Posts made by julian

You shouldn't need to start and enable NodeBB every time you reboot the server, once you've enable'd it once, it should come up again every time you reboot.

@Nick-Harmon Could be you don't need a plugin for something that simple... if the user is already logged in on the forum, then your app could really just GET /api/notifications to see the notifications.

Of course, if they're not logged in then you'd just get an error.

If you want to get their notification count if they're logged into your app but not on the forum, then it gets a little harder, because then you have to associate their NodeBB account with your app and make server-side calls, etc. etc... lmk if the simple solution helps.

Great work!

With SSO for major services, it might actually be much easier to fork sso-github or similar, instead. Reason being there sometimes are npm packages that help you log in to these services.

e.g. https://www.npmjs.com/package/passport-gitlab2

Then you can really just change the require from github to gitlab, and hopefully it would just work.

Almost all of the time it actually won't be that easy, but it sure beats doing it from the sso-oauth base!

@rdomzim

1. Not easily, as /login is hardcoded in a couple places in the codebase. To combat these types of attacks, we introduce a delay when logging in that somewhat matches the bcrypt runtime. You could always edit the codebase to increase the delay some more, but what I'd recommend is setting up spam-be-gone so these requests are curbed before it hits bcrypt.

2. Yes. bcrypt is processor intensive by design (that's what makes it so good as a password hashing algorithm, but I am no expert).

@gotwf said in Plugin idea: emailrep.io:

Which seems to be nodebb's approach in general w.r.t. stuff like this

In general, yes. We try to not muck around with existing installs too much, but plugins are a little more fast and loose with things like this. Will keep it in mind

Definitely makes sense to integrate this as an additional verification vector in the spam-be-gone plugin.

Thoughts @akhoury ?

This topic was created as an entry in the Developer FAQ. Respond below if you have additional information to add re: SSO or other session-sharing implementations.

The common causes for a session mismatch error are usually one of the following:

1. Mis-configured URL parameter in your config.json file

If you have a misconfigured url value in your config.json file, the cookie may be saved incorrectly (or not at all), causing a session mismatch error. Please ensure that the link you are accessing your site with and the url defined match.

2. Improper/malformed cookieDomain set in ACP

Sometimes admins set this value realising that they probably don't need to set it at all. The default is perfectly fine. If this is set, you'll want to revert the setting by editing your database directly:

Redis: hdel config cookieDomain
MongoDB: db.objects.update({ _key: "config" }, { $set: { "cookieDomain": "" } });

3. Missing X-Forwarded-Proto header from nginx/apache

If you are using a reverse proxy, you will need to have nginx pass a header through to NodeBB so it correctly determines the correct cookie secure property.

In nginx, you will need to add the directive like so:

location / {
    ...
    proxy_set_header X-Forwarded-Proto $scheme;
    ...
}

This topic was created as an entry in the Developer FAQ. Respond below if you have additional information to add re: SSO or other session-sharing implementations.

The recommended method of sharing sessions between two separate and distinct applications is through OAuth2. We recommend this approach because NodeBB maintains its own user records, so that we can keep track of user-related metrics and other data. Relying on another database would be tricky, prone to breaking, and quite possibly dangerous.

Luckily, it's quite straightforward to get things working with OAuth2!

The first step is getting your application to expose an OAuth2 endpoint. If you're running a Node.js based app, you can use a module called OAuth2orize.

Once that is set up, you'll want to take a look at the SSO plugin skeleton for customised OAuth deployments -- nodebb-plugin-sso-oauth. You'll take this plugin, fork it, and modify it to communicate with your OAuth endpoint.

Once everything is working properly, you should be able to register and log in/out via your web app.

By default, NodeBB instances should be able to send email out of the box. However, having the server send emails is not ideal, as the server itself does not have any reputation (and in some cases, may have a negative reputation if a spammer sent messages from the IP in the past).

In nearly all cases, you will want to open up an account with a third-party emailer service, who can handle these outgoing messages for you.

Here at NodeBB, we recommend "nodebb-plugin-emailer-sendgrid", which is installable via the admin control panel. SendGrid has a free tier that is fairly generous, so you should not have to pay any upfront or recurring costs.

Once the plugin is installed and activated, you will need to register a new account at SendGrid and create an API key for NodeBB to use.

@y-h said in ERROR invalid-event:

reinstall this plugin

What plugin are you referring to?

Have you tried running ./nodebb build? Please let us know how you installed the plugin (via npm?)

I've heard that Docker is just an abstraction of LXC... but that makes me wonder if it's just easier to use LXC to begin with.

Admittedly, LXC is a little rough, but LXD is the official abstraction that works quite well.

Oof! That's spectacularly bad timing! However, I suppose it's good that we have two dice roller plugins in the wild now?

Well, to be honest, emails come and go, but I don't want to rely on hard bounces as a method of confirming email validity (it's why we have the email confirmation flow).

Mostly, this is because dealing with emails is very complicated, which is admittedly why we prefer to farm out the dirty work to third-party mailers like SendGrid, et al.

As commented therein, a one-click unsub is a great idea. NodeBB actually does support one-click unsub. We send a unique link in the email header that you can POST.

Unfortunately, SendGrid doesn't pass on the requisite headers, and so GMail strips it. That's an ongoing issue. We'll probably just add that link into the footer.

Looks like you need to upgrade your Node.js version.

When you're in vabnal, you need to run ./nodebb setup, not ./vabnal setup

I believe this is fixed in the latest master branch.

If you want them there, then you probably have to modify the template to add the items, since they are not dynamically generated from a list like the items in the user profile menu.

<div class="stat">
	<div class="human-readable-number"  title="{followingCount}">{followingCount}</div>
	<span class="stat-label">[[user:following]]</span>
</div>

Just copy this block and add them below, and the styling should be preserved.

There's no event/audit log for this currently, as the audit log only logs admin level events. It makes sense to log everything, though... so perhaps we can extend the logging system to include user level events...

@PitaJ That's a nice idea... might be a good plugin, though

Actually, there is still an "about me" on this forum (using the Persona theme).

Setting it to 0 length is a good indicator that the admin wants it gone, so perhaps we should just remove it if set to 0.

... that said, it brings up a good discussion of whether we want to add in the ability in the ACP to customise what fields to show