mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 03:09:39 +03:00
Login attempts redirect to /wiki/domain.tld, 400 error when I check "Remember me" #1476
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @AlphaJack on GitHub (Dec 14, 2019).
The bug
Since yesterday I can't login anymore in BookStack, even if there are three valid accounts under the BookStackDB/users table. I've used the same MySQL credentials of the .env file to manually check the database. When I fail to login, I get redirected to https://domain.tld/wiki/domain.tld (I should stay on the login page).
If I change the APP_URL variable to https://192.168.1.130:8558, the failed login attempt stays to the login page and displays the red error "These credentials do not match our records."
It was all working correctly until yesterday, what can I do?
Is there a way to disable the email confirmation without logging in? What should I change to not get redirected to /wiki/domain.tld?
I logged out of my account because I deleted the cookie that were returning error 400 in BookStack.
Steps To Reproduce
Steps to reproduce the behavior:
Configuration
git pull origin releaseAdditional data
Bookstack .env settings (I did
mariadb -u un -p dband entered the password to check the users table):Nginx settings for the external server
Nginx settings for the internal server
Bookstack access logs:
Nginx access logs:
@ssddanbrown commented on GitHub (Dec 15, 2019):
Hi @AlphaJack,
Sorry to hear you are having issues.
Just to confirm, what authentication method or you using? What is the label for the top input on the login screen? is it username or email?
There is the following command available which might help:
You can use this to create a new admin user to login as, to ensure you're using correct credentials to login to BookStack, since you cannot be sure of user credentials by looking at the database directly due to hashed passwords.
@AlphaJack commented on GitHub (Dec 15, 2019):
Thank you, creating another admin allowed me to revert the email requirement and reset our passwords.
However, why does it redirects failed login attempts to that specific url, instead of staying in the login page?
Is there any log I can read? It would also useful to debug my other issue, #1813
EDIT: BookStack is giving me a 400 error because it creates a cookie like
If I delete the cookie, It won't load the stylesheets, and when I click on them manually it returns another 400 error
@ssddanbrown commented on GitHub (Dec 16, 2019):
I'm not sure, Things get complicated when proxied with a few re-writes like this. I'm guessing one of the rewrites or proxy since you say that doesn't occur when accessing the IP directly without the sub-path?
Probably not on the BookStack side since no error is actually being thrown.
For that one, are you using your sendgrid username of a username of
apikey?Is BookStack explicitly stating the error is from that cookie value? When does this cookie issue occur?
@AlphaJack commented on GitHub (Dec 16, 2019):
Ok, but is there a log that I can use to prevent bruteforcing access?
Username/password, but I've just tried using an api key and if I try
APP_DEBUG=false,and a page with
BookStack/vendor/egulias/email-validator/EmailValidator/Parser/Parser.phpif I set
APP_DEBUG=true.The same error appears using username/password as well
No, the error comes from Nginx. It's strange because I have explicitly told Nginx to use a custom html page for error 400. 404 errors are instead handled by BookStack. Another fun fact is that using Tor browser I don't get any 400 error.
EDIT: There was probably another cookie that caused the error, I'll report it here if I get the error again
EDIT2: The problem seems to be
remember_web_XXXXXX, that appears when someone checks the "Remember Me" option in the login page@ssddanbrown commented on GitHub (Dec 18, 2019):
After playing around for a while I managed to replicate the same error. It seems this can be thrown when running the latest release on php7.4, Looks like one of the dependencies may not support
php7.4properly. I've tested by jumping between php7.3 and php7.4 on the same setup.Could this be the thing that's changed, since you said things were working until a particular day? Did your version of PHP update recently?
To get around that particular error, You could either downgrade PHP to 7.3 until the next release or running
composer updatein your BookStack install directory should get more recent, php7.4 compatible versions.@AlphaJack commented on GitHub (Dec 19, 2019):
composer updatehogs all the available RAM and tries to eat as much SWAP as it can, it makes the website unaccessible and forces the SSH connection to close because there is no memory left. Is there anything else I can do? Downgrading unfortunately is not an option with Arch ARM@ssddanbrown commented on GitHub (Dec 20, 2019):
You could
composer updateon an external machine then rsync the/vendordirectory across?@alexjustesen commented on GitHub (Dec 22, 2019):
@AlphaJack when running composer it uses the ram allocations set in your php .ini file, depending how high you have your memory_limit var and your available server memory you might want to lower that limit.
If that doesn't work try limiting composer using the following command:
COMPOSER_MEMORY_LIMIT=256M php composer.phar updateI've got 256MB and seems more than enough for bookstack and composer (my server has 1G available).
Edit: included composer memory command.
@AlphaJack commented on GitHub (Jan 20, 2020):
@ssddanbrown Thank you, I've fixed #1813 with
composer installandcomposer updatein my computer, and rsyncing the whole BookStack folder to the server and importing the "uploads" directories from the backup folder.I'll write again if the 400 error appears again.
A failed login attempt still redirects to /wiki/domain.tld, but it's a minor issue now.
@AlphaJack commented on GitHub (May 31, 2020):
@ssddanbrown I've updated BookStack to the latest version (0.29.3), but I'm still getting the 400 error if I check the "Remember me" box on login. The cookie is 393 characters long.
Also, even correct login attempts from /wiki/login redirects to /wiki/domain.tld. The same thing happens when toggling the light or dark mode.
@AlphaJack commented on GitHub (Aug 6, 2020):
I've fixed 400 error by increasing these NginX settings:
Source
A workaround for login redirects is adding this 301 redirect