[GH-ISSUE #112] login/imap auth fails with false-positive javascript enabled error

kerem commented

2026-02-25 21:34:07 +03:00

Owner

Originally created by @donpdonp on GitHub (Aug 27, 2016).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/112

Originally assigned to: @jasonmunro on GitHub.

first time setup for cypht. using imap login. enter user/pass.

POST happens with password (using firefox inspector), result is 303 with header of Location redirecting back to the same page. Not sure whats happening here.

php_errors.log shows
(
[0] => Using Hm_PHP_Session with Hm_Auth_IMAP
[1] => Using file based user configuration
[2] => Using sapi: fpm-fcgi
[3] => Request type: HTTP
[4] => Request path: /cypht/
[5] => TLS request: 0
[6] => Mobile request: 0
[7] => Page ID: home
[8] => TRANSLATION NOT FOUND :Cypht:
[9] => TRANSLATION NOT FOUND :You Need to have Javascript enabled to use Cypht, sorry about tha
t!:
[10] => PHP version 5.6.24-0+deb8u1
[11] => Zend version 2.6.0
[12] => Peak Memory: 3584
[13] => PID: 4511
[14] => Included files: 76
)

Originally created by @donpdonp on GitHub (Aug 27, 2016). Original GitHub issue: https://github.com/cypht-org/cypht/issues/112 Originally assigned to: @jasonmunro on GitHub. first time setup for cypht. using imap login. enter user/pass. POST happens with password (using firefox inspector), result is 303 with header of Location redirecting back to the same page. Not sure whats happening here. php_errors.log shows ( [0] => Using Hm_PHP_Session with Hm_Auth_IMAP [1] => Using file based user configuration [2] => Using sapi: fpm-fcgi [3] => Request type: HTTP [4] => Request path: /cypht/ [5] => TLS request: 0 [6] => Mobile request: 0 [7] => Page ID: home [8] => TRANSLATION NOT FOUND :Cypht: [9] => TRANSLATION NOT FOUND :You Need to have Javascript enabled to use Cypht, sorry about tha t!: [10] => PHP version 5.6.24-0+deb8u1 [11] => Zend version 2.6.0 [12] => Peak Memory: 3584 [13] => PID: 4511 [14] => Included files: 76 )

kerem

2026-02-25 21:34:07 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Aug 30, 2016):

Sorry, I would have replied sooner but I just noticed this! The javascript message is because I did not properly setup that string for translation (I need to add a number of phrases to the translation files), and is not related to any login issue. Cypht does a 303 redirect after any form submission (prevents reload from re-submitting a post form), so this is normal behavior regardless of whether or not the login was successful.

There should be 2 of these debug messages, the one for the POST form, and then this one after the redirect. Could you post both? Also, do you see any message in the browser? Like "username or password incorrect"? Or does it just reload the login page with no message?

You can also try the following debug:
https://gist.github.com/jasonmunro/b3a00e6429102a302dfaab7b0bb02f1b

This will output the IMAP conversation when you try to login and could provide a clue as to the problem (EDIT: this output is also in the PHP error log). Thanks for the feedback!

@jasonmunro commented on GitHub (Aug 30, 2016): Sorry, I would have replied sooner but I just noticed this! The javascript message is because I did not properly setup that string for translation (I need to add a number of phrases to the translation files), and is not related to any login issue. Cypht does a 303 redirect after any form submission (prevents reload from re-submitting a post form), so this is normal behavior regardless of whether or not the login was successful. There should be 2 of these debug messages, the one for the POST form, and then this one after the redirect. Could you post both? Also, do you see any message in the browser? Like "username or password incorrect"? Or does it just reload the login page with no message? You can also try the following debug: https://gist.github.com/jasonmunro/b3a00e6429102a302dfaab7b0bb02f1b This will output the IMAP conversation when you try to login and could provide a clue as to the problem (EDIT: this output is also in the PHP error log). Thanks for the feedback!

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Aug 30, 2016):

Just as a note, Cypht does not use a standard login page. Every page is a login page if you are not logged in :) It's kind of weird but simplifies the ability to go directly to a page without a "next page after login" redirect type of thing.

@jasonmunro commented on GitHub (Aug 30, 2016): Just as a note, Cypht does not use a standard login page. Every page is a login page if you are not logged in :) It's kind of weird but simplifies the ability to go directly to a page without a "next page after login" redirect type of thing.

