Jetpack: Protect: Link fails in email sent to unlock site
Related to #8117
I had two reports of this this morning, in 831912-zen and 831859-zen.
In both cases, the users got the email to let them log in to their site. Upon clicking the login link, they got the following error:
{'error':'Bad Request','message':'Invalid input.'}
Note that 1 ticket was of a user that wasn't trusting REMOTE_ADDR, and the other was someone with many failed logins from their IP so they were blocked.
richardmtl
All 152 comments
cc @enejb
jeherve
on 6 Dec 2017
The user see {'error':'Bad Request','message':'Invalid input.'} message after the login link expires of if they type the wrong link. Retrying again would work out for them.
cc: @lezama Should we increase the duration of that token?
enejb
on 7 Dec 2017
How long is the duration of the token, @enejb ? I don't know how long these folks waited; I would guess not a long time but I don't know for a fact.
richardmtl
on 7 Dec 2017
The link is only valid for 5 minutes.
It also says so in the email that we send out to the user.
Clicking the link below will allow you to either attempt additional login attempts or change your password for your WordPress site for 5 minutes from the ip address %2$s.
As I understand things users are usually only blocked for 20 minutes. So having something that is super long is probably not very useful.
But in the case where the token is not valid any more that doesn't seem to be the case.
enejb
on 7 Dec 2017
As I understand things users are usually only blocked for 20 minutes. So having something that is super long is probably not very useful.
Actually, no. Users can be blocked for much longer, ESPECIALLY in cases where we are trusting the wrong header (which is the majority of cases when users get blocked); in those cases, blocks can be effectively indefinite (the block expires and then are blocked again almost immediately, and for longer). At least, that's how I understand it, so.. I think 5 minutes is not long enough. Especially when a user is frazzled and locked out and not sure what's going on, they might not go check their email right away.
richardmtl
on 7 Dec 2017
I updated the email link duration to 15 minutes.
Can you explain a bit more about the wrong header? What is the issue there?
enejb
on 8 Dec 2017
Can you explain a bit more about the wrong header? What is the issue there?
This should explain things a bit: PCYsg-8f0-p2
You can also look at 1257-gh-jpop-issues for some recent examples of this issue.
jeherve
on 8 Dec 2017
Thanks for the links.
It would be good to implement some sort of solution where we automatically set the IP address in a better way. I know it really depends on the configuration of the server.
But maybe we can automate this somehow. For example if we know the IP address of the servers and make a request to the jetpack server. We could use the known predefined array of possible keys and headers and then try to configure the IP address that matched the one that we expect.
cc: @samhotchkiss What do you think?
enejb
on 8 Dec 2017
Same problem here, unlock site link not working. I'm clicking within 5 minutes but still. I have to login to wordpress.com, go to settings, security, and disable protection, before logging in and activating protection again.
Adding my IP adress to the whitelist does not solve the issue.
merire111
on 14 Dec 2017
@merire111 Your site likely needs us to tweak a setting on our end. Can you contact us directly please?
richardmtl
on 14 Dec 2017
Same problem here too, unlock site link doesn't work. Not sure why this would be opt out and not opt in.
Jzatopa
on 15 Jan 2018
Same issue on 900393-zen
In here, the user wasn't trusting REMOTE_ADDR so I switched to it.
StefMattana
on 15 Jan 2018
Also reported in 899797-zen
The user wasn't trusting REMOTE_ADDR so I switched to it.
StefMattana
on 15 Jan 2018
@enejb It is my understanding that if the Headers that we are looking at are incorrect on our end, then the link won't work. I don't know what percentage of people who get blocked are blocked because they mistakenly enter the wrong password (and thus the link is useful for them), versus the people blocked because the headers we are trusting are wrong (and thus the link won't work for them). However, right now we are giving all the people with incorrect trusted headers "false hope" that they can get into their site by clicking the link we send them. I suppose there's no easy way to filter those out so we don't even send them a link and we just say "contact us please"?
richardmtl
on 15 Jan 2018
I think there might be a way to filter them out. Will look into this some more. Great suggestion!
enejb
on 15 Jan 2018
Also I think this should be fixed via the Jetpack UI somehow. Telling the user something is wrong and what they should do to fix it. (Contact support)
enejb
on 15 Jan 2018
Also I think this should be fixed via the Jetpack UI somehow. Telling the user something is wrong and what they should do to fix it. (Contact support)
cc: @samhotchkiss and @MichaelArestad :)
enejb
on 15 Jan 2018
More discussion at p7rcWF-HJ-p2
jeherve
on 16 Jan 2018
I got this request when trying to login. Had it sent to email. Got this:
{"error":"Bad Request","message":"Invalid input."}
And I did it all in minutes. So no timeout on the request. I'd say your plugin is broken.
vrocks
on 30 Jan 2018
@vrocks Could you contact us via this contact form and give us more details about your site? We'll help you get this fixed on your site.
