401 error in /api/v1/dashboard while logging through discord OAuth causing a loop while logging about discord-musicbot

[BioCla]

Thanks for reporting, this will be looked into 👍

[Neko-Life]

try adding proxy_pass_request_headers on; to both location in your nginx config

[szentigrad3]

i can login to the dashboard fine

https://i.imgur.com/9GUfcCC.png

[NereaCassian]

@szentigrad3 can I get more info? Which browser you're using? The networks tab doesn't report any error?

[szentigrad3]

@szentigrad3 can I get more info? Which browser you're using? The networks tab doesn't report any error?

i'm using microsoft edge and no errors, https://i.imgur.com/jVLEdIG.png

[NereaCassian]

Oh, but you mean in your bot. Yeah I know that for now it's only failing for me.

[BioCla]

an initial analysis shows that it may have to do with how the links are being handled here:

Discord-MusicBot/dashboard/src/pages/login/index.tsx

Lines 36 to 42 in b4c9e8b

	useEffect(() => {
	if (url)
	window.location.href =
	url +
	'&redirect_uri=' +
	encodeURIComponent(window.location.href);
	}, [url]);

and here:

Discord-MusicBot/dashboard/src/components/ProcessData.tsx

Lines 1 to 21 in b4c9e8b

	import { useProcessData } from '@/hooks/useProcessData';
	import { IBaseApiResponse, IUseProcessDataOptions } from '@/interfaces/api';
	interface IProcessDataProps<T> extends IUseProcessDataOptions {
	data: IBaseApiResponse<T> | undefined;
	isLoading: boolean;
	children: React.ReactNode;
	}
	export default function ProcessData<T>({
	data,
	isLoading,
	children,
	...props
	}: IProcessDataProps<T>) {
	const processData = useProcessData(data, isLoading, {
	...props,
	});
	return processData(children);
	}

Thus:

Discord-MusicBot/dashboard/src/services/api.ts

Lines 101 to 138 in b4c9e8b

	export async function getLoginURL() {
	const res = await apiService.get<IGetLoginURL>('/login');
	return res.data;
	}
	export function useGetLoginURL(options: IUseQueryOptions<IGetLoginURL> = {}) {
	return useQuery({
	queryKey: ['get-login-url'],
	queryFn: getLoginURL,
	...options,
	});
	}
	type IPostLogin = IBaseApiResponse<IUser>;
	export async function postLogin(data: ParsedUrlQuery) {
	const { origin, pathname } = window.location;
	const res = await apiService.post<IPostLogin>('/login', {
	...data,
	redirect_uri: origin + pathname,
	});
	return res.data;
	}
	export function usePostLogin(
	query: ParsedUrlQuery,
	options: IUseQueryOptions<IPostLogin> = {},
	) {
	return useQuery({
	queryKey: ['post-login', query.code],
	queryFn: () => postLogin(query),
	enabled: !!query.code,
	...options,
	});
	}

More research will be done

[Neko-Life]

probably no database configured, you can't have authorization without database

[NereaCassian]

I have a DB configured, the postgress db that comes with the bot. And I have setup correctly the database URL and type in the .env.

[Neko-Life]

apply this patch

From e23d8d6e4658d88d08bd04f9ff741e1384a044ea Mon Sep 17 00:00:00 2001
From: Neko-Life <[email protected]>
Date: Tue, 29 Aug 2023 08:33:16 +0700
Subject: [PATCH] patch

---
 djs-bot/api/v1/src/routes/v1/index.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/djs-bot/api/v1/src/routes/v1/index.ts b/djs-bot/api/v1/src/routes/v1/index.ts
index 6d5c5e1..f97d0c0 100644
--- a/djs-bot/api/v1/src/routes/v1/index.ts
+++ b/djs-bot/api/v1/src/routes/v1/index.ts
@@ -59,14 +59,20 @@ const routes: RegisterRouteHandler = async (app, opts, done) => {
         );
       };
 
