Hi, we have a forum instance running for Chinese users, 1 out of 4 users is having trouble registering or loginin, instead of seeing the red error prompt box on that page, they got redirected to a plain text page showing "Forbidden", even after cleaning their cookies, this happens on varies browsers including chrome, edge, ie, also some Chinese browser such as UC. I've searched through the forum and tried any config but no luck. Please give advice.
Below are the setup and config files I have
Ubuntu 16.10
Nodebb version 1.5.1
Mongodb 2.6.11
Nginx 1.12.0
Nginx config
server {
listen 80;
server_name www.moefi.com;
return 302 https://$server_name$request_uri;
}
### the https server
server {
# listen on ssl, deliver with speedy if possible
listen 443 ssl spdy;
server_name www.moefi.com;
# change these paths!
ssl_certificate /etc/some.pem;
ssl_certificate_key /etc/some.key;
# enables all versions of TLS, but not SSLv2 or 3 which are weak and now
deprecated.
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
# disables all weak ciphers
ssl_ciphers 'AES128+EECDH:AES128+EDH';
ssl_prefer_server_ciphers on;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_set_header X-NginX-Proxy true;
proxy_pass http://127.0.0.1:4567;
proxy_redirect off;
# Socket.IO Support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
Nodebb config
{
"url": "http://www.moefi.com",
"secret": "secret",
"database": "mongo",
"port": 4567,
"mongo": {
"host": "127.0.0.1",
"port": "27017",
"username": "something",
"password": "something",
"database": "nodebb"
}
}
Error
20/6 09:47:18 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
20/6 18:14:28 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 06:31:10 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 06:31:13 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 06:31:23 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 06:31:33 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 06:31:48 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 06:31:52 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 06:32:11 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 06:33:34 [6838] - ^[[31merror^[[39m: /login
invalid csrf token 21/6 08:45:27 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 10:25:07 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 11:17:21 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 11:19:13 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 11:21:10 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 11:27:41 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 11:28:35 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 11:47:46 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
21/6 11:48:58 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 11:49:09 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 11:49:57 [6838] - ^[[31merror^[[39m: /login
invalid csrf token
21/6 11:54:16 [6838] - ^[[31merror^[[39m: /register
invalid csrf token
