starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #4184] [bug]: Self Host. Can not Login with Email. Clicked Magic link but 401 #1510

New issue

Closed

opened 2026-03-16 20:38:21 +03:00 by kerem · 11 comments

kerem commented

2026-03-16 20:38:21 +03:00

Owner

Originally created by @lfift on GitHub (Jul 13, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4184

Originally assigned to: @mirarifhasan on GitHub.

Is there an existing issue for this?

I have searched the existing issues

Current behavior

version: 2024.6.0
When I log in via email, the page prompts a 401 code after clicking the received MagicLink.
I'm using a self-signed SSL certificate

Steps to reproduce

1.Click to Login
2.Enter Email Address
3.Click Magic link
4.The page displays 401 and the browser console displays that there is a problem with the SSL certificate. Can't I use a self-signed certificate?

Environment

Deploy preview

Version

Self-hosted

Originally created by @lfift on GitHub (Jul 13, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4184 Originally assigned to: @mirarifhasan on GitHub. ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior version: 2024.6.0 When I log in via email, the page prompts a 401 code after clicking the received MagicLink. I'm using a self-signed SSL certificate ![image](https://github.com/user-attachments/assets/7038bbfb-61c5-4f9a-87d6-090b575d1ad5) ![image](https://github.com/user-attachments/assets/3c689584-9bde-435f-af14-d88d4a248673) ### Steps to reproduce 1.Click to Login 2.Enter Email Address 3.Click Magic link 4.The page displays 401 and the browser console displays that there is a problem with the SSL certificate. Can't I use a self-signed certificate? ### Environment Deploy preview ### Version Self-hosted

kerem

2026-03-16 20:38:21 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 20:38:37 +03:00

Author

Owner

@lfift commented on GitHub (Jul 17, 2024):

using AIO container

@lfift commented on GitHub (Jul 17, 2024): using AIO container

kerem commented

2026-03-16 20:38:43 +03:00

Author

Owner

@nayelimdejesus commented on GitHub (Aug 6, 2024):

I would like to work on this issue.

@nayelimdejesus commented on GitHub (Aug 6, 2024): I would like to work on this issue.

kerem commented

2026-03-16 20:38:48 +03:00

Author

Owner

@ngoc-minh-do commented on GitHub (Jul 18, 2025):

I have the same issue using AIO container

@ngoc-minh-do commented on GitHub (Jul 18, 2025): I have the same issue using AIO container

kerem commented

2026-03-16 20:38:53 +03:00

Author

Owner

@faritor commented on GitHub (Jul 21, 2025):

use AIO image

i discovered the problem through the console of the browser. I use the http protocol, When requesting the interface of :3170/v1/auth/verify, the returned http status code was401. post request body parameters format is {"token":"*****","deviceIdentifier":"*****"}

how should I solve this problem

@faritor commented on GitHub (Jul 21, 2025): use AIO image i discovered the problem through the console of the browser. I use the http protocol, When requesting the interface of `:3170/v1/auth/verify`, the returned http status code was`401`. `post` request body parameters format is `{"token":"*****","deviceIdentifier":"*****"}` how should I solve this problem

kerem commented

2026-03-16 20:38:58 +03:00

Author

Owner

@mirarifhasan commented on GitHub (Jul 22, 2025):

Hey @faritor —
Could you let us know if increasing the MAGIC_LINK_TOKEN_VALIDITY resolved the 401 error on your end?

@ngoc-minh-do —
Would you mind sharing more detailed steps or context so we can try to reproduce the issue locally?

@lfift
Is this issue still occurring for you, or has it been resolved?

@mirarifhasan commented on GitHub (Jul 22, 2025): Hey @faritor — Could you let us know if increasing the `MAGIC_LINK_TOKEN_VALIDITY` resolved the `401` error on your end? @ngoc-minh-do — Would you mind sharing more detailed steps or context so we can try to reproduce the issue locally? @lfift Is this issue still occurring for you, or has it been resolved?

kerem commented

2026-03-16 20:39:03 +03:00

Author

Owner

@faritor commented on GitHub (Jul 23, 2025):

Hey @faritor — Could you let us know if increasing the MAGIC_LINK_TOKEN_VALIDITY resolved the 401 error on your end?

@ngoc-minh-do — Would you mind sharing more detailed steps or context so we can try to reproduce the issue locally?

@lfift Is this issue still occurring for you, or has it been resolved?

Hi, @mirarifhasan ,

thank you for your reply. my configuration is as follows. according to the documentation, the email should expire within 3 days. however, from receiving the email to clicking to open it, it took no more than 3 minutes. I'm using the chrome browser, and the version is 138.0.7204.158

JWT_SECRET="a9******cabf"
TOKEN_SALT_COMPLEXITY=10
MAGIC_LINK_TOKEN_VALIDITY=3
REFRESH_TOKEN_VALIDITY=604800000
ACCESS_TOKEN_VALIDITY=86400000
SESSION_SECRET="5****81"
ALLOW_SECURE_COOKIES=false

