Login session error popup loop

[phenomlab]

@mattdjuk Odd - what's the error message ?

[mattdjuk]

Ok, got NGINX to update - missed the semi colon!

However, its made no difference to the website, I still get the error message "invalid session..."

I've managed to get from the logs...

POST /logout
invalid csrf token

This is appearing every time I try to get to the site in Chrome. I'm not logged in, its a new site, I can't see any cookies have been created or anything like that.

[phenomlab]

@mattdjuk said in Login session error popup loop:

invalid csrf token

Yep. I've had this also. Try this
https://sudonix.com/topic/249/invalid-csrf-on-dev-install?_=1653292047605

[mattdjuk]

@phenomlab Thanks. Tried

I can now get an incognito window to work without the constant prompting. My main Chrome window still shows it constantly though but I think that's cache. Edge is now working too.

I'll clear out the cache in chrome and see if that helps.

Really helpful! Thanks again.

[phenomlab]

@mattdjuk No problems.

[mattdjuk]

Further to this - I can now get the site to show without the session error popup, but only when I use an incognito window. So far Chrome remains stuck with the pop up when I use it normally.

[phenomlab]

@mattdjuk I've had this exact same issue with Chrome. Does it still happen if you clear the cache completely, or if you press F12, then select the Network tab and select "Disable cache" (as shown below) and then reload the page ?

[mattdjuk]

@phenomlab Unfortunately it doesn't help. I can use Edge to log in to the admin area and it has a load of these errors:

POST /logout
invalid csrf token

Edge is fine, Chrome (normal, incognito) doesn't work and keeps prompting.

[phenomlab]

@mattdjuk Is the URL specified in config.json correct, and does it contain any trailing backslashes ?

[mattdjuk]

@phenomlab

Tried both in the config - with and without a trailing slash, e.g.

url": "http://forum.*******.co.uk"

and

url": "http://forum.*******.co.uk/"

Makes no difference

[phenomlab]

@mattdjuk Thanks. For clarity, the trailing backslash should not be there. Does the site function as desired when using Edge with no issues from the user perspective ? Does anything appear in the logs when the CSRF error is being generated ?

[mattdjuk]

@phenomlab I tried both, but its currently without the /

Edge works fine. I can use the site without issue. Its just Chrome.

The only thing I can see in the admin logs on /admin is this

022-05-24T15:16:43.080Z [4567/165874] - error: POST /logout
invalid csrf token

in the inspect tools in Chrome I see...

nodebb.min.js?v=eau0luijpea:2 POST https://forum.**********.co.uk/logout 403 (Forbidden)

[phenomlab]

@mattdjuk Can you contact me via PM and share your site URL ? I want to see if I can reproduce the issue in Chrome.

[mattdjuk]

@phenomlab Sure, will do. thanks

[phenomlab]

@mattdjuk Just checked. This is exactly the same issue I encountered in this post

https://sudonix.com/topic/249/invalid-csrf-on-dev-install?_=1653382858005

When you tried this the first time, are you sure you selected the right database ?

[mattdjuk]

@phenomlab I've just run this again. The first refresh, I actually got the screen without the session warning, but then the next time I refreshed, it was back.

Same error in the logs, and everything working fine in Edge.

[phenomlab]

@mattdjuk Bizarre. I actually get the same issue in Edge when accessing your site.

[mattdjuk]

@phenomlab You're right - as soon as I logged out from Edge, it started doing the same thing.

[phenomlab]

@mattdjuk There's something else going on here. Happy to help, but will likely need direct access to your site, and the VPS hosting it.

[mattdjuk]

@phenomlab

I've just noticed this in when I run the site as dev...

info: NodeBB is now listening on: 0.0.0.0:4567

In the Nginx config, it has

proxy_pass http://127.0.0.1:4567

Any connection do you think?