Clever Geek Handbook

Installing Piwik with nginx + varnish + memcached = can't login?

I moved my piwik installation from apache server to nginx using varnish and memcached. I'm not sure when, but at some point it stopped allowing me to log in, giving an error:

Error: Form security failed. Reload the form and make sure your cookies are enabled. If you are using a proxy server, you must configure Piwik to accept the proxy header, which forwards the Host header. Also check that the Referrer header is sent correctly.

I'm not sure what the problem is because it worked for a while until I logged out. I'm not sure at what point it stopped, but I installed memcached later, I suppose.

I tried to put:

proxy_client_headers[] = HTTP_X_FORWARDED_FOR
proxy_host_headers[] = HTTP_X_FORWARDED_HOST

In piwik configuration, it didn't help.

In the configuration with varnish, I put under vcl_recv:

if (req.url ~ "piwik" { 
set req.http.X-Forwarded-For = client.ip; 
return (pass); 
}

It didn't help either.

I'm here. Does anyone know what might be wrong in my configuration or how can I figure it out? I tried putting "return (pass)" at the top of the vcl_recv (assuming this will basically disable all varnish caching) and it didn't help. Is there a way to debug the beer to figure out what the problem might be? Thank you!

UPDATE: After a lot of headache I realized that this is indeed a case of varnishing the pivot caching in an inappropriate way. I couldn't come up with a working solution (I tried the solutions suggested here).

Ultimately, My solution: I made varnish listening on port 80, but piwik instead listens on port 85 with nginx, bypassing varnish entirely . Everything works 100% again! This is obviously not the most ideal solution, but it works, and it saves me frustration that should be spent elsewhere. Thanks everyone for the help.

+3


source to share


2 answers


I'm not sure about this, but Form security failed

suggested to me that maybe Varnish was caching the login page. And I think there is a CSRF token (unique identifier) ​​in the login form that changes every time.



So maybe because of the cache, the CSRF token is always the same as when trying to login. Could you tweak Varnish so that the login form isn't cached?

0


source


You have to bypass varnish when using piwik

sub vcl_recv {

        if (req.url ~ "^/piwik(.*)")  {
        return(pass);
        }
}


if a subdomain is used

sub vcl_recv {
    if (req.http.Host == "piwik.domain.com") {
    return (pipe);
    }
}
0


source






More articles:


All Articles