How to use FIDO2 with Discourse behind a reverse proxy?

[JonahAragon1 (Jonah Aragon)]

Has anyone ever figured out how to use FIDO2 with Discourse behind a reverse proxy? I’m having this issue using the web.socketed.template.yml template with a forum behind a Cloudflare Tunnel.

Neither Yubikey 2FA nor the new Passkey logins are working for me.

[pmusaraj (Penar Musaraj)]

Is this on a dev environment? You might need to override this bit temporarily:

discourse/discourse/blob/main/lib/discourse_webauthn.rb#L84-L100

And it is also likely helpful to use the --forward-host flag when running the server, i.e. bin/ember-cli -u --forward-host.

[JonahAragon1 (Jonah Aragon)]

No, this is a production install.

[pmusaraj (Penar Musaraj)]

What error messages are you getting?

[JonahAragon1 (Jonah Aragon)]

[pmusaraj (Penar Musaraj)]

What is the full URL of the failed request, /auth.json?

[JonahAragon1 (Jonah Aragon)]

Ah, no: /session/passkey/auth.json

[pmusaraj (Penar Musaraj)]

Ok, so your server thinks that it is not running on the hostname that the browser is requesting. The security key / passkey generation procedure has to ensure that the the hostname of the browser matches that of the server (keys are generated per hostname).

Can you log into your Rails console and check what the output of Discourse.current_hostname is? If it doesn’t match the URL you use to access the site, that’s the problem.

[pmusaraj (Penar Musaraj)]

Note, this could be a http vs https issue as well. I see the logo is looking for a URL under http:// on your site.

[JonahAragon1 (Jonah Aragon)]

Discourse.current_hostname does match the URL I use to access the site. Is there a way to see what Discourse thinks the hostname my browser is requesting is?

[pmusaraj (Penar Musaraj)]

What do you get for Discourse.base_url in the console?

[JonahAragon1 (Jonah Aragon)]

Ah, that is set to an http:// URL (with the correct hostname). I’m using the setup described here to make Discourse accessible to Cloudflare Tunnel:

Run other websites on the same machine as Discourse

@pfaffman edited this heavily 2022.02.24. Blame me if it’s broken. If you want to run other websites on the same machine as Discourse, you need to set up an extra NGINX or HAProxy proxy in front of the Docker container. NOTE: This is for advanced admins This guide assumes you already have Discourse working - if you don’t, it may be hard to tell whether or not the configuration is working. You cannot use ./discourse-setup to set up Discourse if another server is using port 80 or 443. You will …

[JonahAragon1 (Jonah Aragon)]

Oh, I think I got it. Enabling the force https setting in Discourse seems to have fixed it, I’m not sure why it was off. I don’t think it was necessary in the default config before adding another reverse proxy in front of it. Thanks for your help!