+      console.log({ headers: request.headers, path: request.routerPath });
+
       if (!request.headers.access_token?.length) throwError();
 
       const { user_id } = verifyToken(request.headers.access_token as string);
 
+      console.log({ user_id });
+
       if (!user_id?.length) throwError();
 
       const auth = await db.getUserAuth(user_id as string);
 
+      console.log({ auth });
+
       if (!auth?.access_token?.length) throwError();
 
       request.headers.user_id = user_id;
-- 
2.41.0

and then come back to us with some log, hopefully this can give us some clue

[NereaCassian]

Here are my logs

found 0 vulnerabilities
Using "postgresql" as the database schema
Generating Prisma client...
Pushing schema to database...
Database schema pushed successfully

> [email protected] bot
> npm run api-build && node index.js


> [email protected] api-build
> tsc -p api/v1/tsconfig.json

[29:7:2023 - 7:44] | Spawned shard 0
[29:7:2023 - 7:44] [WARN] | Bot running on OPLevel: 1
[29:7:2023 - 7:44] [WARN] | Debug mode is [ENABLED]!
[29:7:2023 - 7:44] [WARN] | Booting up the bot...
        InsertNameHereBot/v5.2.1-beta (ID: 899776315958390805)
[29:7:2023 - 7:44] [WARN] | Loading error handlers...
[29:7:2023 - 7:44] [INFO] | Loaded debug error handlers!
[29:7:2023 - 7:44] [DEBUG] | Music engine "Erela" has been loaded
[29:7:2023 - 7:44] [DEBUG] | Prisma ORM has been loaded
[29:7:2023 - 7:44] [INFO] | Slash commands have been loaded. Waiting for bot to finish initializing...
[29:7:2023 - 7:44] [INFO] | Schedules have been loaded.
[29:7:2023 - 7:44] [INFO] | Event listeners have been loaded.
[29:7:2023 - 7:44] [INFO] | Successfully logged in as Judy Alvarez#5402
[29:7:2023 - 7:44] [INFO] | API is now listening on port 8080
[29:7:2023 - 7:44] [DEBUG] | Node: DockerNode | Lavalink node is connected.
[29:7:2023 - 7:44] [INFO] | Slash commands have been pushed to application
[29:7:2023 - 7:44] [SILLY] | InsertNameHereBot/v5.2.1-beta (ID: 899776315958390805) is online!
{
  headers: {
    host: 'judy.nereacassian.com',
    'x-real-ip': '213.194.147.141',
    'x-forwarded-for': '213.194.147.141',
    'x-forwarded-host': 'judy.nereacassian.com',
    connection: 'close',
    'sec-ch-ua': '"Not.A/Brand";v="8", "Chromium";v="114", "Opera GX";v="100"',
    accept: 'application/json, text/plain, */*',
    'sec-ch-ua-mobile': '?0',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/100.0.0.0',
    'sec-ch-ua-platform': '"Windows"',
    'sec-fetch-site': 'same-origin',
    'sec-fetch-mode': 'cors',
    'sec-fetch-dest': 'empty',
    referer: 'https://judy.nereacassian.com/dashboard',
    'accept-encoding': 'gzip, deflate, br',
    'accept-language': 'es-ES,es;q=0.9'
  },
  path: '/api/v1/dashboard'
}
prisma:info Starting a postgresql pool with 13 connections.
{
  headers: {
    host: 'judy.nereacassian.com',
    'x-real-ip': '213.194.147.141',
    'x-forwarded-for': '213.194.147.141',
    'x-forwarded-host': 'judy.nereacassian.com',
    connection: 'close',
    'sec-ch-ua': '"Not.A/Brand";v="8", "Chromium";v="114", "Opera GX";v="100"',
    accept: 'application/json, text/plain, */*',
    'sec-ch-ua-mobile': '?0',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/100.0.0.0',
    'sec-ch-ua-platform': '"Windows"',
    'sec-fetch-site': 'same-origin',
    'sec-fetch-mode': 'cors',
    'sec-fetch-dest': 'empty',
    referer: 'https://judy.nereacassian.com/dashboard',
    'accept-encoding': 'gzip, deflate, br',
    'accept-language': 'es-ES,es;q=0.9'
  },
  path: '/api/v1/dashboard'
}
{
  headers: {
    host: 'judy.nereacassian.com',
    'x-real-ip': '213.194.147.141',
    'x-forwarded-for': '213.194.147.141',
    'x-forwarded-host': 'judy.nereacassian.com',
    connection: 'close',
    'sec-ch-ua': '"Not.A/Brand";v="8", "Chromium";v="114", "Opera GX";v="100"',
    accept: 'application/json, text/plain, */*',
    'sec-ch-ua-mobile': '?0',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/100.0.0.0',
    'sec-ch-ua-platform': '"Windows"',
    'sec-fetch-site': 'same-origin',
    'sec-fetch-mode': 'cors',
    'sec-fetch-dest': 'empty',
    referer: 'https://judy.nereacassian.com/dashboard',
    'accept-encoding': 'gzip, deflate, br',
    'accept-language': 'es-ES,es;q=0.9'
  },
  path: '/api/v1/dashboard'
}
{
  headers: {
    host: 'judy.nereacassian.com',
    'x-real-ip': '213.194.147.141',
    'x-forwarded-for': '213.194.147.141',
    'x-forwarded-host': 'judy.nereacassian.com',
    connection: 'close',
    'sec-ch-ua': '"Not.A/Brand";v="8", "Chromium";v="114", "Opera GX";v="100"',
    accept: 'application/json, text/plain, */*',
    'sec-ch-ua-mobile': '?0',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/100.0.0.0',
    'sec-ch-ua-platform': '"Windows"',
    'sec-fetch-site': 'same-origin',
    'sec-fetch-mode': 'cors',
    'sec-fetch-dest': 'empty',
    referer: 'https://judy.nereacassian.com/dashboard',
    'accept-encoding': 'gzip, deflate, br',
    'accept-language': 'es-ES,es;q=0.9'
  },
  path: '/api/v1/dashboard'
}

