oidc: Cross-site POST form submissions are forbidden #64
Description
Describe the bug
I am trying to configure dashbrr to use pocket-id hosted in the same kubernetes cluster for OIDC auth. Both pocket-id and dashbrr are behind an ingress proxy that handles https termination and load-balancing.
OIDC_ISSUER is set to the https URL of pocket-id (https://pid.example.com) and OIDC_REDIRECT_URL is set to the dashbrr callback URL (https://dashbrr.example.com/api/auth/callback). There is a dashbrr app in pocket-id and OIDC_CLIENT_ID and OIDC_CLIENT_SECRET are set to the correct values.
When I try the flow, after I login from pocket-id and it redirects my browser to dashbrr, I see this error in the dashbrr log:
│ 3:26PM ERROR code exchange failed error="oauth2: cannot fetch token: 403 Forbidden\nResponse: Cross-site POST form submissions are forbidden"
To Reproduce
Steps to reproduce the behavior:
- Deploy an OIDC provider and dashbrr behind an https proxy
- Configure an app in the OIDC for dashbrr and configure dashbrr.
- Configure dashbrr to use that provider.
- See error
Expected behavior
OIDC login should work.
Desktop (please complete the following information):
Operating System: Arch Linux
KDE Plasma Version: 6.2.3
KDE Frameworks Version: 6.8.0
Qt Version: 6.8.0
Kernel Version: 6.12.1-2-cachyos (64-bit)
Graphics Platform: Wayland
Processors: 32 × AMD Ryzen 9 7950X3D 16-Core Processor
Memory: 62.4 GiB of RAM
Graphics Processor: NVIDIA GeForce RTX 4090/PCIe/SSE2
Manufacturer: ASUS
Google Chrome 131.0.6778.85 (Official Build) (64-bit)
Revision 3d81e41b6f3ac8bcae63b32e8145c9eb0cd60a2d-refs/branch-heads/6778@{#2285}
OS Linux
JavaScript V8 13.1.201.9
User Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36