When clicking on either "forgot password" or "confirm account' links, a 404 Not Found

forgot password and confirm account links do not work about security_monkey HOT 1 CLOSED

mklatsky commented on May 16, 2024

forgot password and confirm account links do not work

from security_monkey.

Comments (1)

scriptsrc commented on May 16, 2024

Check to make sure your nginx config has routes setup for /reset and /confirm.

I believe the quickstart guide (http://securitymonkey.readthedocs.org/en/latest/quickstart1.html ) may not have these routes setup as it had confirmation and recover disabled in config-deploy.py

SECURITY_CONFIRMABLE = False
SECURITY_RECOVERABLE = False

You can add these routes like this:

location /reset {
    proxy_read_timeout 120;
    proxy_pass  http://127.0.0.1:5000;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_redirect off;
    proxy_buffering off;
    proxy_set_header        Host            $host;
    proxy_set_header        X-Real-IP       $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /confirm {
    proxy_read_timeout 120;
    proxy_pass  http://127.0.0.1:5000;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_redirect off;
    proxy_buffering off;
    proxy_set_header        Host            $host;
    proxy_set_header        X-Real-IP       $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
}

I've run into a separate issue where the URL's that Flask-Security emails out to reset your password or to confirm your account contain "http" links instead of "https", as Flask doesn't know that nginx is wrapping it in SSL. I don't yet have a good solution for this issue but it may be as easy as setting a wsgi environment variable somewhere.

from security_monkey.

Recommend Projects