Thanks!
jeherve
on 31 Jan 2018
979688-zen
joendotcom
on 26 Feb 2018
1065607-zen
tmmbecker
on 5 Apr 2018
As someone else stated, I also followed the link probably 2 minutes or less after receiving the link, and got the same error API response. This looks like a plugin issue.
chromechris
on 19 Apr 2018
@chromechris Could you contact us via this form, so we can take a look at your site with you and try to see if we can get this fixed?
Thank you.
jeherve
on 19 Apr 2018
@jeherve I have contacted support through the provided link. I hope there is a fix for this :( Thanks for the help.
chromechris
on 21 Apr 2018
I encountered this issue today. I bypassed it by disabling the Jetpack plugin manually using phpMyAdmin. I then could log into my site. I reenabled Jetpack in my site and turned off the "Brute force attack protection" feature. I have other security plugins installed so it was superfluous. I live in China and often use VPNs to access the web, changing IP regularly, so whitelisting all my IP addresses isn't practical.
42Rincewind
on 21 Apr 2018
1152270-zen
joendotcom
on 11 May 2018
@42Rincewind In your case, I suspect the VPN IPs were the ones getting blocked, but we could always verify it on our end if you send us your site's URL (and ideally, some or all of the IPs that were blocked) here: https://jetpack.com/contact-support/ Of course, since you turned off Protect, it's up to you if you want us to follow up on this! :)
richardmtl
on 11 May 2018
Also reported in 1162780-zen
chaselivingston
on 17 May 2018
221045-zen
tmmbecker
on 18 Jun 2018
1232562-zen
tmmbecker
on 20 Jun 2018
1238231-zen
chaselivingston
on 24 Jun 2018
1254295-zen
tmmbecker
on 2 Jul 2018
1261281-zen
ntpixels
on 8 Jul 2018
1269716-zen
jesscga
on 10 Jul 2018
1286665-zen
jesscga
on 18 Jul 2018
1289550-zen
tmmbecker
on 19 Jul 2018
1302552-zen
StefMattana
on 25 Jul 2018
1312971-zen
StefMattana
on 30 Jul 2018
1319911-zen
StefMattana
on 2 Aug 2018
1319950-zen
chaselivingston
on 2 Aug 2018
1322772-zen
StefMattana
on 3 Aug 2018
1325354-zen
chaselivingston
on 4 Aug 2018
1308737-zen
StefMattana
on 7 Aug 2018
1330881-zen
danjjohnson
on 7 Aug 2018
Also reported on https://wordpress.org/support/topic/jetpack-blocking-websites-ip/
StefMattana
on 8 Aug 2018
1333615-zen
StefMattana
on 8 Aug 2018
1341560-zen
tmmbecker
on 13 Aug 2018
1349711-zen
tmmbecker
on 15 Aug 2018
1355603-zen
coder-karen
on 19 Aug 2018
I have been experiencing this same issue. My IP in whatsmyip is showing another IP wherein the Jetpack has blocked another IP and blocked the access.
an email was sent to unblock to the verified user.
When I clicked on the link provided to login - it gave the same error
{'error':'Bad Request','message':'Invalid input.'}
It would be not good if I want the users to subscribe on the website and they will be blocked to login just because of this.
Can't we do something about that.
amy6147
on 19 Aug 2018
Hey @amy6147 ~ could you contact us through this form? Please include info about your sites, as well as the IP addresses that are blocked. We'll help take care of this for you. Do make sure to include more info, as your comment states that different IPs were blocked.
