For anyone else that may find this post and is struggling, this step by step walkthrough really helped me out (at least regarding the php oauth2 server) http://bshaffer.github.io/oauth2-server-php-docs/cookbook/

@raven Right now the only supported way to do what you want is to create an Oauth service and authenticate against it using the plugin @psychobunny linked. It's far from ideal but it seems to be the only way unless you want to start hacking into the internals of nodebb or create another plugin from scratch.

Yes, It sucks. I wish I would have known this before I started down the path of using nodebb

Is there any way to access the read-only built-in api from an external site with programmatic authentication?

My forum is private so everything is restricted to logged in users only. This means If i want to integrate a "recent posts" display widget on my main site it wont work because the API call to mysite.com/api/recent will fail due to lack of a login cookie. I know with the write-api you can generate tokens and api keys but that api doesn't include any read-only endpoints (which i think is a huge oversight btw, at the very least it should allow you authenticated api access to endpoints that are traditionally locked down, like /api/user/:userid:). Is there any way to achieve this without making huge modifications to the write-api plugin?

So everything was working great but due to the nature of my site and it's users, SSL is required, especially since I'll be using SSO exclusively for login. Once I enabled SSL I started receiving both 400 and 522 errors on a certain amount of the socket.io polls. I'm not certain what the percentage is of failed polling attempts but it's not 100% because the site still works and some data still makes it through.

Here's a screenshot of the errors in my safari console (yes, it happens in chrome and firefox too)

And here's my nginx vhost config

server {
    listen 80;

    server_name forum.nzb.cat;

    return 301    https://forum.nzb.cat$request_uri;

}
server {
    listen 443 ssl;

    server_name forum.nzb.cat;

    ssl_certificate /etc/nginx/ssl/forum.nzb.cat.crt;
    ssl_certificate_key /etc/nginx/ssl/nzbcat.key;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://127.0.0.1:4567/;
        proxy_redirect off;

        # Socket.IO Support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

And here's the error in the nginx error.log. I googled and googled and did everything the stack overflow people suggested to no avail:

2015/04/12 10:39:03 [error] 17037#0: *146836 upstream prematurely closed connection while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: forum.nzb.cat, request: "GET /socket.io/?EIO=3&transport=polling&t=1428849532722-383&sid=ECw2nTDnOQgEjGcdAAKp HTTP/1.1", upstream: "http://127.0.0.1:4567/socket.io/?EIO=3&transport=polling&t=1428849532722-383&sid=ECw2nTDnOQgEjGcdAAKp", host: "forum.nzb.cat", referrer: "https://forum.nzb.cat/"

I'm at my wit's end here so any help would be appreciated. I didn't bother commenting out any of the URL's as it's a public site.

@julian Thank you so much for your help. I finally got it working. I had to ditch the intermediary auth server and integrate oauth2-server-php directly into my application so I could associate the currently logged in user with the authentication dance.

Thanks again for your help, I was really confused.

@julian said:

It's cloudflare. Keep using it, but disable acceleration. Websocket issues will be fixed.

I did what you suggested and it seems to have fixed the issue in chrome. However in safari it still happens. I'm gonna wait a while and see if maybe safari just has something weird cached (even though i cleared browser and dns cache).

@psychobunny I've always wanted to make a browser based rpg but never had the wherewithal to create something useable, I think this way I can scratch my itch without having to create all the underlying plumbing haha.

Also, I'm in the nodebb IRC on freenode if you ever want to come by and chat about it.

Best of luck to you @RichG. I did quite a bit of windows admin with IIS back in the day but I couldn't explain to you now how to do it without being on your system.

If you still can't get IIS to play nice, may I suggest giving WAMP a try? It's basically the most popular linux web server: Apache, on windows. It will allow you to stick with windows but also use the suggestions and instructions from the nodebb documentation to get your proxy pass setup correctly. Additionally, configuring wordpress to use Apache instead of IIS is trivial.

If you decide to go this route I can walk you through setting up apache and the vhosts required, just start a chat with me here.

@Schamper Haha yep. I may be the KingCat but even I need support sometimes

@Codejet Yea, I saw your post and almost replied but I thought since @psychobunny said it might be a bug it's worthy of it's own thread.

