19
Can't log in to piefed (lemmy.world)
submitted 9 months ago by to c/voyagerapp@lemmy.world
19 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[โ€“] 6 points 9 months ago (11 children)

I used to be able to log in via Voyager. I don't know what changed. I get a message that Voyager doesn't support signups via Piefed. Is this what you see?

I'll have to look at this tonight. Maybe it's a firewall issue? Rimu, @rimu@piefed.social, any suggestions on where to start?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [โ€“] 7 points 9 months ago* (7 children)

    You can't register from within Voyager, but you can log in to an existing account (the button on the lower right of the adding an account screen). The reason you can't register a new piefed account in Voyager is because that functionality doesn't exist in the API yet.

    I was able to log in to feddit just fine using curl, so it seems to be voyager-specific. Not sure if there might be an errant cloudflare challenge or other kind of proxy-level filtering that it might be getting caught up in.

    Not sure if @aeharding@vger.social might have suggestions for how to help ID the issue or get a more descriptive error message.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [โ€“] 6 points 9 months ago (6 children)

    This is helpful. Thanks.

    Can you share the curl command? Seems like something worth keeping in my notes and will help me in looking more closely at the firewall rules.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [โ€“] 5 points 9 months ago (5 children)

    Here you go:

    curl --request POST \
  --url https://feddit.online/api/alpha/user/login \
  --header 'Content-Type: application/json' \
  --data '{
  "username": "your_username",
  "password": "your_password"
}'
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [โ€“] 4 points 9 months ago* (last edited 9 months ago) (3 children)

    Help me here. I'm not an expert. Here is the request going into the server. The error code is 400 (Bad Request)

    @x..@x..  
18:24:10.580462 IP 127.0.0.1.49126 > 127.0.0.1.5000: Flags [P.], seq 5107:5771, ack 1755, win 8143, options [nop,nop,TS val 1081650450 ecr 1081650382], length 664  
E....3@.@...............kz.....n...........  
@x..@x..POST /api/alpha/user/login HTTP/1.1  
X-Forwarded-For: 162.120.199.186, 172.70.111.121  
X-Forwarded-Proto: https  
Host: feddit.online  
Content-Length: 56  
accept-language: en-US,en;q=0.5  
content-type: application/json  
accept-encoding: gzip, br  
cf-ray: 9c85ae25b9720f65-EWR  
user-agent: Dalvik/2.1.0 (Linux; U; Android 16; Pixel 10 Pro XL Build/BP4A.260105.004.E1)  
cdn-loop: cloudflare; loops=1  
cf-connecting-ip: 162.120.199.186  
cf-ipcountry: US  
cf-visitor: {"scheme":"https"}  
cookie: session=eyJSZWZlcmVyIjoiaHR0cHM6Ly9sb2NhbGhvc3QvaW5ib3giLCJfZnJlc2giOmZhbHNlfQ.aYJgEQ.nMo4SDt0iKOrzFvSItQuquLp4qo  

{"password":"<hidden>","username":"testuser"}  
18:24:10.584409 IP 127.0.0.1.49120 > 127.0.0.1.5000: Flags [P.], seq 8671:10383, ack 2866, win 22123, options [nop,nop,TS val 1081650454 ecr 1081650338], length 1712  
E.....@.@.CB.............BO.+Ngj..Vk.......

    The session string is: eyJSZWZlcmVyIjoiaHR0cHM6Ly9sb2NhbGhvc3QvaW5ib3giLCJfZnJlc2giOmZhbHNlfQ
    This decodes to a referrer of: https://localhost/inbox

    I wonder if this is the issue. Will Piefed accept a session claiming to be from localhost? Will it see this as a potential attack or misconfiguration? Should I reconfigure nginx to drop incoming cookies for the login endpoint?

    I'm grasping at straws.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [โ€“] 4 points 9 months ago (1 child)

    When I do a curl request to the feddit.online API endpoint I can log in fine. If I use an invalid password I get the expected error message.

    rimu@rimu-mate2 ~ $ curl --request POST \
  --url https://feddit.online/api/alpha/user/login \
  --header 'Content-Type: application/json' \
  --data '{
  "username": "rimu",
  "password": "valid password"
}'
{"jwt":"some gibberish"}
rimu@rimu-mate2 ~ $ curl --request POST   --url https://feddit.online/api/alpha/user/login   --header 'Content-Type: application/json'   --data '{
  "username": "rimu",
  "password": "invalid password"
}'
{"code":400,"message":"incorrect_login","status":"Bad Request"}
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [โ€“] 4 points 9 months ago

    @rimu@piefed.social
    But the logins from Voyager are returning 400 (Bad Request), although the username and password are correct, and to me, the request looks good.

    I posted what is coming into the server. The only anomaly I saw was that the session cookie referrer seemed odd. Can you look at the request I posted? Do you see any reason it would be seen as a bad request?

    The odd thing is that while I get an error 95% of the time trying to log into Voyager, twice it did let me log in. I don't know what was different about those 2 times.

    Nothing gets logged to syslog, any nginx logs, pyfedi.log, or journalctl.

  • permalink
  • fedilink
  • source
  • parent
  • [โ€“] 4 points 9 months ago (2 children)

    Do you have any nginx rules which block scrapers by inspecting the user agent string? Perhaps that's catching Voyager.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [โ€“] 4 points 9 months ago*

    Nope. I posted below what is coming into the server. The only thing I can think of is that the referrer is coming in as https://localhost/inbox which might explain the 400 error (Bad Request). Does your nginx configuration drop incoming cookies for the login endpoint?

  • permalink
  • fedilink
  • source
  • parent
  • [โ€“] 3 points 9 months ago

    I have to look again because it was a while ago, but I do block some user agent strings, but if I'm blocking Voyager this way, I really screwed up.

    Another possibility is that Cloudflare is presenting a managed challenge during sign up.

  • permalink
  • fedilink
  • source
  • parent