starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #4137] [bug]: Can't use MICROSOFT auth in k8s installation #1483

New issue

Open

opened 2026-03-16 20:30:01 +03:00 by kerem · 6 comments

kerem commented

2026-03-16 20:30:01 +03:00

Owner

Originally created by @0xdnL on GitHub (Jun 20, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4137

Is there an existing issue for this?

I have searched the existing issues

Current behavior

When I try to login using MICROSOFT I get directed to /v1/auth/microsoft and get 404 page not found.
When I clear the clear cookies and site data then press Login and select Continue with Microsoft I get logged in.
The microsoft login page doesn't appear at all.

When I use a private/incognito session and press login I get redirected to the microsoft login page, fill in credentials get redirected back correctly being logged in.

similar issues:

Steps to reproduce

Self-Hosted on K8s

environment

ENABLE_SUBPATH_BASED_ACCESS: "true"
REDIRECT_URL: "https://hoppscotch.foo.bar"
WHITELISTED_ORIGINS: "https://hoppscotch.foo.bar,http://hoppscotch-backend:3170,http://hoppscotch-app:3000,http://hoppscotch-backend:3100,http://localhost:3000,http://localhost:3100,http://localhost:3170"
VITE_ALLOWED_AUTH_PROVIDERS: MICROSOFT,EMAIL
MICROSOFT_CALLBACK_URL: https://hoppscotch.foo.bar/v1/auth/microsoft/callback
MICROSOFT_SCOPE: "user.read"

VITE_BASE_URL:           https://hoppscotch.foo.bar          # http://localhost:3000
VITE_SHORTCODE_BASE_URL: https://hoppscotch.foo.bar          # http://localhost:3000
VITE_ADMIN_URL:          https://hoppscotch.foo.bar          # http://localhost:3100
VITE_BACKEND_GQL_URL:    https://hoppscotch.foo.bar/graphql  # http://localhost:3170/graphql
VITE_BACKEND_WS_URL:       wss://hoppscotch.foo.bar/graphql  #   ws://localhost:3170/graphql
VITE_BACKEND_API_URL:    https://hoppscotch.foo.bar/v1       # http://localhost:3170/v1

k8s manifests

hoppscotch-app and hoppscotch-admin are deployed similarly

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: hoppscotch-backend
    release: hoppscotch
  name: hoppscotch-backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hoppscotch-backend
      release: hoppscotch
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: hoppscotch-backend
        release: hoppscotch
    spec:
      containers:
      - name: hoppscotch-backend
        image: hoppscotch/hoppscotch-backend:2024.3.4
        envFrom:
        - configMapRef:
            name: hoppscotch-cm
        - secretRef:
            name: hoppscotch-aio-secret
        command: ["sh", "-c", "pnpm exec prisma migrate deploy && node /usr/src/app/packages/hoppscotch-backend/prod_run.mjs"]
        ports:
        - containerPort: 80
          name: http
---
apiVersion: v1
kind: Service
metadata:
  name: hoppscotch-backend
spec:
  type: ClusterIP
  selector:
    app: hoppscotch-backend
  ports:
  - port: 80
    name: http
    targetPort: http

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "https://hoppscotch.foo.bar"
spec:
  rules:
  - host: hoppscotch.foo.bar
    http:
      paths:
      - backend:
          service:
            name: hoppscotch-app
            port:
              number: 80
        path: /
        pathType: Prefix
      - backend:
          service:
            name: hoppscotch-admin
            port:
              number: 80
        path: /admin
        pathType: Prefix
      - backend:
          service:
            name: hoppscotch-backend
            port:
              number: 80
        path: /graphql
        pathType: Prefix
      - backend:
          service:
            name: hoppscotch-backend
            port:
              number: 80
        path: /v1
        pathType: Prefix

When I check the network in browser I can find this:

{
  "errors": [
    {
      "message": "auth/cookies_not_found",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "me"
      ],
      "extensions": {
        "code": "FORBIDDEN",
        "stacktrace": [
          "ForbiddenException: auth/cookies_not_found",
          "    at JwtStrategy.<anonymous> (/usr/src/app/packages/hoppscotch-backend/dist/auth/strategies/jwt.strategy.js:27:31)",
          "    at JwtStrategy._jwtFromRequest (/usr/src/app/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/extract_jwt.js:84:39)",
          "    at JwtStrategy.authenticate (/usr/src/app/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:93:22)",
          "    at attempt (/usr/src/app/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:369:16)",
          "    at authenticate (/usr/src/app/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:370:7)",
          "    at /usr/src/app/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_reflect-metadata@0.1.13_rxjs@7.6.0__passport@0.6.0/node_modules/@nestjs/passport/dist/auth.guard.js:88:3",
          "    at new Promise (<anonymous>)",
          "    at /usr/src/app/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_reflect-metadata@0.1.13_rxjs@7.6.0__passport@0.6.0/node_modules/@nestjs/passport/dist/auth.guard.js:80:83",
          "    at GqlAuthGuard.canActivate (/usr/src/app/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_reflect-metadata@0.1.13_rxjs@7.6.0__passport@0.6.0/node_modules/@nestjs/passport/dist/auth.guard.js:44:32)",
          "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
        ],
        "originalError": {
          "message": "auth/cookies_not_found",
          "error": "Forbidden",
          "statusCode": 403
        }
      }
    }
  ],
  "data": null
}

