request while running
> > the browser debug tools and see what the value is of the Referer
> > header?
>
> https://example.com/tracker/name/user
>
> >
> > Have a great week.
> >
> > --
> >                                 -- rouilj
> > John Rouillard
> > ===========================================================================
> > My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users