NPM fail on frontend image build / 403 Referrer Policystrict-origin-when-cross-origin #227
Comments
Mohamed-Hacene
added
bug
|
@EvoXCX, could you update your docker compose version and re-try it to be sure it's not related to it ? |
|
@Mohamed-Hacene I used docker compose too and neither work |
|
If is something I can do to help you to fix that ask me :) |
|
@EvoXCX thanks a lot ! It could be very useful to try without any proxy in your configuration. I've re-done the installation from scratch and I can't get the same error, the only thing I notice in common between the two issues is that you are behind a proxy. |
|
@Mohamed-Hacene Yeah proxy seem to be the problem but this is mandatory in my case, although it's weird because it's not a problem with installation (network) but with compiling, I'm investigating in the frontend container not fully builded to understand how it works exactly step by step. |
|
Let me know if you have a fix for this issue before me ;) P.S: Building image on another docker node and importing do not work because |
|
Thanks for your help, I hope this isn't due to dependencies, as they are external to our application. We're also working on publishing our images to avoid this kind of problem. That way, you'll be able to compile them, proxy or not without a hitch ;) |
|
This is a very good news !!! When you think your image will be published ? I ask you that because this tool will help me to migrate to NIS2 in my context :) I will update issue if I found something useful to solve this. |
|
As soon as possible, we first make sure they work on different configurations. |
|
@Mohamed-Hacene It work with your images on ghcr. But I think I found a bug, let me explain: If you modify in docker-compose.yml hostname of containers backend and/or frontend an 500 internal error occur and give this message Invalid HTTP_HOST header: 'ciso_backend:8000'. The domain name provided is not valid according to RFC 1034/1035.
Traceback (most recent call last):
File "/usr/local/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55, in inner
response = get_response(request)
^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/django/utils/deprecation.py", line 133, in __call__
response = self.process_request(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/django/middleware/common.py", line 48, in process_request
host = request.get_host()
^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/django/http/request.py", line 151, in get_host
raise DisallowedHost(msg)
django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: 'ciso_backend:8000'. The domain name provided is not valid according to RFC 1034/1035.
Bad Request: /api/csrf/Working when back to backend and frontend hostname. In my docker-compose.yml there is the |
|
Oups fail, I get login page but can't login, when I click on login button nothing happen. Nginx (Reverse) Log "POST /login?next=/ HTTP/1.1" 403 60 "https://cisoassistant.domain.com/login?next=/" "Mozilla/5.0 (Windows NT 10.0; rv:121.0) Gecko/20100101 Firefox/121.0" |
|
Hi @EvoXCX, If nothing happens at login, knowing your error, it's because the frontend can't communicate with the backend (it receives no response) or doesn't get the cookie/session_id to be able to communicate. Could I see your docker-compose.yml to see if everything is ok in the configuration ? |
|
Here is my new configuration services:
backend:
image: ghcr.io/intuitem/ciso-assistant-community/backend:latest
container_name: ciso_backend
hostname: backend
restart: always
environment:
- ALLOWED_HOSTS=backend
- CISO_ASSISTANT_URL=https://cisoassistant.domain.com
- DJANGO_DEBUG=True
# DB
- POSTGRES_NAME=ciso
- POSTGRES_USER=ciso_user
- POSTGRES_PASSWORD=<password>
- DB_HOST=ciso_db
- DB_PORT=5432
# Email
- [email protected]
- EMAIL_HOST=<smtp_server>
- EMAIL_PORT=25
frontend:
image: ghcr.io/intuitem/ciso-assistant-community/frontend:latest
container_name: ciso_frontend
hostname: frontend
restart: always
environment:
- PUBLIC_BACKEND_API_URL=http://backend:8000/api
- PROTOCOL_HEADER=x-forwarded-proto
- HOST_HEADER=x-forwarded-host
depends_on:
- backend
ports:
- 127.0.0.1:3000:3000
ciso_db:
image: docker.io/postgres:latest
container_name: ciso_db
hostname: ciso_db
restart: always
environment:
- POSTGRES_USER=ciso_user
- POSTGRES_PASSWORD=<password>
- POSTGRES_DB=ciso
- PGDATA=/var/lib/postgres/data
volumes:
- /srv/cisoassistant/data:/var/lib/postgres/data |
|
Ok, at first glance I don't see anything problematic. Could I also see your containers logs when you try to login ? |
|
Hey @Mohamed-Hacene sorry for the late response but, I updated all images to the latest version and had the same error as described before, can't login. Here is my log front my backend 2024-04-15T06:53:03.781987Z [info ] BASE_DIR: /code [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:03.782307Z [info ] VERSION: v1.0.8 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:03.782546Z [info ] BUILD: 07c5855 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:03.783259Z [info ] DEBUG mode: True [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:03.783450Z [info ] CISO_ASSISTANT_URL: https://ciso.domain.com [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:03.783786Z [info ] ALLOWED_HOSTS: ['backend'] [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:03.784337Z [info ] DATABASE ENGINE: django.db.backends.postgresql_psycopg2 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:07.413983Z [info ] BASE_DIR: /code [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:07.414237Z [info ] VERSION: v1.0.8 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:07.414622Z [info ] BUILD: 07c5855 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:07.415232Z [info ] DEBUG mode: True [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:07.415421Z [info ] CISO_ASSISTANT_URL: https://ciso.domain.com [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:07.415691Z [info ] ALLOWED_HOSTS: ['backend'] [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:07.415972Z [info ] DATABASE ENGINE: django.db.backends.postgresql_psycopg2 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
36 static files copied to '/code/static'.
