starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-02-09 11:19:38 +03:00
Code Issues 784 Packages Projects Releases 10 Wiki Activity

[Bug Report]: Remember me cookie not working #2510

New Issue
Closed
opened 2026-02-05 04:22:15 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-05 04:22:15 +03:00
Owner
Copy Link

Originally created by @wouterVE on GitHub (Nov 28, 2021).

Describe the Bug

Since a couple of releases ago (don't remember with which version it started) the "Remember me" cookie doesn't seem to work anymore. I have to login at least once every 24hr. Also, sometimes after login I receive an 419 Page expired issue.

This is what I've done so far to debug:

  • Check browser cookies: 3 cookies are present (XSRF-TOKEN, bookstack_session and Remember_standard_, which is responsible for saving the credentials I guess (valid till 2026)
  • made sure app_url in .env includes https before url

More info about my installation:

  • Docker container running on port 6875 (image used of linuxserver.io)
  • Reverse proxy with apache (running on port 443)
  • TLS certificate of Let's encrypt

My apache vhost file:

<IfModule mod_ssl.c>
        <VirtualHost *:443>
                ServerName PUBLIC-URL
                SSLEngine on
                SSLCertificateFile      /etc/letsencrypt/fullchain.pem
                SSLCertificateKeyFile /etc/letsencrypt/privkey.pem

               # enable HTTP/2, if available
               Protocols h2 http/1.1
             
              Header always set Strict-Transport-Security "max-age=63072000"
              Header set X-Content-Type-Options nosniff
              Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
              Header always append X-Frame-Options SAMEORIGIN
              Header set X-XSS-Protection "1; mode=block"

             Header set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' data:; media-src 'self'; script-src  'self'; style-src 'self' 'unsafe-inline';frame-src 'https://embed.diagrams.net' 'https://<PUBLIC-URL>';"

              SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
  SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECD
HE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
             SSLHonorCipherOrder     off
             SSLSessionTickets       off

              proxypass  / http://<PRIVATE IP SERVER>:6875/
              proxypassreverse  / Http://<PRIVATE IP SERVER>:6875/
        </VirtualHost>
 SSLUseStapling On
 SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
</IfModule>

How can I further debug this problem?

FYI I'm using Chrome on android & Opera on Ubuntu

Steps to Reproduce

  1. Surf to my bookstack website URL

Expected Behaviour

See my normal homepage instead of login page (almost) each time

Screenshots or Additional Context

No response

Exact BookStack Version

21.11.0

PHP Version

7.4.25

Hosting Environment

Armbian 21.08.5 (based on Debian 10) - 32 bit
Docker 20.10.11
Apache 2.4.38

Originally created by @wouterVE on GitHub (Nov 28, 2021). ### Describe the Bug Since a couple of releases ago (don't remember with which version it started) the "Remember me" cookie doesn't seem to work anymore. I have to login at least once every 24hr. Also, sometimes after login I receive an `419 Page expired` issue. This is what I've done so far to debug: - Check browser cookies: 3 cookies are present (XSRF-TOKEN, bookstack_session and Remember_standard_<RANDOMSTRING>, which is responsible for saving the credentials I guess (valid till 2026) - made sure `app_url` in `.env ` includes https before url More info about my installation: - Docker container running on port 6875 (image used of[ linuxserver.io](https://hub.docker.com/r/linuxserver/bookstack)) - Reverse proxy with apache (running on port 443) - TLS certificate of Let's encrypt My apache vhost file: ``` <IfModule mod_ssl.c> <VirtualHost *:443> ServerName PUBLIC-URL SSLEngine on SSLCertificateFile /etc/letsencrypt/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/privkey.pem # enable HTTP/2, if available Protocols h2 http/1.1 Header always set Strict-Transport-Security "max-age=63072000" Header set X-Content-Type-Options nosniff Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure Header always append X-Frame-Options SAMEORIGIN Header set X-XSS-Protection "1; mode=block" Header set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' data:; media-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';frame-src 'https://embed.diagrams.net' 'https://<PUBLIC-URL>';" SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECD HE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 SSLHonorCipherOrder off SSLSessionTickets off proxypass / http://<PRIVATE IP SERVER>:6875/ proxypassreverse / Http://<PRIVATE IP SERVER>:6875/ </VirtualHost> SSLUseStapling On SSLStaplingCache "shmcb:logs/ssl_stapling(32768)" </IfModule> ``` How can I further debug this problem? FYI I'm using Chrome on android & Opera on Ubuntu ### Steps to Reproduce 1. Surf to my bookstack website URL ### Expected Behaviour See my normal homepage instead of login page (almost) each time ### Screenshots or Additional Context _No response_ ### Exact BookStack Version 21.11.0 ### PHP Version 7.4.25 ### Hosting Environment Armbian 21.08.5 (based on Debian 10) - 32 bit Docker 20.10.11 Apache 2.4.38
OVERLORD added the 🐛 Bug label 2026-02-05 04:22:15 +03:00
OVERLORD commented 2026-02-05 04:22:21 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Nov 28, 2021):

Hi @wouterVE, It might be worth having a read through #2985. As per that issue, it's something that's been reported by a few people now but I'm having trouble deciphering what in BookStack would cause this.

@ssddanbrown commented on GitHub (Nov 28, 2021): Hi @wouterVE, It might be worth having a read through #2985. As per that issue, it's something that's been reported by a few people now but I'm having trouble deciphering what in BookStack would cause this.
OVERLORD commented 2026-02-05 04:22:23 +03:00
Author
Owner
Copy Link

@wouterVE commented on GitHub (Nov 30, 2021):

hi @ssddanbrown thanks for your link. The described behavior is exactly what I am experiencing. I'll close this issue and continue my input on the other one. Thanks

@wouterVE commented on GitHub (Nov 30, 2021): hi @ssddanbrown thanks for your link. The described behavior is exactly what I am experiencing. I'll close this issue and continue my input on the other one. Thanks
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
No Label 🐛 Bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/BookStack#2510
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?