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Aug 30, 2016):

No need for the gist I posted above, I added IMAP and POP3 debug output to failed logins when running Cypht in debug mode, so you should get a better idea about what is going on (fixed some missing translation strings too!).

@jasonmunro commented on GitHub (Aug 30, 2016): No need for the gist I posted above, I added IMAP and POP3 debug output to failed logins when running Cypht in debug mode, so you should get a better idea about what is going on (fixed some missing translation strings too!).

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 1, 2016):

thx, how can I enable debug mode? i dont see a setting for it in hm3.ini

@donpdonp commented on GitHub (Sep 1, 2016): thx, how can I enable debug mode? i dont see a setting for it in hm3.ini

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 1, 2016):

oh found it after more digging. its already set to true

define('DEBUG_MODE', true);

where would I look for the output?

@donpdonp commented on GitHub (Sep 1, 2016): oh found it after more digging. its already set to true `define('DEBUG_MODE', true);` where would I look for the output?

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

The debug mode stuff is a bit confusing, let me clarify:

when you run the config_gen script, a production site is created under the site/ sub-directory. Accessing CYpht there means you are in production mode. Accessing Cypht using the main download directory means you are in debug mode.

The extended debug info I added will be output to the php error log, just like the debug information you included in the OP.

@jasonmunro commented on GitHub (Sep 1, 2016): The debug mode stuff is a bit confusing, let me clarify: when you run the config_gen script, a production site is created under the site/ sub-directory. Accessing CYpht there means you are in production mode. Accessing Cypht using the main download directory means you are in debug mode. The extended debug info I added will be output to the php error log, just like the debug information you included in the OP.

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 1, 2016):

I started to switch from the release tarball to the git repo to use the imap changes, but I had to kill the git clone after 256MB of data downloaded and only 40% done. whats in that repo?? I'm using a raspberryPi with not much storage.

@donpdonp commented on GitHub (Sep 1, 2016): I started to switch from the release tarball to the git repo to use the imap changes, but I had to kill the git clone after 256MB of data downloaded and only 40% done. whats in that repo?? I'm using a raspberryPi with not much storage.

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

sorry about that, I package the documentation for the Cypht website in the repo. It's auto-generated from code using apigen and it creates large changesets in git every time I updated it, which is pretty frequently (currently my .git folder is 605M. Yikes!). I need to split this out into it's own repo and see if I can truncate the history.

@jasonmunro commented on GitHub (Sep 1, 2016): sorry about that, I package the documentation for the Cypht website in the repo. It's auto-generated from code using apigen and it creates large changesets in git every time I updated it, which is pretty frequently (currently my .git folder is 605M. Yikes!). I need to split this out into it's own repo and see if I can truncate the history.

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 1, 2016):

thanks for the /site/ tip, i was using the root folder anyways. git clone --depth 1 did the trick. thanks for the help so far!

@donpdonp commented on GitHub (Sep 1, 2016): thanks for the /site/ tip, i was using the root folder anyways. git clone --depth 1 did the trick. thanks for the help so far!

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

Looks like github supports splitting out a subdir and creating a new repo from it. Looking into that now.

Be advised, that debug mode (the root folder) should only be used to troubleshoot problems or do development. Once we resolve the IMAP auth issue, you should switch to the site/ subdir.

@jasonmunro commented on GitHub (Sep 1, 2016): Looks like github supports splitting out a subdir and creating a new repo from it. Looking into that now. Be advised, that debug mode (the root folder) should only be used to troubleshoot problems or do development. Once we resolve the IMAP auth issue, you should switch to the site/ subdir.

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 1, 2016):

i can see the imap3 conversation. the login is denied but I dont know why. I'm using a command line imap tool to validate the email and password for the login. My only guess is the kind of login, i understand imap3 supports multiple kinds of encryption, etc.