2024-04-15T06:53:08.831324Z [info ] BASE_DIR: /code [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:08.831592Z [info ] VERSION: v1.0.8 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:08.831843Z [info ] BUILD: 07c5855 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:08.832419Z [info ] DEBUG mode: True [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:08.832623Z [info ] CISO_ASSISTANT_URL: https://ciso.domain.com [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:08.832852Z [info ] ALLOWED_HOSTS: ['backend'] [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:08.833243Z [info ] DATABASE ENGINE: django.db.backends.postgresql_psycopg2 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
Operations to perform:
Apply all migrations: auth, cal, contenttypes, core, iam, sessions
Running migrations:
No migrations to apply.
startup handler: initialize database
[2024-04-15 06:53:12 +0000] [1] [INFO] Starting gunicorn 21.2.0
[2024-04-15 06:53:12 +0000] [1] [INFO] Listening at: http://0.0.0.0:8000 (1)
[2024-04-15 06:53:12 +0000] [1] [INFO] Using worker: sync
[2024-04-15 06:53:12 +0000] [61] [INFO] Booting worker with pid: 61
2024-04-15T06:53:12.606833Z [info ] BASE_DIR: /code [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:12.607093Z [info ] VERSION: v1.0.8 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:12.607555Z [info ] BUILD: 07c5855 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:12.608231Z [info ] DEBUG mode: True [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:12.608465Z [info ] CISO_ASSISTANT_URL: https://ciso.domain.com [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:12.608773Z [info ] ALLOWED_HOSTS: ['backend'] [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:12.609262Z [info ] DATABASE ENGINE: django.db.backends.postgresql_psycopg2 [ciso_assistant.settings] ciso_assistant_url=https://ciso.domain.com
2024-04-15T06:53:59.602665Z [info ] request_started [django_structlog.middlewares.request] ciso_assistant_url=https://ciso.domain.com ip=192.168.112.4 request=GET /api/csrf/ request_id=ce0a837a-dfb3-4bfa-98dc-5d9c42ef6111 user_agent=node user_id=None
2024-04-15T06:53:59.623017Z [info ] request_finished [django_structlog.middlewares.request] ciso_assistant_url=https://ciso.domain.com code=200 ip=192.168.112.4 request=GET /api/csrf/ request_id=ce0a837a-dfb3-4bfa-98dc-5d9c42ef6111 user_id=None
2024-04-15T06:53:59.798965Z [info ] request_started [django_structlog.middlewares.request] ciso_assistant_url=https://ciso.domain.com ip=192.168.112.4 request=GET /api/csrf/ request_id=7a0953c9-96fb-4f6e-8ab0-3c4c018f184c user_agent=node user_id=None
2024-04-15T06:53:59.802464Z [info ] request_finished [django_structlog.middlewares.request] ciso_assistant_url=https://ciso.domain.com code=200 ip=192.168.112.4 request=GET /api/csrf/ request_id=7a0953c9-96fb-4f6e-8ab0-3c4c018f184c user_id=NoneThere is no log in frontend except this line: Listening on 0.0.0.0:3000Here is log from Firefox dev tools about request send when clicked on login Status
403
Forbidden
VersionHTTP/1.1
Transferred266 B (60 B size)
Referrer Policystrict-origin-when-cross-origin
Request PriorityHighest
DNS ResolutionSystemI use Nginx as reverse proxy, is something wrong with my proxy_pass config or proxy_header ? server {
listen 443 ssl;
listen [::]:443 ssl;
ssl_certificate /etc/ssl/ciso/ciso.domain.com.crt;
ssl_certificate_key /etc/ssl/ciso/ciso.domain.com.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
add_header Strict-Transport-Security "max-age=63072000" always;
server_name ciso.domain.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
} |
|
Hey, @Mohamed-Hacene @ab-smith I pulled 1.0.9 and it didn't work neither |
|
Hey @EvoXCX, could you try to add ORIGIN environment variable inside frontend service, with the same value than CISO_ASSISTANT_URL on backend side. It should be ORIGIN="https://ciso.domain.com" in your case normally. |
|
It work !!! |
Mohamed-Hacene
changed the title
Describe the bug
Issue #205 is probably same nature problem
Hello,
I tried to build image frontend image with Docker 26.0.0 and docker-compose 1.29.2 and I get this error
I'm behind reverse proxy I don't think the problem come from that since packages are retrieved at the start.
Here is my docker-compose.yml
To Reproduce
Steps to reproduce the behavior:
Expected behavior
A working image.
Environment (please complete the following information):
Additional context
I builded it successfully on Fedora 39 clean install, but can't import image to another docker node.
When I import it and launch, it say me that the image have no command.
The text was updated successfully, but these errors were encountered: