CSFR foutmelding na inloggen

[wilco-22]

Hallo,

Ik heb OpenKat geïnstalleerd op Ubuntu 20.04. Nadat ik ben ingelogd op het aangemaakte account krijg ik direct een foutmelding: "Verboden (403), CSFR verificatie gefaald". Aan het einde van de installatie kreeg ik ook een foutmelding van sqlalchemy. Misschien heeft dit ermee te maken. Alle containers zijn verder zonder foutmeldingen gestart. Hieronder de error code van sqlalchemy:

`Creating nl-kat-coordination_katalogus_run ... done
Traceback (most recent call last):
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/base.py", line 3256, in _wrap_pool_connect
return fn()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 310, in connect
return _ConnectionFairy._checkout(self)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 868, in _checkout
fairy = _ConnectionRecord.checkout(pool)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 476, in checkout
rec = pool._do_get()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/impl.py", line 256, in _do_get
return self._create_connection()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 256, in _create_connection
return _ConnectionRecord(self)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 371, in init
self.__connect()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 666, in connect
pool.logger.debug("Error on connect(): %s", e)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/util/langhelpers.py", line 70, in exit
compat.raise(
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/util/compat.py", line 207, in raise
raise exception
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 661, in __connect
self.dbapi_connection = connection = pool._invoke_creator(self)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/create.py", line 590, in connect
return dialect.connect(*cargs, **cparams)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/default.py", line 597, in connect
return self.dbapi.connect(*cargs, **cparams)
File "/usr/local/lib/python3.8/site-packages/psycopg2/init.py", line 122, in connect
conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
psycopg2.OperationalError: connection to server at "katalogus-db" (172.25.0.2), port 5432 failed: FATAL: password authentication failed for user "katalogus_app"

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/usr/local/lib/python3.8/runpy.py", line 194, in _run_module_as_main
return _run_code(code, main_globals, None,
File "/usr/local/lib/python3.8/runpy.py", line 87, in _run_code
exec(code, run_globals)
File "/usr/local/lib/python3.8/site-packages/alembic/main.py", line 4, in
main(prog="alembic")
File "/usr/local/lib/python3.8/site-packages/alembic/config.py", line 588, in main
CommandLine(prog=prog).main(argv=argv)
File "/usr/local/lib/python3.8/site-packages/alembic/config.py", line 582, in main
self.run_cmd(cfg, options)
File "/usr/local/lib/python3.8/site-packages/alembic/config.py", line 559, in run_cmd
fn(
File "/usr/local/lib/python3.8/site-packages/alembic/command.py", line 320, in upgrade
script.run_env()
File "/usr/local/lib/python3.8/site-packages/alembic/script/base.py", line 563, in run_env
util.load_python_file(self.dir, "env.py")
File "/usr/local/lib/python3.8/site-packages/alembic/util/pyfiles.py", line 92, in load_python_file
module = load_module_py(module_id, path)
File "/usr/local/lib/python3.8/site-packages/alembic/util/pyfiles.py", line 108, in load_module_py
spec.loader.exec_module(module) # type: ignore
File "", line 843, in exec_module
File "", line 219, in _call_with_frames_removed
File "./migrations/env.py", line 80, in
run_migrations_online()
File "./migrations/env.py", line 70, in run_migrations_online
with connectable.connect() as connection:
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/base.py", line 3210, in connect
return self._connection_cls(self, close_with_result=close_with_result)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/base.py", line 96, in init
else engine.raw_connection()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/base.py", line 3289, in raw_connection
return self._wrap_pool_connect(self.pool.connect, _connection)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/base.py", line 3259, in _wrap_pool_connect
Connection.handle_dbapi_exception_noconnection(
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/base.py", line 2106, in handle_dbapi_exception_noconnection
util.raise(
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/util/compat.py", line 207, in raise
raise exception
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/base.py", line 3256, in _wrap_pool_connect
return fn()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 310, in connect
return _ConnectionFairy._checkout(self)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 868, in _checkout
fairy = _ConnectionRecord.checkout(pool)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 476, in checkout
rec = pool._do_get()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/impl.py", line 256, in _do_get
return self._create_connection()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 256, in _create_connection
return _ConnectionRecord(self)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 371, in init
self.__connect()
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 666, in connect
pool.logger.debug("Error on connect(): %s", e)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/util/langhelpers.py", line 70, in exit
compat.raise(
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/util/compat.py", line 207, in raise
raise exception
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/pool/base.py", line 661, in __connect
self.dbapi_connection = connection = pool._invoke_creator(self)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/create.py", line 590, in connect
return dialect.connect(*cargs, **cparams)
File "/usr/local/lib/python3.8/site-packages/sqlalchemy/engine/default.py", line 597, in connect
return self.dbapi.connect(*cargs, **cparams)
File "/usr/local/lib/python3.8/site-packages/psycopg2/init.py", line 122, in connect
conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) connection to server at "katalogus-db" (172.25.0.2), port 5432 failed: FATAL: password authentication failed for user "katalogus_app"

(Background on this error at: https://sqlalche.me/e/14/e3q8)
ERROR: 1
make[2]: *** [Makefile:56: migrate] Error 1
`

[Mergpijp]

Hey, ik heb dit ook django lijkt geen cookies te hebben. Maar op localhost werkt het wel en niet op mijn interne ip. Erg vreemd.

[Mergpijp]

De settings.py verandert niet als je make kat of make update of dergelijks doet. probeer nu make debian. Vraag me af hoe de ontwikkelaars van openkat makkelijk kunnen ontwikkelen zo?

[underdarknl]

De reden dat het niet werkt op een lokaal ip, maar wel op de hostname 'localhost' (en ook dan soms niet) is omdat wij de cookies met de 'secure' flag aan zetten. Omdat je op localhost geen https aan kan bieden wegens het ontbreken van een certificaat is dat dus een secure cookie op een unscure website. Moderne browsers hebben daar een uitzondering voor sinds ongeveer een jaar terug, maar dat gaat helaas nog wel eens mis.
De secure flag uit zetten vinden we aan de andere kant ook weer geen goede oplossing omdat we dan een by default minder secure setting meeleveren die je maar net weer zelf moet aanzetten op productie-omgevingen.

[SamvWinsen]

Ik had dit "probleem" ook.
Je kan er een nginx ingress voorzetten die je SSL ofload. Die je daarna redirect naar de openkat. Waardoor wel de coockie in je webbrowser gezet word.
Dan kan je openKat draaien op een server die docker draait.

[underdarknl]

@SamvWinsen dat werkt inderdaad ook, en is de verwachte omgeving waarin we OpenKAT in productie denken te zien. Vandaar dat we de secure session en secure csrf flag ook niet willen uitzetten. Secure by default.
http://localhost met een moderne browser (sinds being 2022) werkt ook zonder ingress/https proxy er voor.