serverUri not respected in login popup

[benharri]

I found this nginx config, seemingly missing from the wiki page, and ended up with this:

The goal is to use *.solid.tilde.team on 443 through nginx.

server {
    include snippets/listen.conf;
    server_name solid.tilde.team *.solid.tilde.team;
    return 307 https://$server_name$request_uri;
}

server {
    include snippets/listen-ssl.conf;
    include snippets/ssl/solid.tilde.team;
    server_name solid.tilde.team *.solid.tilde.team;
    ssl_verify_client optional_no_ca;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "";
        proxy_set_header X-Nginx-Proxy true;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-SSL-CERT $ssl_client_cert;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass https://localhost:8443;
    }
}

my config.json is as follows:

{
  "root": "/solid/data",
  "serverUri": "https://solid.tilde.team",
  "port": "8443",
  "webid": true,
  "mount": "/",
  "configPath": "./config",
  "configFile": "./config.json",
  "dbPath": "./.db",
  "sslKey": "/etc/letsencrypt/live/solid.tilde.team/privkey.pem",
  "sslCert": "/etc/letsencrypt/live/solid.tilde.team/fullchain.pem",
  "multiuser": true,
  "enforceToc": false,
  "disablePasswordChecks": false,
  "supportEmail": "sudoers@tilde.team",
  "server": {
    "name": "solid.tilde.team",
    "description": "",
    "logo": ""
  }
}

I'm able to successfully register an account from the root at https://solid.tilde.team, but am unable to log in with my newly created account.

The js console in the login popup reports the following:

Error logging in with WebID-OIDC popup.html:24:123308
TypeError: "NetworkError when attempting to fetch resource." popup.html:24:123357
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://localhost:8443/jwks. (Reason: CORS request did not succeed).

At a first glance, it appears that something in the popup window is not respecting the serverUri value from config.json. It's also possible that something is getting dropped along the way in the nginx proxy.

If the nginx configs look correct, I'd like to add them to the wiki page as well.

Thanks!

[benharri]

This might be related to #1017

[RubenVerborgh]

proxy_set_header X-SSL-CERT $ssl_client_cert;

That will not work anymore though.

[benharri]

Is it not needed or is there a different header that I need to set?

[RubenVerborgh]

It is not needed if you do not use WebID-TLS.

There is currently no solution (that I know of) with NGINX to forward client certificates. We used to have header-based certificate forwarding, but that broke because of a library incompatibility in Node 8, so we had to drop it.

[benharri]

Ahh ok I'll remove that header. Is there a reason the popup is trying to get to localhost though?

[benharri]

I've just recreated this with a fresh VPS (meaning no proxy) and I'm getting the same CORS error for localhost:8443, even though serverUri is properly set.

In this case, I don't even have the solid server running on 8443. It's only configured to run on 443 directly.

[RubenVerborgh]

Can you clear your .db/ folder and restart?

[benharri]

Whoa that worked!

the serverUri was not set by solid init. I must have started the server once before realizing it, fixing it, and restarting.

[RubenVerborgh]

Thanks for testing!

[benharri]

This means that the solid init command has a bug that fails to set the serverUri key.

[RubenVerborgh]

This means that the solid init command has a bug that fails to set the serverUri key.

Did it ask you for serverUri though? I think it's one of the optional settings.