    [0] => Array
        (
            [0] => * OK [ CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN AUTH=LOGIN ] Dovecot ready.
            [1] => * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS AUTH=PLAIN AUTH=LOGIN
            [2] => A1 OK Capability completed.
        )

    [1] => Array
        (
            [0] => A2 NO [ AUTHENTICATIONFAILED ] Authentication failed.
        )

@donpdonp commented on GitHub (Sep 1, 2016): i can see the imap3 conversation. the login is denied but I dont know why. I'm using a command line imap tool to validate the email and password for the login. My only guess is the kind of login, i understand imap3 supports multiple kinds of encryption, etc. ``` [0] => Array ( [0] => * OK [ CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN AUTH=LOGIN ] Dovecot ready. [1] => * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS AUTH=PLAIN AUTH=LOGIN [2] => A1 OK Capability completed. ) [1] => Array ( [0] => A2 NO [ AUTHENTICATIONFAILED ] Authentication failed. ) ```

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

well that output is less helpful than I hoped :) Anything in the dovecot logs when the login fails that might provide a clue?

@jasonmunro commented on GitHub (Sep 1, 2016): well that output is less helpful than I hoped :) Anything in the dovecot logs when the login fails that might provide a clue?

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

Walking through the code here, I see that Cypht is probably just using the AUTH=LOGIN method. We could dump the final login command to the log before it's sent to the IMAP server (it will contain a password) to see if something is breaking when we prep the credentials. I will whip up a gist for this.

@jasonmunro commented on GitHub (Sep 1, 2016): Walking through the code here, I see that Cypht is probably just using the AUTH=LOGIN method. We could dump the final login command to the log before it's sent to the IMAP server (it will contain a password) to see if something is breaking when we prep the credentials. I will whip up a gist for this.

kerem commented

2026-02-25 21:34:07 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

my only other guess here is that dovecot is treating the Cypht login differently from the CLI login in some way, but darn if I know how. The capability response in your debug output clearly shows standard login is accepted. Weird!

@jasonmunro commented on GitHub (Sep 1, 2016): my only other guess here is that dovecot is treating the Cypht login differently from the CLI login in some way, but darn if I know how. The capability response in your debug output clearly shows standard login is accepted. Weird!

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

Also, I switched my test environment to IMAP auth just to make sure I did not recently introduce a bug. Works as expected for me :/

@jasonmunro commented on GitHub (Sep 1, 2016): Also, I switched my test environment to IMAP auth just to make sure I did not recently introduce a bug. Works as expected for me :/

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

I split out the docs and website code into their own repos. A git clone now totals 12MB :)

@jasonmunro commented on GitHub (Sep 1, 2016): I split out the docs and website code into their own repos. A git clone now totals 12MB :)

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 1, 2016):

The following will send the exact login command sent to the IMAP server to the PHP error log. IT INCLUDES THE PASSWORD, so don't leave this in there after you check the results!

https://gist.github.com/jasonmunro/0993e7c3e123a605acd37c7ff6bd75dd

@jasonmunro commented on GitHub (Sep 1, 2016): The following will send the exact login command sent to the IMAP server to the PHP error log. IT INCLUDES THE PASSWORD, so don't leave this in there after you check the results! https://gist.github.com/jasonmunro/0993e7c3e123a605acd37c7ff6bd75dd

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 2, 2016):

I get the login log entry. the user and pass look right but now i dont get the imap conversation output at all. like its not trying to use the username . gasp.
[02-Sep-2016 03:49:37 UTC] string: LOGIN "donp" "password-here"

I am suddenly realizing my ssl cert expired just recently, that might be the source of the error. i'll look into it tomorrow.

@donpdonp commented on GitHub (Sep 2, 2016): I get the login log entry. the user and pass look right but now i dont get the imap conversation output at all. like its not trying to use the username . gasp. [02-Sep-2016 03:49:37 UTC] string: LOGIN "donp" "password-here" I am suddenly realizing my ssl cert expired just recently, that might be the source of the error. i'll look into it tomorrow.

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 2, 2016):

I renewed the ssl cert that dovecot is using. made sure the hostname in cypht config matches the common name/cn in the ssl cert. restarted dovecot (and nginx for good measure). Running out of cypht repo with last commit of 'Wed Aug 31 19:08:39 2016'.