Environment

Production

Version

Self-hosted

Originally created by @0xdnL on GitHub (Jun 20, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4137 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior When I try to login using MICROSOFT I get directed to `/v1/auth/microsoft` and get 404 page not found. When I clear the clear cookies and site data then press Login and select Continue with Microsoft I get logged in. The microsoft login page doesn't appear at all. When I use a private/incognito session and press login I get redirected to the microsoft login page, fill in credentials get redirected back correctly being logged in. #### similar issues: - https://github.com/hoppscotch/hoppscotch/issues/3813 - https://github.com/hoppscotch/hoppscotch/issues/3349 ### Steps to reproduce 1. Self-Hosted on K8s environment ```sh ENABLE_SUBPATH_BASED_ACCESS: "true" REDIRECT_URL: "https://hoppscotch.foo.bar" WHITELISTED_ORIGINS: "https://hoppscotch.foo.bar,http://hoppscotch-backend:3170,http://hoppscotch-app:3000,http://hoppscotch-backend:3100,http://localhost:3000,http://localhost:3100,http://localhost:3170" VITE_ALLOWED_AUTH_PROVIDERS: MICROSOFT,EMAIL MICROSOFT_CALLBACK_URL: https://hoppscotch.foo.bar/v1/auth/microsoft/callback MICROSOFT_SCOPE: "user.read" VITE_BASE_URL: https://hoppscotch.foo.bar # http://localhost:3000 VITE_SHORTCODE_BASE_URL: https://hoppscotch.foo.bar # http://localhost:3000 VITE_ADMIN_URL: https://hoppscotch.foo.bar # http://localhost:3100 VITE_BACKEND_GQL_URL: https://hoppscotch.foo.bar/graphql # http://localhost:3170/graphql VITE_BACKEND_WS_URL: wss://hoppscotch.foo.bar/graphql # ws://localhost:3170/graphql VITE_BACKEND_API_URL: https://hoppscotch.foo.bar/v1 # http://localhost:3170/v1 ``` ### k8s manifests hoppscotch-app and hoppscotch-admin are deployed similarly ```yaml --- apiVersion: apps/v1 kind: Deployment metadata: labels: app: hoppscotch-backend release: hoppscotch name: hoppscotch-backend spec: replicas: 1 selector: matchLabels: app: hoppscotch-backend release: hoppscotch strategy: type: Recreate template: metadata: labels: app: hoppscotch-backend release: hoppscotch spec: containers: - name: hoppscotch-backend image: hoppscotch/hoppscotch-backend:2024.3.4 envFrom: - configMapRef: name: hoppscotch-cm - secretRef: name: hoppscotch-aio-secret command: ["sh", "-c", "pnpm exec prisma migrate deploy && node /usr/src/app/packages/hoppscotch-backend/prod_run.mjs"] ports: - containerPort: 80 name: http --- apiVersion: v1 kind: Service metadata: name: hoppscotch-backend spec: type: ClusterIP selector: app: hoppscotch-backend ports: - port: 80 name: http targetPort: http --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: kubernetes.io/tls-acme: "true" nginx.ingress.kubernetes.io/affinity: cookie nginx.ingress.kubernetes.io/enable-cors: "true" nginx.ingress.kubernetes.io/cors-allow-origin: "https://hoppscotch.foo.bar" spec: rules: - host: hoppscotch.foo.bar http: paths: - backend: service: name: hoppscotch-app port: number: 80 path: / pathType: Prefix - backend: service: name: hoppscotch-admin port: number: 80 path: /admin pathType: Prefix - backend: service: name: hoppscotch-backend port: number: 80 path: /graphql pathType: Prefix - backend: service: name: hoppscotch-backend port: number: 80 path: /v1 pathType: Prefix ``` When I check the network in browser I can find this: ```json { "errors": [ { "message": "auth/cookies_not_found", "locations": [ { "line": 2, "column": 3 } ], "path": [ "me" ], "extensions": { "code": "FORBIDDEN", "stacktrace": [ "ForbiddenException: auth/cookies_not_found", " at JwtStrategy.<anonymous> (/usr/src/app/packages/hoppscotch-backend/dist/auth/strategies/jwt.strategy.js:27:31)", " at JwtStrategy._jwtFromRequest (/usr/src/app/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/extract_jwt.js:84:39)", " at JwtStrategy.authenticate (/usr/src/app/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:93:22)", " at attempt (/usr/src/app/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:369:16)", " at authenticate (/usr/src/app/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:370:7)", " at /usr/src/app/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_reflect-metadata@0.1.13_rxjs@7.6.0__passport@0.6.0/node_modules/@nestjs/passport/dist/auth.guard.js:88:3", " at new Promise (<anonymous>)", " at /usr/src/app/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_reflect-metadata@0.1.13_rxjs@7.6.0__passport@0.6.0/node_modules/@nestjs/passport/dist/auth.guard.js:80:83", " at GqlAuthGuard.canActivate (/usr/src/app/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_reflect-metadata@0.1.13_rxjs@7.6.0__passport@0.6.0/node_modules/@nestjs/passport/dist/auth.guard.js:44:32)", " at process.processTicksAndRejections (node:internal/process/task_queues:95:5)" ], "originalError": { "message": "auth/cookies_not_found", "error": "Forbidden", "statusCode": 403 } } } ], "data": null } ``` ### Environment Production ### Version Self-hosted

