sneak/pixa
1
0 Fork 0
Code Issues 4 Pull Requests 3 Actions 13 Packages Projects Releases Wiki Activity

A refused login or generator form answers a bare "Forbidden - origin invalid" that hides the cause #358

New Issue
Closed
opened 2026-11-11 21:13:26 +01:00 by clawbot · 1 comment
clawbot commented 2026-11-11 21:13:26 +01:00
Collaborator
Copy link
Copy source

Found in the hands-on acceptance test of next (092176d), #356.

Steps

  1. Run pixa with debug off, as the example config configs/config.example.yml has it.
  2. Open http://localhost:8080/ in a browser, type the signing key, press Login.

What happened

  • The browser shows a bare text page, Forbidden - origin invalid, status 403.
  • The origin is the page's own. The real cause is that the page was opened over plain HTTP while debug is off.
  • pixa logs nothing but the request line with status 403.
  • Other refusals answer the same way: a missing or stale form token gives Forbidden - CSRF token invalid.

These texts are the defaults of gorilla/csrf, the form-token library. internal/handlers/csrf.go builds its middleware without csrf.ErrorHandler.

What should happen

  • A refused form still answers 403, with a page that names the cause and what to do:
    • page opened over plain HTTP with debug off: open it over HTTPS, or turn debug on for plain HTTP on your own machine;
    • form from another host than the Host header: the reverse proxy must pass Host on unchanged;
    • missing or stale token: reload the page and submit again.
  • pixa logs a warning with the request ID and the cause (csrf.FailureReason).

Model: opus-5-5

Found in the hands-on acceptance test of `next` (`092176d`), https://git.eeqj.de/sneak/pixa/issues/356. ## Steps 1. Run pixa with `debug` off, as the example config `configs/config.example.yml` has it. 2. Open `http://localhost:8080/` in a browser, type the signing key, press Login. ## What happened - The browser shows a bare text page, `Forbidden - origin invalid`, status 403. - The origin is the page's own. The real cause is that the page was opened over plain HTTP while `debug` is off. - pixa logs nothing but the request line with status 403. - Other refusals answer the same way: a missing or stale form token gives `Forbidden - CSRF token invalid`. These texts are the defaults of `gorilla/csrf`, the form-token library. `internal/handlers/csrf.go` builds its middleware without `csrf.ErrorHandler`. ## What should happen - A refused form still answers 403, with a page that names the cause and what to do: - page opened over plain HTTP with `debug` off: open it over HTTPS, or turn `debug` on for plain HTTP on your own machine; - form from another host than the `Host` header: the reverse proxy must pass `Host` on unchanged; - missing or stale token: reload the page and submit again. - pixa logs a warning with the request ID and the cause (`csrf.FailureReason`). Model: opus-5-5
clawbot commented 2026-11-11 21:33:53 +01:00
Author
Collaborator
Copy link
Copy source

PR: #365, branch issue-358-name-form-refusal-cause.

A refused form now gets a 403 page naming the cause and what to do, and pixa logs a form refused warning with the request ID and reason. Two more causes are named than the issue lists: HTTPS while debug is on, and a form with neither Origin nor Referer.

Model: opus-5-5

PR: https://git.eeqj.de/sneak/pixa/pulls/365, branch `issue-358-name-form-refusal-cause`. A refused form now gets a 403 page naming the cause and what to do, and pixa logs a `form refused` warning with the request ID and reason. Two more causes are named than the issue lists: HTTPS while `debug` is on, and a form with neither `Origin` nor `Referer`. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
needs-checks
needs-decision
Waiting on a decision; no PR can proceed
 needs-rebase
needs-review
needs-rework
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/pixa#358