שגיאה בעת יצירת סיסמת משתמש בדפדפן

whitewaterdeu · 13 באוגוסט,‏ 2025,‏ 1:52pm

when i try to create passkey in my own site, it reminds

The passkey registration process either timed out, was cancelled or is not allowed

but i can create passkey in discourse meta forum in same browser(mirosoft edge) and same plugin( apple passkey)

i have upgraded my discourse to latest, but it doesn’t work like this post

nat · 14 באוגוסט,‏ 2025,‏ 3:33am

Hey, it looks like we do show a console error when this message you share shows up in a dialog.

Could you open your browser console and share with us the error you might see?

whitewaterdeu · 14 באוגוסט,‏ 2025,‏ 5:29am

it seems like there is nothing about this error in logs

nat · 14 באוגוסט,‏ 2025,‏ 5:48am

You’ll need to see your browser console log, not site /logs.

whitewaterdeu · 14 באוגוסט,‏ 2025,‏ 11:48am

is this right?

forum.beginner.center/:1  Mixed Content: The page at 'https://forum.beginner.center/' was loaded over HTTPS, but requested an insecure font 'http://forum.beginner.center/fonts/JetBrainsMono-Regular.woff2?v=0.0.19'. This request has been blocked; the content must be served over HTTPS.
forum.beginner.center/:1  Mixed Content: The page at 'https://forum.beginner.center/' was loaded over HTTPS, but requested an insecure font 'http://forum.beginner.center/fonts/JetBrainsMono-Bold.woff2?v=0.0.19'. This request has been blocked; the content must be served over HTTPS.
app.js:270 ℹ️ Discourse v3.5.0.beta9-dev — https://github.com/discourse/discourse/commits/33dfd7dba9 — Ember v5.12.0
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-4YvvTZffYuqGaENC8DnQ7yeNg' 'strict-dynamic'".

