-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Web UI only works on leader server #3697
Comments
We've ran into the same issue. Interestingly enough, injecting a proper P.S.: We didn't modify the |
I can confirm, that ui works fine when anonymous user is allowed to read everything . |
Fixes #3697 The existing code and test case only covered the leader behavior. When querying against non-leaders the error has an "rpc error: " prefix. To provide consistency in HTTP error response I also strip the "rpc error: " prefix for 403 responses as they offer no beneficial additional information (and in theory disclose a tiny bit of data to unauthorized users, but it would be a pretty weird bit of data to use in a malicious way).
Fixes #3697 The existing code and test case only covered the leader behavior. When querying against non-leaders the error has an "rpc error: " prefix. To provide consistency in HTTP error response I also strip the "rpc error: " prefix for 403 responses as they offer no beneficial additional information (and in theory disclose a tiny bit of data to unauthorized users, but it would be a pretty weird bit of data to use in a malicious way).
Thanks for the bug report @hynek! PR is up and will be in the next release. No easy workaround in the meantime unfortunately. |
Fixes #3697 The existing code and test case only covered the leader behavior. When querying against non-leaders the error has an "rpc error: " prefix. To provide consistency in HTTP error response I also strip the "rpc error: " prefix for 403 responses as they offer no beneficial additional information (and in theory disclose a tiny bit of data to unauthorized users, but it would be a pretty weird bit of data to use in a malicious way).
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad version
Nomad v0.7.1 (0b295d399d00199cfab4621566babd25987ba06e)
Operating system and Environment details
Ubuntu Xenial on AMD64.
Issue
I’m using ACLs.
I’m trying to access the Web UI but on every server and client except for the leader, the UI flashes shortly and then I get a
error message before being able to enter a token. I’ve tried Safari, Chrome, and Firefox.
The browser console looks like this:
The only relevant log messages on the server side is these two:
It’s unfortunate because I would like to use https://nomad.service.consul:4646 as the canonical URL (AFAIK, it’s impossible to determine the leader using a tag like with Vault?).
Interestingly, the API works just fine – I’m not getting any errors when using the nomad CLI client with
NOMAD_ADDR
set to https://nomad.service.consul:4646Is this behaviour intended or documented? I don’t seem to be able to find anything on Google or GitHub which is deeply confusing me.
FTR, a successful request looks like this:
![nomad 2017-12-28 19-52-59](https://user-images.githubusercontent.com/41240/34420253-dca945a6-ec08-11e7-9992-3855f58e3584.png)
in the browser.
Reproduction steps
The text was updated successfully, but these errors were encountered: