Thanks! I hope that for SSO logging the old logic will be preserved.

Is this a security gap or do I not understand the logic behind the registration?

1. In the permissions options panel, I have local login disabled, for "unverfied-users"
2. I create a new user, it automatically logs me into the site and I get a verification link.
3. I can add posts even though I don't have permissions, because it logged me in after registrations.
4. I log out
5. Trying to log in again results in "Error verification requierd".

After a few tweaks, everything works.
The config from docs didn't work properly and is probably a bit outdated, (tls version, spdy...).

First:
CloudFlare SSL: Flexible to Full

Second:
New nginx setup:

server {
    listen 80;

    server_name forum.example.com;

    return 302 https://$host$request_uri;
}

server {
    listen 443 ssl http2;

    server_name forum.example.com;

    ssl_certificate /home/ubuntu/nodebb/ssl/forum.crt;
    ssl_certificate_key /home/ubuntu/nodebb/ssl/forum.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

    ssl_ciphers 'AES128+EECDH:AES128+EDH';
    ssl_prefer_server_ciphers on;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://127.0.0.1:4567;  # no trailing slash
        proxy_redirect off;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

I have SSL from the Cloudflare proxy - do I still need SSL on the Nginx?

I have https which is a certificate from Cloudflare.

My Nginx server has the configurations from the documentation.
When I have enabled: “url: “http://forum.example.com” - login works.

When I set in config.json
“url: “https://forum.example.com” - error

Error message:

Login failed.
Login failed, probably due to session expiration. Try again.

In the URL, there is an error: "https://forum.example.com/login?error=csrf-invalid"

It needs https because, without it, the Google SSO plugin doesn't work for me

my nginx:

server {
         listen 80;
         server_name example.com;
         return 301 https://forum.example.com;
}


server {
    listen 80;

    server_name forum.example.com www.forum.example.com;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://127.0.0.1:4567;
        proxy_redirect off;

        client_max_body_size 10M;

        # Socket.IO Support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

My recommendation is compressorjs - https://github.com/fengyuanchen/compressorjs

The compression happens on the client side and we only upload the resized file. This approach saves space and reduces file upload time which is especially important on mobile.

@baris How should I find it in the admin panel or in the source code on the server?

Edit:
Ok I found the problem! grep -r ";cc0 1.0 universal" - there was problem with depreacted plugin nodebb-plugin-html5videoplayer - I removed this and know everythong works fine!

Thanks a lot for your quick help! This is my first time using NodeBB.

Hello! I have one error, and the build is successfully

2024-12-02T14:00:40.772Z [4567/43946] - info: [build] admin control panel styles  build completed in 5.442sec
2024-12-02T14:00:40.773Z [4567/43946] - info: [build]                  templates  build started
2024-12-02T14:00:42.294Z [4567/43946] - info: [build]                  templates  build completed in 1.521sec
2024-12-02T14:00:42.296Z [4567/43946] - info: [build]                  languages  build started
2024-12-02T14:00:47.214Z [4567/43946] - info: [build]                  languages  build completed in 4.918sec
2024-12-02T14:00:47.216Z [4567/43946] - info: [build] Bundling with Webpack.
315 assets
788 modules

ERROR in ./build/public/scripts-client.js 1960:5
Module parse failed: Unexpected token (1960:5)
You may need an appropriate loader to handle this file type, currently no loaders are configured to process this file. See https://webpack.js.org/concepts#loaders
| });
|
> ;CC0 1.0 Universal
|
| Statement of Purpose

webpack 5.94.0 compiled with 1 error in 19554 ms
2024-12-02T14:01:07.713Z [4567/43946] - info: [build] Asset compilation successful. Completed in 41.304sec.

I have VPS, and other plugins works fine, I have only problem with this. Save button dosen't work in plugin settigns.
/admin/plugins/link-preview

When I click "Save changes"/"Zapisz zmiany" - nothing happen, and after refresh page changes on checkboxes are gone.

I have a problem with uploading images, because in order for people to upload images from their phones, usually they can weigh 2-3MB - cropping images works by itself,
but the problem is that after upload image there are two left on the server, the original one and the cropped one, which leads to quickly running out of space on the server.

How to disable the option to keep the original images after upload?

I installed the plugin via dashboard plugins.

NodeBB v3.10.3

I did a rebuild, the plugin appears, but saving settings does not work.
In addition, I have this error in the console: “admin.min.js?v=o50k63atqko:1 error loading admin/plugins/link-preview
Error: Cannot find module './plugins/link-preview'”

What did I do wrong?