adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 10:52:22 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Access Denied: 403 (Webadmin behind nginx reverse proxy) #895

New Issue
Closed
opened 2026-10-05 04:51:18 +02:00 by adam · 2 comments
adam commented 2026-10-05 04:51:18 +02:00
Owner
Copy link
Copy source

OS: Ubuntu Xenial 16.04.1
Znc version : ZNC 1.6.3+deb1ubuntu0.1 - http://znc.in
IPv6: yes, SSL: yes, DNS: threads, charset: yes

When I try to access znc through a '/login' route on my domain, I get this error - "Access denied
POST requests need to send a secret token to prevent cross-site request forgery attacks."

I have searched a lot about this and have tried to log the response headers coming through the upstream server (znc), but I wasn't able to find much information on it.
When I run znc in debug mode, I get the following in systemd logs (accessed using journalctl -f -u znc) -

Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336739] Page Request [/]
Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336769] Remote IP:   14.139.38.113; discarding session [41c633b3772e73a5694eccdc8934d491b22adeda57a25e981c7fa261283c8fe1]
Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336792] Auto generated session: [c28091da93e0789465c79dc0f757a39ae9f0f829e3b524b815ff3c298b9ab0ea]
Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336812] Expected _CSRF_Check: 6c98f2fc7d55ac784db145971894decc
Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336820] Actual _CSRF_Check:
Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336834] - 403 (Access denied) [text/html; charset=utf-8]

The issue is that ZNC can't get the CSRF token, and that nginx isn't taking/getting those headers from upstream, and hence it can't supply to client. I then tested by opening the 6697 port directly from firewall, and tried accessing it and everything went smooth. So, that's some issue between nginx and znc. Any help would be greatly appreciated.

My nginx.conf file

server { 
	listen 443 ssl http2 ;
	listen [::]:443 ssl http2 ;
	server_name msharma.in; # managed by Certbot
	root /home/ubuntu/;
	index index.html index.htm index.nginx-debian.html;

	location / {
		alias /home/ubuntu/site/_site/;
		index index.html;
	}
	location /login {
		access_log /var/log/nginx/postdata.log postdata;
		proxy_pass http://127.0.0.1:6697/;
		proxy_redirect off;
		proxy_set_header 	X-Forwarded-Proto $scheme;
		proxy_set_header 	X-Real-IP  $remote_addr;
		proxy_set_header 	X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header 	Host $host;
		proxy_set_header 	Referer $http_referer;
		proxy_pass_header 	Set-Cookie;
	}	
	ssl_certificate /etc/letsencrypt/live/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/privkey.pem; # managed by Certbot
}

My znc.conf file -

Version = 1.6.3
TrustedProxy = 127.0.0.1
TrustedProxy = ::1
<Listener l>
	Port = 6697
	IPv4 = true
	IPv6 = true
	SSL = false 
</Listener>
LoadModule = webadmin

<User foobar>
	Pass       = sha256#xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx#
	Admin      = true
	Nick       = mayanksha
	AltNick    = mayank_sha
	Ident      = mayanksha
	RealName   = Mayank Sharma
	LoadModule = chansaver
	LoadModule = controlpanel

	<Network freenode>
		LoadModule = simple_away
		Server     = chat.freenode.net +6697 

		<Chan #archlinux>
		</Chan>
	</Network>
</User>
OS: Ubuntu Xenial 16.04.1 Znc version : ZNC 1.6.3+deb1ubuntu0.1 - http://znc.in IPv6: yes, SSL: yes, DNS: threads, charset: yes When I try to access znc through a '/login' route on my domain, I get this error - "Access denied POST requests need to send a secret token to prevent cross-site request forgery attacks." I have searched a lot about this and have tried to log the response headers coming through the upstream server (znc), but I wasn't able to find much information on it. When I run znc in debug mode, I get the following in systemd logs (accessed using `journalctl -f -u znc`) - ``` Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336739] Page Request [/] Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336769] Remote IP: 14.139.38.113; discarding session [41c633b3772e73a5694eccdc8934d491b22adeda57a25e981c7fa261283c8fe1] Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336792] Auto generated session: [c28091da93e0789465c79dc0f757a39ae9f0f829e3b524b815ff3c298b9ab0ea] Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336812] Expected _CSRF_Check: 6c98f2fc7d55ac784db145971894decc Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336820] Actual _CSRF_Check: Jan 17 10:30:53 ip-172-31-17-71 znc[2278]: [2019-01-17 10:30:53.336834] - 403 (Access denied) [text/html; charset=utf-8] ``` The issue is that ZNC can't get the CSRF token, and that nginx isn't taking/getting those headers from upstream, and hence it can't supply to client. I then tested by opening the 6697 port directly from firewall, and tried accessing it and everything went smooth. So, that's some issue between nginx and znc. Any help would be greatly appreciated. My `nginx.conf` file ``` server { listen 443 ssl http2 ; listen [::]:443 ssl http2 ; server_name msharma.in; # managed by Certbot root /home/ubuntu/; index index.html index.htm index.nginx-debian.html; location / { alias /home/ubuntu/site/_site/; index index.html; } location /login { access_log /var/log/nginx/postdata.log postdata; proxy_pass http://127.0.0.1:6697/; proxy_redirect off; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header Referer $http_referer; proxy_pass_header Set-Cookie; } ssl_certificate /etc/letsencrypt/live/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/privkey.pem; # managed by Certbot } ``` My `znc.conf` file - ``` Version = 1.6.3 TrustedProxy = 127.0.0.1 TrustedProxy = ::1 <Listener l> Port = 6697 IPv4 = true IPv6 = true SSL = false </Listener> LoadModule = webadmin <User foobar> Pass = sha256#xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx# Admin = true Nick = mayanksha AltNick = mayank_sha Ident = mayanksha RealName = Mayank Sharma LoadModule = chansaver LoadModule = controlpanel <Network freenode> LoadModule = simple_away Server = chat.freenode.net +6697 <Chan #archlinux> </Chan> </Network> </User> ``` <!-- github-sync-id:400213455 -->
adam closed this issue 2026-10-05 04:51:18 +02:00
adam commented 2026-10-05 04:51:19 +02:00
Author
Owner
Copy link
Copy source

Try following https://wiki.znc.in/Reverse_Proxy
Why do you proxy_pass only /login?

Try following https://wiki.znc.in/Reverse_Proxy Why do you `proxy_pass` only `/login`? <!-- github-comment-id:455160832 -->
adam commented 2026-10-05 04:51:20 +02:00
Author
Owner
Copy link
Copy source

Ah, My bad! I was putting an extra '/' at the end of http://127.0.0.1:6697 while not using a '/' at the end of '/login'. From what I can infer, all the '/login/' routes when accessed were giving the CSRF token for '/login' which wasn't present (since, that was login page).

I had seen and tried whatever was on wiki, but couldn't figure out this little difference of '/'. Sorry for the trouble, and Thanks a lot! 💯

Ah, My bad! I was putting an extra '/' at the end of `http://127.0.0.1:6697` while not using a '/' at the end of '/login'. From what I can infer, all the '/login/' routes when accessed were giving the CSRF token for '/login' which wasn't present (since, that was login page). I had seen and tried whatever was on wiki, but couldn't figure out this little difference of '/'. Sorry for the trouble, and Thanks a lot! :100: <!-- github-comment-id:455219033 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#895