[BioCla]

So it's looping in the verify token function

[NereaCassian]

I did and still looping, this is my new conf

location / {
	proxy_pass http://127.0.0.1:3000;
	proxy_set_header   Host $host;
	proxy_set_header   X-Real-IP $remote_addr;
	proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header   X-Forwarded-Host $server_name;
	proxy_pass_request_headers on;
}
location /api {
	proxy_pass http://127.0.0.1:1023;
	proxy_set_header   Host $host;
	proxy_set_header   X-Real-IP $remote_addr;
	proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header   X-Forwarded-Host $server_name;
	proxy_pass_request_headers on;
}

[Neko-Life]

does proxy_set_header access_token $access_token; works?

[NereaCassian]

I don't have any $access_token var configured in nginx, so it gives me a test failed

[Neko-Life]

there's something probably your configuration causing nginx to drop the access token header which needed for the authorization. You need to find which configuration or whatever causing it to do that so the api receives the header

[NereaCassian]

Okay, I did found out and is a very stupid thing If you do not explicitly set underscores_in_headers on;, NGINX will silently drop HTTP headers with underscores (which are perfectly valid according to the HTTP standard). So its solved. Thank you very much for your help. <3

[BioCla]

Should we maybe add some try catch blocks to return the actual errors, if possible?

[Neko-Life]

sure we can add some log in debug mode smt like "Missing access_token header", "Invalid JWT signature" etc.

[SerpentDrago]

I'm having the same "loop" problem using Nginx Config manager in unraid , i dont' see how or where to set the underscores_in_headers on;

i'm using the webbased config gui for nginx .

I authorize and just get looped to the main webpage again .. so i can't access the dashboard . Bot works fine besides

[NereaCassian]

@SerpentDrago just add the line in the config block of the advanced tab