Can't login, reset password or create new account due to 403 Forbidden error

installation
1

Hi everyone!

I got a big problem on my discourse. Since a few days, nobody can login anymore, neither in authentication by email nor by social login (Facebook, Google, Twitter …)
That’s very strange cause everything was working since 1 year with no problems. Everything broked overnight for no reason.

This is what happend for differents case (sorry it’s french …):

  • For the email connection:

Capture du 2017-01-07 12-40-07.png715×390 20 KB

Just the message " Unknown error"

  • For the social login auth:

Capture du 2017-01-07 12-40-37.png830×164 12.7 KB

The message says: “Sorry, there was an error authorizing your account. Perhaps you did not approve authorization?”

  • When I try to reset the password:

Capture du 2017-01-07 12-39-44.png718×270 13.9 KB

“403 Forbidden”

  • And when I want to create a new account:

Capture du 2017-01-07 12-37-39.png1126×160 12.5 KB

“We can not detect if your account has been created, please verify that you have enabled cookies.”
Of course, the cookies are enabled.

Any ideas ?

2

Please provide some info:

  • Forum URL
  • Are you using HTTPS?
  • Do you use a reverse proxy outside docker?
2 Likes
3

The URL is https://colibris41.citiz-network.org and use https.

I use a nginx in reverse proxy in an independant LXC container, cause it’s a virtualization server. The forum is in a KVM and I use another KVM and LXC for another forum and website.

4

Paste the location config of the reverse proxy with the header your are setting.

5

This is the config enabled for my nginx…

server {
        listen  80;
        server_name     colibris41.citiz-network.org;
        listen 443 ssl;
        listen [::]:443 ssl;

        ssl_certificate /etc/letsencrypt/live/colibris41.citiz-network.org/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/colibris41.citiz-network.org/privkey.pem;

        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES12$
        ssl_prefer_server_ciphers on;

        add_header Strict-Transport-Security max-age=15768000;

        ssl_stapling on;
        ssl_stapling_verify on;

        ssl_trusted_certificate /etc/letsencrypt/live/colibris41.citiz-network.org/chain.pem;
        resolver 8.8.8.8 8.8.4.4 valid=86400;
        resolver_timeout 10;

        client_max_body_size 10M;

        location / {
                proxy_pass      http://10.0.2.110/;
                #proxy_pass      http://10.0.2.114/; #Redirection maintenance
       }
}

But I don’t why the problem could be there. That works fine for one year…

6

You have a broken reverse proxy config:

Adding a reverse proxy increase the maintenance burden, so should be done only when necessary, and will occasionally break.

A simpler approach, with less maintenance, is using Caddy as a reverse proxy server.

Discourse is using secure cookies now, and they are more sensitive to a broken proxy.

6 Likes
7

Ok I just added this in my proxy.conf:

  proxy_set_header        X-Forwarded-Proto https;

Everything seems to work great now! I never thought the problem would come from there. Thank’s a lot!

4 Likes
8

Bonjour,

I just installed Discourse version Bitnami v2.2.2 with auto-install on GCP (Google Cloud Platform).
After setting up https, I encounter the 403 issue.
I tried your solution, aka adding a line (proxy_set_header X-Forwarded-Proto https;) in proxy.conf
1/ I had a very hard time to find the file
2/ Found proxy-html.conf in /opt/bitnami/apache2/conf/extra
3/ added the line there, restarted apache and it did not work

I’m not sure it’s the right file
I’m not sure it is used
I’m not sure if that line is enough

Please, help!

9

Bonjour François,

I’m sorry but we don’t support Bitnami installs. You will have to ask their support.

1 Like
10

Salut @zogstrip

I get you. I did as requested a post to Bitnami support => 403 Forbidden on Logins - Discourse - Bitnami Community
I was given instructions very similar to those in this thread, but the same way, they both don’t work. I am stuck for tow days.
I am more and more willing to reset everything down. I chose the Bitnami solution on GCP because I never used VMs and I wanted to cut some hassle as I set this forum alone and am more of a front-end specialist.

So, do you think it is worth I start over with a non-Bitnami version you would support?
And if so, is it compatible with GCP? Are there step by step instructions to set it up?
I’m not very familiar with the CL but I can deal with it as I do for 30 years :slight_smile:

I would really like to use Discourse to replace LUDGEF, my 75K members G+ community, but I am not paid for that and would really appreciate some help.

Have a nice day.

2 Likes
11

We definitely recommend following our official install guide.

2 Likes