CSRF-Invalid error Cannot Login after upgrade to package 2.31.5

[Axtremus]

Hello, I am seeing "error=csrf-invalid" with a NodeBB installation recently upgraded to 4.14.5.
The installation is NodeBB 4.14.5 (package version 2.31.5) running in Cloudron 9.2.0 on Ubuntu 24.04.4.
Existing sessions continue to work; observed issues are:

• All attempts to login result in "error=csrf-invalid" and the message "Login Unsuccessful // We were unable to log you in, likely due to an expired session. Please try again"
• NodeBB users with "admin" privilege cannot actually get to the admin panel (clicking on the "admin" icon takes the user to the /user/admin page rather than the /admin page)

Simple things like "(on the server side) let's restart the app and see what happens" and "(on the client side) let's clear all browser cache/cookies/history/data" and "let's try this on different browsers (Safari/Brave/Chrome)" have been tried to no avail.

Any advice for what else I should try?

[robi]

@Axtremus save logs, check custom plugins, then restore from backup until issue resolved.

[joseph]

As @robi said most likely something plugin related. What plugins do you have installed?

[james]

Hello @axtremus
We addressed a CSRF-Invalid error this in the NodeBB update 4.14.4/diff.
And it was also addressed upstream https://community.nodebb.org/topic/19405/trust_proxy-will-default-to-false-in-4.14.3
The Cloudron package always sets "trust_proxy": true.

Can you please check your /run/nodebb/config.json file with the Web Terminal if trust_proxy: true exists in there?

[Axtremus]

@Joseph , my list of "enabled" plagins below:

# ./nodebb plugins | grep enabled
        * @nodebb/nodebb-plugin-reactions@3.0.1 (installed, enabled)
        * nodebb-plugin-btn-spoilers@0.4.1 (installed, enabled)
        * nodebb-plugin-composer-default@11.0.8 (installed, enabled)
        * nodebb-plugin-dbsearch@7.0.0 (installed, enabled)
        * nodebb-plugin-embed@3.0.19 (installed, enabled)
        * nodebb-plugin-emoji@6.0.14 (installed, enabled)
        * nodebb-plugin-emoji-android@4.1.1 (installed, enabled)
        * nodebb-plugin-markdown@13.2.6 (installed, enabled)
        * nodebb-plugin-mentions@5.0.0 (installed, enabled)
        * nodebb-plugin-twitter-netdata@1.0.0 (installed, enabled)
        * nodebb-rewards-essentials@1.0.3 (installed, enabled)
        * nodebb-theme-harmony@3.1.9 (installed, enabled)
        * nodebb-widget-essentials@8.0.4 (installed, enabled)

@James , yes, I see the line "trust-proxy" : true in my config.json file.

Another suspect is some sort of Redis "memory full" condition preventing new logins from happening. When I check Redis memory usage, I see these two lines:

used_memory:257978864
maxmemory:257949696

used_memory seems to have exceeded maxmemory a bit; but at this point I do not know what's filling up Redis memory.

[Axtremus]

Update: Flushing Redis worked ... now the system allows logins again. The cost is everyone needs to re-login (not ideal, but tolerable).

Now I would like to investigate what caused Redis' memory to fill up in the first place.

One working theory is that we're being targeted by bots, but the number of logins I can see are rather modest and there has been no "spike" in those stats. We do have "guess visitors" and "guess page views" (also no "spike" on those stats) ... so if any one here knows the answer, my question now is this:

• Does NodeBB generate new Redis entries for "guess visits" or "guess page views"?
• Anything else you can think of that would cause NodeBB to add entries to Redis?

[joseph]

@axtremus this question might be better suited for the NodeBB forum itself (https://community.nodebb.org/) since it's an implementation detail of the app.

[Axtremus]

@Joseph , you make a good point and I have follow up on this topic at https://community.nodebb.org/topic/19410/csrf-invalid-login-issue-with-nodebb-4.14.5/

That said, one suggestion received from there is to "check your redis config and make sure it has an eviction policy set to something like volatile-lru" ... for this, it seems I need to come back and ask a question here because I don't seem able to find my redis.conf file in the usual places like /etc/redis.conf or /etc/redis/redis.conf, so I come back here to ask if maybe the folks who "package" up NodeBB for Cloudron can clue me into where I can find redis.conf in the NodeBB package for Cloudron. Thanks in advance!

[joseph]

@axtremus the maxMemoryPolicy can be set now in the package but it requires Cloudron 10 . So, I think the answer is to wait a bit for Cloudron 10.