Freshrss: FeedMe not able to authenticate

[jackjackk]

I recently updated FreshRSS. Not sure if it's related, but now I can no longer use FeedMe.
In my logs I get:

XXX - - [29/Jan/2019:15:00:47 +0000] "POST /api/greader.php/accounts/ClientLogin?Email=YYY&Passwd=ZZZ HTTP/1.1" 200 111 "-" "FeedMe3.8.5(181)"
XXX - - [29/Jan/2019:15:00:48 +0000] "GET /api/greader.php/reader/api/0/user-info HTTP/1.1" 401 13 "-" "FeedMe3.8.5(181)"

What can I do to make it work again?
Thanks

[Alkarex]

Hello,
Did you try to log out and log in again in FeedMe?

[jackjackk]

Hi,
yes, and indeed in the first line of the log I do see my username (associated to a field named "email") and password (the one set specifically for API access). also not sure if relevant but if I go to "Configuration", "Profile" and click on the API link shown, I get: "Google Reader API configuration test: ❌ FAIL get HTTP Authorization header! Wrong Web server configuration."

[trustchk]

I got it to work by removing everything but the IfModule-Block for mod_rewrite from p/api/.htaccess. I couldn't get it to work with mod_setenvif, which is marked as essential and shouldn't be removed according to the output of a2dismod.
Setup: Apache2 2.4.25-3+deb9u6, PHP 1:7.0+49 on Debian Stretch

[jackjackk]

I'm running freshrss w/ the official docker. I tried with the following .htaccess:

/var/www/FreshRSS # ls -alh p/api/.htaccess 
-rw-r--r--    1 root     www-data     161 Jan 30 23:07 p/api/.htaccess
/var/www/FreshRSS # cat p/api/.htaccess
<IfModule !mod_setenvif.c>
    <IfModule mod_rewrite.c>
        RewriteEngine on
        RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    </IfModule>
</IfModule>

but I still get a

GET /api/greader.php/reader/api/0/user-info HTTP/1.1" 401 13

in the logs when I try to access with FeedMe. Does the .htaccess above look like yours, @trustchk ?
thanks

[Alkarex]

@jackjackk It does not seem to be the same problem for you than for @trustchk
If you use the official Docker image, the FreshRSS configuration should be good (I have just tested again with FeedMe). Please restore the original .htaccess (otherwise, you need to manually enable mod_rewrite). How do you expose this Docker image to the public network? Do you have a reverse proxy in front (Træfik, nginx, Apache...)?

[Alkarex]

@trustchk Thanks for the feedback. Could you please tell what PHP setup you have (mod_php or php-fpm or CGI...). And could you please provide the relevant part of ./data/users/_/log_api.txt when it does not work? (so I can see what HTTP headers are received)?

[mangenehm]

I encounter the same issue as @jackjackk after updating to 1.13.1 yesterday. FastCGI is used for the PHP setup according to my hoster. Strangely my logs don't show anything. The last entry in the API log is from January 15th. Which part of the log is relevant for you? Or is it safe to post the whole log? I'd be happy to help.

[jackjackk]

@Alkarex please find below the log_api.txt section relative to the failed authorization of FeedMe, as well as the bash code I use to start docker (collected in a makefile). The freshrss docker is running behind a reverse proxy.
https://gist.github.com/jackjackk/bc31b746425957bb73879e52afdc2c9a
Thanks for following up

[Alkarex]

@trustchk Could you please tell what PHP setup you have (mod_php or php-fpm or CGI...). And could you please provide the relevant part of ./data/users/_/log_api.txt when it does not work? (so I can see what HTTP headers are received)?

@jackjackk In your case, it looks like your reverse proxy changes the Authorization header to lower-case authorization (which is not a good practice), which is not accepted by FreshRSS (although it should - could you please open another issue for that problem?).

@mangenehm Hum, it is strange that you have nothing in the logs. Please check the write access rights in ./data/ and subfolders. You can also try with the previous version of ./p/api/.htaccess : https://github.com/FreshRSS/FreshRSS/blob/1.13.0/p/api/.htaccess

[Alkarex]

Could you please try https://github.com/FreshRSS/FreshRSS/pull/2235 ?

[knodderdachs]

Could you please try #2235 ?

That worked for me! Thanks!!

[trustchk]

Confirm, working! Thank you :)

[Alkarex]

Thanks for the quick feedback. Merged in the /dev branch. For Docker, freshrss/freshrss:dev should be updated as well.

[jackjackk]

Mine now works too, thanks a lot! very prompt and professional @Alkarex , kudos to you and your project! I see on your Docker page that you use a reverse proxy called "traefik", would you recommend that instead? Thanks again

[Alkarex]

@jackjackk Thanks for the kind words. I like Traefik for reverse proxying, in particular in front of Docker services. I like the ability to run it with one single command line, no reload needed when adding/removing services, elegant built-in automatic Let's Encrypt (including on-the-fly sub-domains and renewals), its Web admin UI, etc.
I dislike that it does not support fcgi (yet, work in progress). But some other reverse proxies have other merits.

[jackjackk]

Great thanks! I will consider it.