kerem added the

bug

need testing

self-host

labels

2026-03-16 20:30:01 +03:00

kerem commented

2026-03-16 20:30:12 +03:00

Author

Owner

@Brainpitcher commented on GitHub (Jun 24, 2024):

Can you try to make ctrl + shift + R after getting 403 page?
I have the same problem with google auth and when i get 403 page after auth screen i just make this combinationg in chrome and it works and log me in

@Brainpitcher commented on GitHub (Jun 24, 2024): Can you try to make ctrl + shift + R after getting 403 page? I have the same problem with google auth and when i get 403 page after auth screen i just make this combinationg in chrome and it works and log me in

kerem commented

2026-03-16 20:30:17 +03:00

Author

Owner

@0xdnL commented on GitHub (Jun 25, 2024):

No, a page refresh does not work here. I need to explicitly clear cookies and site-data after 403 and then login redirects correctly and works.

@0xdnL commented on GitHub (Jun 25, 2024): No, a page refresh does not work here. I need to explicitly clear cookies and site-data after 403 and then login redirects correctly and works.

kerem commented

2026-03-16 20:30:22 +03:00

Author

Owner

@Brainpitcher commented on GitHub (Jun 25, 2024):

No, a page refresh does not work here. I need to explicitly clear cookies and site-data after 403 and then login redirects correctly and works.

i see, theese problems are the same i suppose. Did you try github auth? just in case it works without any troubles. I don not say that you must use, i just want to check that we have the same in different clusters

@Brainpitcher commented on GitHub (Jun 25, 2024): > No, a page refresh does not work here. I need to explicitly clear cookies and site-data after 403 and then login redirects correctly and works. i see, theese problems are the same i suppose. Did you try github auth? just in case it works without any troubles. I don not say that you must use, i just want to check that we have the same in different clusters

kerem commented

2026-03-16 20:30:27 +03:00

Author

Owner

@0xdnL commented on GitHub (Sep 12, 2024):

I've bumped the images and made changes (run prisma migrate, add DATA_ENCRYPTION_KEY). The issue remains.

image: hoppscotch/hoppscotch-backend:2024.8.2.   # path change to: /dist/backend/prod_run.mjs
image: hoppscotch/hoppscotch-frontend:2024.8.2
image: hoppscotch/hoppscotch-admin:2024.8.2

@0xdnL commented on GitHub (Sep 12, 2024): I've bumped the images and made changes (run prisma migrate, add DATA_ENCRYPTION_KEY). The issue remains. ```sh image: hoppscotch/hoppscotch-backend:2024.8.2. # path change to: /dist/backend/prod_run.mjs image: hoppscotch/hoppscotch-frontend:2024.8.2 image: hoppscotch/hoppscotch-admin:2024.8.2 ```

kerem commented

2026-03-16 20:30:32 +03:00

Author

Owner

@Brainpitcher commented on GitHub (May 12, 2025):

Any updates here with 2025?
My case with a callback service and a github auth does not work anymore in k8s

@Brainpitcher commented on GitHub (May 12, 2025): Any updates here with 2025? My case with a callback service and a github auth does not work anymore in k8s

kerem commented

2026-03-16 20:30:37 +03:00

Author

Owner

@g3Bg2 commented on GitHub (Jun 2, 2025):

There is a dedicated helm chat for easy setup on k8s.

https://github.com/hoppscotch/helm-charts

You can add Microsoft auth in value.yaml file.

@g3Bg2 commented on GitHub (Jun 2, 2025): There is a dedicated helm chat for easy setup on k8s. https://github.com/hoppscotch/helm-charts You can add Microsoft auth in value.yaml file.