Multiple group tags and group tag weighting would be nice but right now I'm just trying to get everything that "should" work working so I can open the forum to the users.

Nevermind. I found it. You have to visit a feed to find it and it only works with topic or category feeds, not the "recent" feed. I can work with this tho. Thanks @PitaJ

@pitaj Thanks for that link. Looks like exactly what I was looking for. I can't seem to find the users RSS tokens though? They aren't in their account info or anywhere else

bump

Has there been any progress on this? If @psychobunny or @julianlam has any insights on how this might be achieved, I'd be open to writing my own plugin or better yet, integrating the authentication of the existing write-api plugin into RSS feeds so we could pass a user token in the get request for the rss feed.

Nevermind I fixed it with the session-sharing plugin. I set it to revalidate instead of trust.

@julian Unfortunately I ended up nuking the repostory and rechecking it out mulitple times trying to fix it.

In the future I know I can't trust the database entirely. I'll have to backup all the files (that I thought were ephemeral).

For some reason my login sessions seem to be messed up somehow. I stay logged into nodebb without issue but when i click the admin link, it redirects me to the login page. If i login again and try to go to admin, i get redirected to login, over and over no matter what i do. If i logout of the forum and then log back in I can access the admin section again for a little while but at some unspecified time in the future that session or cookie seems to expire and im back to only being a normal user.

To be clear, I can still access my account details and I can post on the forum as myself and everything else acts like im logged in, I just can't access the admin panel.

Sorry for the necropost but I'm just now getting back into this. I was so upset I had to take some time to cool off. I was upgrading from 1.1.x to 1.5.1 and I guess that was what the issue was. If i could just go back to the old way it was and forgo upgrading I would. I did backup the database but not the node_modules so I have no idea what was installed and what version.

Is there any way to tell what version of nodebb was installed by looking in the database somewhere? It's a redis DB btw if that matters. I opened the dump file on my workstation and poked around looking for some info but the current nodebb version didn't seem to be included anywhere.

I know I should probably cool off before posting but I am getting really fed up with this project. Every single time I do an upgrade I end up having to wipe everything and start over. Thankfully I get to keep my redis database and the user posts and stuff but half the damn plugins dont work anymore, the templates are broken, things are randomly missing settings... Like why should I even bother. Once I get it working I'm never EVER upgrading again. I'd switch to a different platform if it wasn't too late

To add some specific complaints instead of just ranting:

• Why is there no way to roll back once you upgrade?
• Why is there no way to record what version of plugins you have installed besides copying the entire node_modules directory (that is ignored from source control btw)?
• Why do half the plugins and all my templates break when I upgrade? And to be clear I don't mean half the plugins are disabled because they are incompatible, oh no, i would be fine with that, instead they are enabled and upgraded but just don't work, or they lose their settings, or worst of all they break the rest of the application so I only get half a page to load in the browser or something.
• Why do I get copious javascript errors in the console when I try to view the new version? Clearing cache isn't enough, I have to manually purge the files from the public directory and re-generate them..

This all seems very shoddy. The cynic in me thinks this is an effort to drive people toward the paid version of nodebb but I refuse to believe that. I've interacted with some of the main devs here on the forums and they always seemed very helpful and open. But this application is an absolute minefield to maintain. At this point I need to make a full backup of the entire directory in addition to the database to be safe while upgrading (which is not the recommended process, they recommend you use the nodebb git repo, check out a new tag and run the ./nodebb upgrade script). I'm going to have to treat nodebb like it's nitroglycerin from now on.

If I'm doing something wrong or there's a new accepted way please enlighten me but for now I'm going to return to smashing my face into my keyboard while I figure out a way to recover this disaster.

@pichalite That does work as well but it's not obvious for users not familiar with markdown. They will just paste the code in raw. Having a recognizable code button would help usage.

There used to be a code button plugin. According to google the only one that exists still is a fork of an old plugin that's only supported on 0.7.0. Does no one have a need for a code button? I guess no one posts code syntax on their forums. I need one bigtime. I guess i'll have to create one from scratch.

(I know you can just add 4 spaces before the line to create a code block but adding scripts > 10 lines or so makes this painful)