Thanks!
abidhahmed
on 20 Aug 2018
1374252-zen
joendotcom
on 27 Aug 2018
1381584-zen
coder-karen
on 30 Aug 2018
1381855-zen
joendotcom
on 30 Aug 2018
1382457-zen
csonnek
on 30 Aug 2018
1381037-zen
StefMattana
on 1 Sep 2018
1407858-zen
StefMattana
on 11 Sep 2018
Note: This issue has the detailed research on our private discussion p9dueE-mO-p2
htdat
on 11 Sep 2018
1410269-zen - Cloudflare
htdat
on 12 Sep 2018
Changing the priority on this one; while it is an annoying problem for someone getting blocked out of their site, it seems the issue only happens with mis-configured servers that report the wrong IP address in headers like HTTP_X_FORWARDED_FOR. We can fix it on our end by looking at the list of headers given by the server and only looking at the one that seems to report the right address.
If you run into issues like this on your own site, please contact support via this contact form and let us know your site URL; we will fix things for you.
I'll leave this issue opened as we may be able to circumvent some of those issues in the future by improving our IP detection process.
jeherve
on 13 Sep 2018
1442928-zen
htdat
on 26 Sep 2018
1492300-zen
tmmbecker
on 14 Oct 2018
1492369-zen
joendotcom
on 15 Oct 2018
1511591-zen
htdat
on 23 Oct 2018
1512522-zen
StefMattana
on 23 Oct 2018
supernovia
on 7 Nov 2018
supernovia
on 7 Nov 2018
1533692-zen
joendotcom
on 8 Nov 2018
1556889-zen
anaemnesis
on 10 Nov 2018
1567653-zen
brucea8c
on 15 Nov 2018
1578156-zen
StefMattana
on 19 Nov 2018
1581528-zen
StefMattana
on 20 Nov 2018
1583112-zen - Bluehost site
htdat
on 21 Nov 2018
1583373-zen
StefMattana
on 21 Nov 2018
1584262-zen
joendotcom
on 21 Nov 2018
1585183-zen
StefMattana
on 22 Nov 2018
1594387-zen
anaemnesis
on 25 Nov 2018
1594478-zen
anaemnesis
on 25 Nov 2018
1581800-zen
anaemnesis
on 25 Nov 2018
1592368-zen
anaemnesis
on 25 Nov 2018
1596242-zen
StefMattana
on 26 Nov 2018
1593064-zen
StefMattana
on 26 Nov 2018
1598045-zen
chaselivingston
on 26 Nov 2018
Given that we're already addressing the problems with Bluehost and EIG internally, I don't think there's value in adding those to this thread. As Jeremy mentioned above, we know that this is caused by a problem with the headers. If we can get those headers fixed, it will likely resolve this for many of these identified problems.
tmmbecker
on 26 Nov 2018
1597607-zen (not Bluehost, but unclear who the host is; seems like a reseller)
mzakariya
on 3 Dec 2018
There is another report of this error.
https://wordpress.org/support/topic/jetpack-has-locked-your-sites-login-page-6/#post-10975357
lizkarkoski
on 11 Dec 2018
I got this today when I tried to use cloudflare in front of my server, so I guess it's something to do with header stuff. I clicked the link within 30 seconds or so, so it's definitely not related to link expiry.
josephrocca
on 13 Dec 2018
@josephrocca Please contact us with your site's URL so we can take a look.
richardmtl
on 13 Dec 2018
1715467-zen
ntpixels
on 13 Jan 2019
1792502-zen
omkarscode
on 14 Feb 2019
I also have this issue on one of my sites that I still have this protection on. I've had the issue for over a year. Corresponding with Jetpack support, they just pointed me to this thread to track progress. Looks like not much progress has been made in a year.
joshuasosa
on 15 Feb 2019
@Prizem We should be able to fix the underlying issue with your site(s); can you share a ticket number of your correspondence with us, so I can take a look?
richardmtl
on 15 Feb 2019
@Prizem We should be able to fix the underlying issue with your site(s); can you share a ticket number of your correspondence with us, so I can take a look?
