FinalDestination::SSRFDetector

Product Support

AI-generated summary

FinalDestination::SSRFDetector Issue

peyrusse is experiencing an error while trying to install a theme from GitHub on their intranet environment. The error message reads: FinalDestination: lookup failed.

david suggests that this error is thrown when Discourse tries to connect to a private/internal IP address. He thinks it’s possible that the intranet is pointing GitHub’s DNS record to an internal IP address.

To resolve the issue, david proposes two solutions:

  • Add github.com to the ‘allowed internal hosts’ site setting, but notes that this may affect Discourse’s security.
  • Manually download the theme from GitHub and upload it to Discourse, but this would mean no automated updates.

peyrusse tried adding github.com to ‘allowed internal hosts’ but it didn’t work. david then suggests that the issue might be due to the Discourse instance being unable to make a DNS lookup, and asks if the intranet allows access to the internet.

1

Hello,

I’m on an intranet environment and i try to install a new theme from this url :
https://github.com/discourse/discourse-air

When i try to install it, i got this error message :
Failed to process hijacked response correctly : FinalDestination::SSRFDetector::LookupFailedError : FinalDestination: lookup failed

Any idea how to solve this ?
Regards.

2

Hello, any help would be appreciated :wink:

3

This error is thrown when something attempts to connect to a private/internal IP address. If you’re getting it when cloning a theme from GitHub, then that suggests your intranet is pointing GitHub’s DNS record to some internal IP address… which is quite unusual! Is that expected in your intranet environment?

There is a site setting ‘allowed internal hosts’ which can be used to add hostnames which will bypass Discourse’s SSRF protections. Adding github.com there may help, but will also affect the security of Discourse.

Another option would be to download the theme from GitHub manually and then upload it to Discourse. But of course, that would mean you won’t get any automated updates.

4

I have tried adding github.com to “allowed internal hosts” but it doesn’t work, neither trying to import a zip file with the theme :
image

5

Ah I see, ‘lookup failed’ suggests that your Discourse instance can’t make a DNS lookup at all. Does your intranet allow access to the internet?