Cypht login still fails, and the php_error log does not show the imap conversation though debug is on. The elog($login) is showing the correct name and pass.

dovecot log isnt too helpful. failed cypht login is below:

Sep  2 12:38:33 fiizb dovecot: imap-login: Login: user=<donp>, method=PLAIN, rip=67.5.198.112, lip=64.62.134.XXX, TLS
Sep  2 12:38:33 fiizb dovecot: IMAP(donp): Connection closed bytes=15/585

successful login via my cell phone imap client looks very similar

Sep  2 12:46:04 fiizb dovecot: imap-login: Login: user=<donp>, method=PLAIN, rip=66.87.112.99, lip=64.62.134.XXX, TLS

(no connection closed msg because auth succeeded)

also https://cypht.org/install.html has a small typo, the directory should read /scripts/
sudo php ./script/config_gen.php

@donpdonp commented on GitHub (Sep 2, 2016): I renewed the ssl cert that dovecot is using. made sure the hostname in cypht config matches the common name/cn in the ssl cert. restarted dovecot (and nginx for good measure). Running out of cypht repo with last commit of 'Wed Aug 31 19:08:39 2016'. Cypht login still fails, and the php_error log does not show the imap conversation though debug is on. The elog($login) is showing the correct name and pass. dovecot log isnt too helpful. failed cypht login is below: ``` Sep 2 12:38:33 fiizb dovecot: imap-login: Login: user=<donp>, method=PLAIN, rip=67.5.198.112, lip=64.62.134.XXX, TLS Sep 2 12:38:33 fiizb dovecot: IMAP(donp): Connection closed bytes=15/585 ``` successful login via my cell phone imap client looks very similar ``` Sep 2 12:46:04 fiizb dovecot: imap-login: Login: user=<donp>, method=PLAIN, rip=66.87.112.99, lip=64.62.134.XXX, TLS ``` (no connection closed msg because auth succeeded) also https://cypht.org/install.html has a small typo, the directory should read /scripts/ `sudo php ./script/config_gen.php`

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 2, 2016):

I think the auth is working here (the IMAP debug is only output on failed auths, and the dovecot log entry suggests you were authenticated), so maybe it's a cookie related issue. Cypht uses the hostname in the request to generate the session cookie that keeps you logged in, it's possible a mismatch is happening (I have seen this with nginx before). You can force the cookie domain with the "cookie_domain" setting in the ini file to override the automatic one. It should be set to whatever hostname you are using to access the site.

Thanks for sticking with the process, it's very helpful to get feedback about different environments!

@jasonmunro commented on GitHub (Sep 2, 2016): I think the auth is working here (the IMAP debug is only output on failed auths, and the dovecot log entry suggests you were authenticated), so maybe it's a cookie related issue. Cypht uses the hostname in the request to generate the session cookie that keeps you logged in, it's possible a mismatch is happening (I have seen this with nginx before). You can force the cookie domain with the "cookie_domain" setting in the ini file to override the automatic one. It should be set to whatever hostname you are using to access the site. Thanks for sticking with the process, it's very helpful to get feedback about different environments!

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 2, 2016):

Is there something in cypht that is redirecting to https? I just turned on https for my site and I can login now! If I load cypht over http, I get the same login, submit, login loop as before

@donpdonp commented on GitHub (Sep 2, 2016): Is there something in cypht that is redirecting to https? I just turned on https for my site and I can login now! If I load cypht over http, I get the same login, submit, login loop as before

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 3, 2016):

So sorry, there is an ini setting that forces browsers to redirect to https. I put this in place as a "secure by default" type of thing, but this isn't the first time it's caused problems. I'm reconsidering my decision :) If nothing else, I will add a debug message when this happens. I'm also thinking I might create debug "groups" to prioritize messages to make it easier to pick out significant issues.

@jasonmunro commented on GitHub (Sep 3, 2016): So sorry, there is an ini setting that forces browsers to redirect to https. I put this in place as a "secure by default" type of thing, but this isn't the first time it's caused problems. I'm reconsidering my decision :) If nothing else, I will add a debug message when this happens. I'm also thinking I might create debug "groups" to prioritize messages to make it easier to pick out significant issues.

kerem commented

2026-02-25 21:34:08 +03:00

Author

Owner

@donpdonp commented on GitHub (Sep 5, 2016):

ah okay, a debug msg would be great! thanks again for all the help.

@donpdonp commented on GitHub (Sep 5, 2016): ah okay, a debug msg would be great! thanks again for all the help.

Rows
Columns

[GH-ISSUE #112] login/imap auth fails with false-positive javascript enabled error #93