[solved] "Invalid Session" problem

Pappmann

There is a new Problem in Nodebb 1.0.3 latest master installed on linux based root server with apache 2.4. and mongodb

Some user have now "invalid session" (csrf-invalid) problem and cannot login. On Google Chrome i have this problem too. Delete, Cache, Cookies... does not help.

Anyone have an idea to fix it?

Pappmann

anyone can help?

it looks like only one user have this problem, since i login with username an password of that user, i have the same problem, and now i cant login with my admin account on this browser (chrome).

./nodebb reset -a -> does not help
mongo: db.sessions.remove() -> does not help too, nobody can login (invalid session)

is there any opportunity to reset the sessions for the affected user?

julian

Hi @Pappmann! This is an unfortunate breaking change that was introduced and affects users using nginx as a reverse proxy.

https://docs.nodebb.org/en/latest/configuring/proxies/nginx.html

Specifically, you will need this new directive added: proxy_set_header X-Forwarded-Proto $scheme;

I put it after the X-Forwarded-For line, though it can go anywhere in that server/location block, really.

Pappmann

@julian said in "Invalid Session" problem:

Hi @Pappmann! This is an unfortunate breaking change that was introduced and affects users using nginx as a reverse proxy.

https://docs.nodebb.org/en/latest/configuring/proxies/nginx.html

Specifically, you will need this new directive added: proxy_set_header X-Forwarded-Proto $scheme;

I put it after the X-Forwarded-For line, though it can go anywhere in that server/location block, really.

U mean i have to change my webserver from apache to nginx?

julian

Oh, Apache... in that case, I'm not sure of the syntax, but you'll need to have Apache pass in the X-Forwarded-Proto header to NodeBB as well.

julian

@Pappmann:

<VirtualHost *:80>
    RequestHeader set X-Forwarded-Proto "http"
    …
</VirtualHost>

<VirtualHost *:443>
    RequestHeader set X-Forwarded-Proto "https"
    …
</VirtualHost>

Pappmann

Ok thanks i have to enable some apache mods?

Pappmann

solved

can anyone add it to official documentation?
https://docs.nodebb.org/en/latest/configuring/proxies/apache.html

Thanks