Sure! Looks like tickets 1792502 and 1657826.
joshuasosa
on 16 Feb 2019
1835534-zen
StefMattana
on 27 Feb 2019
1846906
tmmbecker
on 6 Mar 2019
1857517-zen
RCowles
on 6 Mar 2019
1865106-zen
StefMattana
on 9 Mar 2019
1876781-zen
ntpixels
on 14 Mar 2019
1880282-zen
RCowles
on 15 Mar 2019
1889229-zen
tmmbecker
on 18 Mar 2019
KokkieH
on 19 Mar 2019
KokkieH
on 20 Mar 2019
Same problem here (on both the QA and production instances of my site).
immersiontravis
on 20 Mar 2019
1895167-zen
danjjohnson
on 21 Mar 2019
@immersiontravis We can fix it for you if you contact us with your site URLs: https://jetpack.com/contact-support/
richardmtl
on 21 Mar 2019
1897156-zen
danjjohnson
on 21 Mar 2019
1901568-zen
anaemnesis
on 23 Mar 2019
1906075-zen
StefMattana
on 25 Mar 2019
1907329-zen
coder-karen
on 25 Mar 2019
1908207-zen
ntpixels
on 25 Mar 2019
1910888-zen
brucea8c
on 26 Mar 2019
1912884-zen
coder-karen
on 27 Mar 2019
1907046-zen
danjjohnson
on 28 Mar 2019
1912666-zen
coder-karen
on 28 Mar 2019
1915822-zen
RCowles
on 28 Mar 2019
1916497-zen
RCowles
on 28 Mar 2019
1916606-zen
RCowles
on 28 Mar 2019
1917036-zen
coder-karen
on 29 Mar 2019
1917292-zen
coder-karen
on 29 Mar 2019
1917065-zen
StefMattana
on 29 Mar 2019
1917022-zen
danjjohnson
on 29 Mar 2019
1917435-zen
coder-karen
on 29 Mar 2019
1917552-zen
danjjohnson
on 29 Mar 2019
1917897-zen
brucea8c
on 29 Mar 2019
1919171-zen
anaemnesis
on 30 Mar 2019
1920016-zen
anaemnesis
on 30 Mar 2019
1920148-zen
anaemnesis
on 30 Mar 2019
1921777-zen
anaemnesis
on 31 Mar 2019
1913219-zen
coder-karen
on 1 Apr 2019
1930569-zen
coder-karen
on 2 Apr 2019
1930890-zen
StefMattana
on 2 Apr 2019
1930846-zen
coder-karen
on 2 Apr 2019
1930986-zen
tmmbecker
on 2 Apr 2019
1917068-zen
StefMattana
on 2 Apr 2019
1932985-zen
RCowles
on 3 Apr 2019
1933178-zen
RCowles
on 3 Apr 2019
1933764-zen
StefMattana
on 3 Apr 2019
1934432-zen
coder-karen
on 3 Apr 2019
1935157-zen
RCowles
on 3 Apr 2019
1936537-zen
StefMattana
on 4 Apr 2019
193691 5-zen
coder-karen
on 4 Apr 2019
1940634-zen
RCowles
on 5 Apr 2019
r190045-wpcom improves the e-mail's handling and should resolve some (if not all) of these issues. Leaving the issue open until Happiness confirms.
kraftbj
on 5 Apr 2019
Woot woot! Thanks :)
supernovia
on 5 Apr 2019
1946446-zen
anaemnesis
on 8 Apr 2019
From checking with Happiness, we've had no new recent reports so I am marking as resolved.
kraftbj
on 17 Apr 2019
鉂わ笍
lezama
on 17 Apr 2019
Ticket: 2043791-zen
Blog ID: 132029627
Jetpack: 7.3.1
Nameserver: Hostgator
@kraftbj - can you check this case? Also, should I open a new ticket for this or continue here?
htdat
on 20 May 2019
Ticket: 2071681-zen @jeherve since Kraft is AFK can you assign someone to own this possibly?
bikedorkjon
on 30 May 2019
@bikedorkjon This seemed to be a problem with the server configuration; it is now fixed within the Protect API settings for that site.
jeherve
on 31 May 2019
They responded that things were fine, just forgot to close this.
bikedorkjon
on 10 Jun 2019
Related issues
NicktheGeek
路
3Comments
beaulebens
路
3Comments
MichaelArestad
路
3Comments
jeherve
路
3Comments
aheckler
路
3Comments
Most helpful comment
r190045-wpcom improves the e-mail's handling and should resolve some (if not all) of these issues. Leaving the issue open until Happiness confirms.