analytics.eu.umami.is/script.js:1   Failed to load resource: net::ERR_CONNECTION_CLOSED
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
Tracking Prevention blocked access to storage for <URL>.
deprecated.js:62  Deprecation notice: Setting timezone property of user object is deprecated. Use user_option object instead [deprecated since Discourse 2.9.0.beta12] [removal in Discourse 3.0.0.beta1] [deprecation id: discourse.user.userOptions]
a @ deprecated.js:62
security:1 Autofocus processing was blocked because a document already has a focused element.
completion_list.html:14   GET chrome-extension://mfbcdcnpokpoajjciilocoachedjkima/heuristicsRedefinitions.js net::ERR_FILE_NOT_FOUND
completion_list.html:13   GET chrome-extension://mfbcdcnpokpoajjciilocoachedjkima/extensionState.js net::ERR_FILE_NOT_FOUND
completion_list.html:12   GET chrome-extension://mfbcdcnpokpoajjciilocoachedjkima/utils.js net::ERR_FILE_NOT_FOUND
ajax.js:188   POST https://forum.beginner.center/u/register_passkey.json 401 (Unauthorized)
send @ jquery.js:9940
ajax @ jquery.js:9521
o @ ajax.js:188
(匿名) @ rsvp-DaQAFb0W.js:435
e @ rsvp-DaQAFb0W.js:451
A @ ajax.js:201
registerPasskey @ user.js:650
createPasskey @ user-passkeys.gjs:86
await in createPasskey
didConfirm @ user-passkeys.gjs:140
didConfirmWrapped @ dialog.js:134
_join @ index.js:788
join @ index.js:605
p @ index.js:152
(匿名) @ index.js:250
submit @ confirm-session.gjs:84
await in submit
(匿名) @ d-button.gjs:138
invoke @ index.js:264
flush @ index.js:180
flush @ index.js:334
_end @ index.js:762
end @ index.js:565
_runExpiredTimers @ index.js:869
setTimeout
setTimeout @ index.js:39
_installTimerTimeout @ index.js:912
_later @ index.js:823
later @ index.js:652
T @ index.js:562
_triggerAction @ d-button.gjs:135
click @ d-button.gjs:93
user-passkeys.gjs:104  {jqXHR: {…}, textStatus: 'error', errorThrown: ''}errorThrown: ""jqXHR: abort: ƒ (e)always: ƒ ()catch: ƒ (e)done: ƒ ()fail: ƒ ()getAllResponseHeaders: ƒ ()getResponseHeader: ƒ (e)jqTextStatus: "error"overrideMimeType: ƒ (e)pipe: ƒ ()progress: ƒ ()promise: ƒ (e)readyState: 4requestedUrl: "/u/register_passkey.json"responseJSON: {errors: Array(1)}responseText: "{\"errors\":[\"The origin of the authentication request does not match the server origin.\"]}"setRequestHeader: ƒ (e,t)state: ƒ ()status: 401statusCode: ƒ (e)statusText: "error"then: ƒ (e,i,n)[[Prototype]]: ObjecttextStatus: "error"[[Prototype]]: Objectconstructor: ƒ Object()hasOwnProperty: ƒ hasOwnProperty()isPrototypeOf: ƒ isPrototypeOf()propertyIsEnumerable: ƒ propertyIsEnumerable()toLocaleString: ƒ toLocaleString()toString: ƒ toString()valueOf: ƒ valueOf()__defineGetter__: ƒ __defineGetter__()__defineSetter__: ƒ __defineSetter__()__lookupGetter__: ƒ __lookupGetter__()__lookupSetter__: ƒ __lookupSetter__()__proto__: (...)get __proto__: ƒ __proto__()set __proto__: ƒ __proto__()
createPasskey @ user-passkeys.gjs:104
await in createPasskey
didConfirm @ user-passkeys.gjs:140
didConfirmWrapped @ dialog.js:134
_join @ index.js:788
join @ index.js:605
p @ index.js:152
(匿名) @ index.js:250
submit @ confirm-session.gjs:84
await in submit
(匿名) @ d-button.gjs:138
invoke @ index.js:264
flush @ index.js:180
flush @ index.js:334
_end @ index.js:762
end @ index.js:565
_runExpiredTimers @ index.js:869
setTimeout
setTimeout @ index.js:39
_installTimerTimeout @ index.js:912
_later @ index.js:823
later @ index.js:652
T @ index.js:562
_triggerAction @ d-button.gjs:135
click @ d-button.gjs:93

nat · 14 באוגוסט,‏ 2025,‏ 1:57pm

Oh hmm this is useful but 401s can be triggered by a myriad of reasons. Will check with our resident passkeys expert.

pmusaraj · 14 באוגוסט,‏ 2025,‏ 2:03pm

האם תוכל לוודא שהאתר שלך מוגדר להגיש הכל ב-https? אימות אתגר מפתח סיסמה דורש שכל הבקשות יעברו דרך https. כמו כן, הדומיין בין הדפדפן לשרת חייב להתאים בדיוק. אם יש אי-התאמה כלשהי, האימות ייכשל.

יש לנו הגדרה לכך, force_https, אתה יכול לנסות אותה, זה עשוי לעזור (אם כי היזהר, זה עלול גם לנעול אותך אם השרת אינו מוגדר כראוי).

whitewaterdeu · 15 באוגוסט,‏ 2025,‏ 2:33am

this is my app.yml
i am using reverse proxy by OpenResty (based on nginx)

expose:
  - "6180:80"   # http
  - "6443:443" # https
  - "587:587"