@faritor commented on GitHub (Jul 23, 2025): > Hey [@faritor](https://github.com/faritor) — Could you let us know if increasing the `MAGIC_LINK_TOKEN_VALIDITY` resolved the `401` error on your end? > > [@ngoc-minh-do](https://github.com/ngoc-minh-do) — Would you mind sharing more detailed steps or context so we can try to reproduce the issue locally? > > [@lfift](https://github.com/lfift) Is this issue still occurring for you, or has it been resolved? Hi, @mirarifhasan , thank you for your reply. my configuration is as follows. according to the documentation, the email should expire within 3 days. however, from receiving the email to clicking to open it, it took no more than 3 minutes. I'm using the chrome browser, and the version is 138.0.7204.158 ``` JWT_SECRET="a9******cabf" TOKEN_SALT_COMPLEXITY=10 MAGIC_LINK_TOKEN_VALIDITY=3 REFRESH_TOKEN_VALIDITY=604800000 ACCESS_TOKEN_VALIDITY=86400000 SESSION_SECRET="5****81" ALLOW_SECURE_COOKIES=false ```

kerem commented

2026-03-16 20:39:08 +03:00

Author

Owner

@mirarifhasan commented on GitHub (Jul 23, 2025):

@faritor
MAGIC_LINK_TOKEN_VALIDITY is in hours — thanks for pointing that out. We've checked the docs and will update the clarification shortly.

We're also aware of a timezone-related issue affecting link validation, and we're aiming to address that in an upcoming release.

@mirarifhasan commented on GitHub (Jul 23, 2025): @faritor `MAGIC_LINK_TOKEN_VALIDITY` is in hours — thanks for pointing that out. We've checked the docs and will update the clarification shortly. We're also aware of a timezone-related issue affecting link validation, and we're aiming to address that in an upcoming release.

kerem commented

2026-03-16 20:39:13 +03:00

Author

Owner

@faritor commented on GitHub (Jul 23, 2025):

@faritor MAGIC_LINK_TOKEN_VALIDITY is in hours — thanks for pointing that out. We've checked the docs and will update the clarification shortly.

We're also aware of a timezone-related issue affecting link validation, and we're aiming to address that in an upcoming release.

Hi, @mirarifhasan ,

thank you for your reply. I'm looking forward to a fix. currently, I'm stuck at the email login stage and can't proceed to the next step of the experience.

@faritor commented on GitHub (Jul 23, 2025): > [@faritor](https://github.com/faritor) `MAGIC_LINK_TOKEN_VALIDITY` is in hours — thanks for pointing that out. We've checked the docs and will update the clarification shortly. > > We're also aware of a timezone-related issue affecting link validation, and we're aiming to address that in an upcoming release. Hi, @mirarifhasan , thank you for your reply. I'm looking forward to a fix. currently, I'm stuck at the email login stage and can't proceed to the next step of the experience.

kerem commented

2026-03-16 20:39:18 +03:00

Author

Owner

@faritor commented on GitHub (Jul 23, 2025):

I think it's probably an issue with the expiration processing here. I set MAGIC_LINK_TOKEN_VALIDITY to 8640000 and I logged in successfully.

after successfully logging in, I noticed this error line in the log of the container. I'm not sure what impact it will have

hoppscotch  | Backend Server | [Nest] 42  - 07/23/2025, 9:20:23 PM   ERROR [ExceptionsHandler] Error: user_settings/settings_already_exists
hoppscotch  | Backend Server |     at throwErr (/dist/backend/dist/utils.js:26:11)
hoppscotch  | Backend Server |     at UserSettingsResolver.createUserSettings (/dist/backend/dist/user-settings/user-settings.resolver.js:36:34)

@faritor commented on GitHub (Jul 23, 2025): I think it's probably an issue with the expiration processing here. I set `MAGIC_LINK_TOKEN_VALIDITY` to 8640000 and I logged in successfully. after successfully logging in, I noticed this error line in the log of the container. I'm not sure what impact it will have ``` hoppscotch | Backend Server | [Nest] 42 - 07/23/2025, 9:20:23 PM ERROR [ExceptionsHandler] Error: user_settings/settings_already_exists hoppscotch | Backend Server | at throwErr (/dist/backend/dist/utils.js:26:11) hoppscotch | Backend Server | at UserSettingsResolver.createUserSettings (/dist/backend/dist/user-settings/user-settings.resolver.js:36:34) ```

kerem commented

2026-03-16 20:39:23 +03:00

Author

Owner

@mirarifhasan commented on GitHub (Jul 23, 2025):

user_settings/settings_already_exists is a known behavior — no worries. The error occurs because the frontend is calling the same API twice, which leads to a duplicate "user settings already exist" response from the backend. We're aware of it and it's not something to be concerned about.

Yes, increasing the MAGIC_LINK_TOKEN_VALIDITY is a good workaround for now and helps ensure smoother usage. That said, we're aware of the timezone handling issue and plan to address it soon to make the experience more reliable.

@mirarifhasan commented on GitHub (Jul 23, 2025): `user_settings/settings_already_exists` is a known behavior — no worries. The error occurs because the frontend is calling the same API twice, which leads to a duplicate "user settings already exist" response from the backend. We're aware of it and it's not something to be concerned about. Yes, increasing the `MAGIC_LINK_TOKEN_VALIDITY` is a good workaround for now and helps ensure smoother usage. That said, we're aware of the timezone handling issue and plan to address it soon to make the experience more reliable.

kerem commented

2026-03-16 20:39:28 +03:00

Author

Owner

@liyasthomas commented on GitHub (Jul 30, 2025):

This issue has been resolved in the latest version.

@liyasthomas commented on GitHub (Jul 30, 2025): This issue has been resolved in the latest version.

kerem referenced this issue

2026-03-17 00:59:04 +03:00

[PR #1510] [CLOSED] chore(deps): bump nuxt from 2.14.12 to 2.15.2 #3361