Fedia Discussions

1 readers

4 users here now

founded 1 year ago

MODERATORS

[email protected]

Fedia.io instability (fedia.io)

submitted 2 months ago by [email protected] to c/[email protected]

34 comments fedilink hide all child comments

Hi all. I've been having some problems keeping fedia.io running - at the moment, either the message workers or the php web server processes are dying after an hour or so and I have to restart everything. I have been working with the mbin team and installed some updates that we hoped would fix the problems, but no luck. I am going to work on a cron job to automatically restart things once an hour. The down side, is that you'll likely see some error 500's if you happen to hit it when the processes are restarting, but it should happen quickly and refreshing the page should make it work again.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 1 month ago (17 children)

For now try Firefox or a fork: Floorp, LibreWolf, etc. I heard that works better.. I know this isn't the solution, but that is the best workaround atm.

[–] [email protected] 2 points 1 month ago (15 children)

Most interesting: the problem had only been happening on MS Edge on my laptop. I have been using safari on my phone without issue. Just a bit ago, i refreshed the page and now every time I revisit the site, I have to log back in, just like on Edge. It’s like the old session expired and the new ones aren’t sticking. I’ll try FF on my phone.

Note: even in the time I started typing this reply to when I hit the “add comment” button, I got logged out

[–] [email protected] 1 points 1 month ago (14 children)

Note: even in the time I started typing this reply to when I hit the “add comment” button, I got logged out

That is really bad indeed. And the only error you see on the server side is only "Invalid CSRF token"?

[–] [email protected] 2 points 1 month ago (1 children)

ok - I just had it happen again while looking at logs. interestingly, there was NOT a CSRF log when that happened. There were a bunch of other errors, but enough that I could look through all of them and see that they were all related to activitypub issues - signaturevalidator and the like

[–] [email protected] 1 points 1 month ago (1 children)

I really hope it's not a session issue with Valkey or something (I don't think so..). We are now just going deep into this issue I think. Both sessions & csrf. Since I notice already some weird config issues with csrf forms

[–] [email protected] 2 points 1 month ago (1 children)

FYI. Reading: https://symfony.com/doc/7.2/security/csrf.html#installation

The tokens used for CSRF protection are meant to be different for every user and they are stored in the session. That's why a session is started automatically as soon as you render a form with CSRF protection.

Moreover, this means that you cannot fully cache pages that include CSRF protected forms. As an alternative, you can:

Embed the form inside an uncached ESI fragment and cache the rest of the page contents;

Cache the entire page and load the form via an uncached AJAX request;

Cache the entire page and use hinclude.js to load the CSRF token with an uncached AJAX request and replace the form field value with it.

[–] [email protected] 1 points 1 month ago (1 children)

So we might cache too much in Mbin.. Including the comments (vote forms)... oopsy?

[–] [email protected] 1 points 1 month ago (1 children)

Or remove.. CSRF protection and keep the cache.. It's a trade-off.. @[email protected] How much protection does CSRF on these forms really gives the user? I'm "just" the software engineer, you are the SecOps expert here... I mean how likely is it really that sites are doing a Cross-Site Request Forgery ...

[–] [email protected] 3 points 1 month ago (1 children)

it's hard to make a blanket statement, because it depends on the details of the application. CSRF attacks are definitely real and common, but using csrf tokens isn't critical in every application. For example, I think we have CORS headers enabled, I don't think we have functionality that allows embedded iframes, but we do allow links - if we have administrative functions that can be triggered solely with GET parameters, then someone could trick an administrator into doing something that caused damage by clicking on a link in a post. The only one that would obviously work that I can see is "logout", which would be annoying, but not world ending, and would work for everyone, not just administrators.

[–] [email protected] 1 points 1 month ago

Thanks. I see. I do see the importance for login & logout forms having CSRF. But it does seems a bit overkill to have it on upvotes, boost and alike.. I could be wrong.

load more comments (12 replies)

load more comments (13 replies)