Can’t register on Docker instance

[hopeseekr]

So I have Docker working… I had to make some modifications to the config/environments/development.rb:

-  config.web_console.permissions = ["192.168.0.0/16", "172.17.0.0/16"]
+  config.web_console.permissions = ["192.168.0.0/16", "172.16.0.0/12"]

This is to support all of Docker’s IP ranges 172.16.0.0-172.31.255.255, since the server runs multiple docker networks.

And

+config.action_cable.allowed_request_origins = [ "https://gpt.zpf.io" ]

so that it will accept entries from the main domain.

The problem is that signups don’t work: https://gpt.zpf.io/register

Each request returns: 422 Unprocessable Content with this in the docker log:

base-1 | web | Started POST "/users" for 172.24.0.1 at 2024-06-17 01:35:13 +0000
base-1 | web | Processing by UsersController#create as TURBO_STREAM
base-1 | web | Parameters: {"authenticity_token"=>“[FILTERED]", "person"=>{"personable_type"=>"User", "email"=>“[FILTERED]", "personable_attributes"=>{"credentials_attributes"=>{"0"=>{"type"=>"PasswordCredential", "password"=>“[FILTERED]"}}, "name"=>"asdf asdf"}}, "commit"=>“Sign Up”}
base-1 | web | HTTP Origin header (https://gpt.zpf.io) didn’t match request.base_url (http://gpt.zpf.io)
base-1 | web | Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms | Allocations: 501)
base-1 | web |
base-1 | web |
base-1 | web |
base-1 | web | ActionController::InvalidAuthenticityToken (HTTP Origin header (https://gpt.zpf.io) didn’t match request.base_url (http://gpt.zpf.io)):

Very simple reverse proxy:

server {
    listen [::]:443 ssl;
    listen 88.99.162.101:443 ssl;
    server_name gpt.zpf.io;

    location / {
        proxy_pass http://127.0.0.3:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }


    ssl_certificate /etc/letsencrypt/live/zpf.io/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/zpf.io/privkey.pem; # managed by Certbot
}

[krschacht]

@hopeseekr You're stumping me, but I've never set up a reverse proxy. But I have an instance of the app running with a custom domain, with an SSL key, on Fly and on Render, and I didn't run into any problems with that.

Are you running this docker instance locally or on a public server?

I just tried copying and pasting all this into GPT and it told me:

It looks like there's a mismatch between the URL scheme in the HTTP Origin header and the request base URL. You need to configure your Rails app to accept HTTPS requests. Try setting the config.force_ssl to true in the config/environments/production.rb file:

config.force_ssl = true

Additionally, update your Nginx configuration to forward the scheme:

proxy_set_header X-Forwarded-Proto $scheme;

This helps Rails recognize the original HTTPS request.

[matthewbennink]

Also, see this initializer. You can set ENV["ALLOWED_REQUEST_ORIGINS"] = "https://gpt.zpf.io" and it should have the same effect as setting it yourself in the code. It will set up a CORS handler as well, which likely won't be necessary for your use case, but is also harmless so long as requests from that domain are expected and safe.

This assumes the Rails app knows the requests are via HTTPS of course.

[krschacht]

@matthewbennink Thanks for chiming in. I thought this ALLOWED_REQUEST_ORIGINS setting was only necessary if you were using the app in API mode since API requests don't validate with CORS. Does it make sense to you why he's having trouble in his particular setup?

[matthewbennink]

I think the reverse proxy isn't sending the header that says the request came over HTTPS. If it does that, then the origins should match (they're not matching because of the protocol) and it shouldn't be required to set the host for ActionCable at all. And so won't be necessary to set this. I believe you're right that ALLOWED_REQUEST_ORIGINS is only necessary if the frontend is separate from the backend.