i can’t use my site by https port 6443

so i only set reverse proxy of http

this is my OpenResty config

server {
    listen 80 ; 
    listen 443 ssl http2 ; 
    server_name forum.beginner.center; 
    index index.php index.html index.htm default.php default.htm default.html; 
    proxy_set_header Host $host; 
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
    proxy_set_header X-Forwarded-Host $server_name; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_http_version 1.1; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    access_log /www/sites/forum.beginner.center/log/access.log main; 
    error_log /www/sites/forum.beginner.center/log/error.log; 
    location ^~ /.well-known/acme-challenge {
        allow all; 
        root /usr/share/nginx/html; 
    }
    if ($scheme = http) {
        return 301 https://$host$request_uri; 
    }
    ssl_certificate /www/sites/forum.beginner.center/ssl/fullchain.pem; 
    ssl_certificate_key /www/sites/forum.beginner.center/ssl/privkey.pem; 
    ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1; 
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!SRP:!CAMELLIA:!SEED; 
    ssl_prefer_server_ciphers on; 
    ssl_session_cache shared:SSL:10m; 
    ssl_session_timeout 10m; 
    error_page 497 https://$host$request_uri; 
    proxy_set_header X-Forwarded-Proto https; 
    add_header Strict-Transport-Security "max-age=31536000"; 
    include /www/sites/forum.beginner.center/proxy/*.conf; 
}

this is reverse proxy config

location ^~ / {
    proxy_pass http://127.0.0.1:6180; 
    proxy_set_header Host $host; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
    proxy_set_header REMOTE-HOST $remote_addr; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    proxy_set_header X-Forwarded-Proto $scheme; 
    proxy_http_version 1.1; 
    add_header X-Cache $upstream_cache_status; 
    add_header Cache-Control no-cache; 
    proxy_ssl_server_name off; 
    proxy_ssl_name $proxy_host; 
    add_header Strict-Transport-Security "max-age=31536000"; 
}

whitewaterdeu · 17 באוגוסט,‏ 2025,‏ 1:04pm

שלום, מישהו יכול לעזור לי?

pmusaraj · 18 באוגוסט,‏ 2025,‏ 8:35pm

מצטער על העיכוב. הבעיה כאן אכן קשורה לפרוקסי שלך. אני לא יכול לומר בדיוק מהי, אבל אחד משמות הדומיין, הפרוטוקול (http או https) והפורט נכנסים לדרך.

Passkeys מאמתים שה-frontend וה-backend פועלים על אותו דומיין, פרוטוקול ופורט. אם אחד מאלה אינו תואם, תקבל שגיאה כזו.

ב-Rails CLI, האם תוכל לנסות זאת:

DiscourseWebauthn.origin

ולהשוות אותו ל-URL שבו אתה משתמש כדי לגשת לאתר בדפדפן? השניים צריכים להתאים.

whitewaterdeu · 26 באוקטובר,‏ 2025,‏ 4:11pm

user passkey function worked when i enable force https

reference

Thomas_Rother · 29 באוקטובר,‏ 2025,‏ 12:29pm

As far as I understand the Webauthn Standard for Passkey, it relies on a secure connection between the Relying Party (Discourse) and the Client (Browser or mobile device) and the Authenticator (e.g. a yubikey). Thus we need https for the communication coming from the Discourse application. Forcing https may be the solution, but just a header for

proxy_set_header X-Forwarded-Proto https;

could also be enough. If forcing of https helps (which is recommended anyway), all is fine.

whitewaterdeu · 30 באוקטובר,‏ 2025,‏ 6:40am

i don’t know how to config proxy_set_header X-Forwarded-Proto

in app.yaml?

system · 29 בנובמבר,‏ 2025,‏ 6:40am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

נושא		תגובות	צפיות
Issues using passkeys with vaultwarden Support passkey	12	2668	15 במרץ,‏ 2024
Passkey error Support passkey	11	155	19 באפריל,‏ 2025
Unable to determine Passkey issues behind Cloudflare Proxy Support passkey	0	100	15 ביולי,‏ 2024
Support passwordless login with Passkeys Feature completed , passkey	43	3730	17 בנובמבר,‏ 2023
Cannot register Yubikey as passkeys for passwordless login Bug passkey	13	1673	3 בדצמבר,‏ 2024

שגיאה בעת יצירת סיסמת משתמש בדפדפן

reference

נושאים קשורים