starred/koel-koel

Fork 0

mirror of https://github.com/koel/koel.git synced 2026-04-26 09:15:59 +03:00

[GH-ISSUE #111] Error just after connexion on koel in 3G network #76

New issue

Closed

opened 2026-02-26 02:32:03 +03:00 by kerem · 9 comments

kerem commented

2026-02-26 02:32:03 +03:00

Owner

Originally created by @kevincaradant on GitHub (Dec 18, 2015).
Original GitHub issue: https://github.com/koel/koel/issues/111

If i try to connect me on koel , with my wireless network the connexion works but if try with 3G network i get this, just after to entry login and password :

But if i connect me before in wireless and then i continue to use it in 3G network, works fine. So it's only during the connexion (3G / Edge / 4G) that something wrong ;)

Originally created by @kevincaradant on GitHub (Dec 18, 2015). Original GitHub issue: https://github.com/koel/koel/issues/111 If i try to connect me on koel , with my wireless network the connexion works but if try with 3G network i get this, just after to entry login and password : ![image](https://cloud.githubusercontent.com/assets/6093175/11902397/c4b13372-a5b1-11e5-8eeb-82bd4aa0ea71.png) But if i connect me before in wireless and then i continue to use it in 3G network, works fine. So it's only during the connexion (3G / Edge / 4G) that something wrong ;)

kerem closed this issue

2026-02-26 02:32:03 +03:00

kerem commented

2026-02-26 02:32:03 +03:00

Author

Owner

@funcoding commented on GitHub (Dec 19, 2015):

Are you running the server on internal IP?

@funcoding commented on GitHub (Dec 19, 2015): Are you running the server on internal IP?

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@kevincaradant commented on GitHub (Dec 19, 2015):

Nop external IP. I opened my port for that. When you say "server" , you talk about "laravel" ? I just launch it with php artisan serve --host 0.0.0.0 which allow to connect not just in localhost . I don't know if that can help you to understand .

And when i haven't this error , i loop on the login page. After to enter login / password, sometimes i fall up again on the login page like if my credential are false :/ but there are not false ... if i connect again in wifi , all the problems desapear :/. Is it possible to link only at a problem with smartphone browser?

@kevincaradant commented on GitHub (Dec 19, 2015): Nop external IP. I opened my port for that. When you say "server" , you talk about "laravel" ? I just launch it with php artisan serve --host 0.0.0.0 which allow to connect not just in localhost . I don't know if that can help you to understand . And when i haven't this error , i loop on the login page. After to enter login / password, sometimes i fall up again on the login page like if my credential are false :/ but there are not false ... if i connect again in wifi , all the problems desapear :/. Is it possible to link only at a problem with smartphone browser?

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@funcoding commented on GitHub (Dec 19, 2015):

What was the url specified while using 3g?

@funcoding commented on GitHub (Dec 19, 2015): What was the url specified while using 3g?

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@jlamur commented on GitHub (Dec 20, 2015):

Looks like the CSRF Token also checks your IP address (and this is not a good practice).
I'm gonna check it. [EDIT: It seems that there's no IP address checking in CSRF controller, maybe in session controller...].

If that is the problem source, delete cookies will solve the problem.

@jlamur commented on GitHub (Dec 20, 2015): Looks like the CSRF Token also checks your IP address (and this is not a good practice). I'm gonna check it. [EDIT: It seems that there's no IP address checking in CSRF controller, maybe in session controller...]. If that is the problem source, delete cookies will solve the problem.

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@phanan commented on GitHub (Dec 20, 2015):

Looks like the CSRF Token also checks your IP address (and this is not a good practice).

Why?

@phanan commented on GitHub (Dec 20, 2015): > Looks like the CSRF Token also checks your IP address (and this is not a good practice). Why?

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@jlamur commented on GitHub (Dec 20, 2015):

When he switches to 3G network, he gets a new IP and that could explain why his CSRF Token is rejected.

Identify someone by IP is never a good idea. It leads in every cases to an undesired disconnecting. Expect if you are in a closed environment (like a company network, or VPN).

Moreover, if someone can steal a CSRF Token, then wants to use it, he will need the session cookie. And if the attacker can have both of them, he can probably use the victim computer or the same network/ip.

That's my opinion.

@jlamur commented on GitHub (Dec 20, 2015): When he switches to 3G network, he gets a new IP and that could explain why his CSRF Token is rejected. Identify someone by IP is never a good idea. It leads in every cases to an undesired disconnecting. Expect if you are in a closed environment (like a company network, or VPN). Moreover, if someone can steal a CSRF Token, then wants to use it, he will need the session cookie. And if the attacker can have both of them, he can probably use the victim computer or the same network/ip. That's my opinion.

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@jlamur commented on GitHub (Dec 20, 2015):

Non sense in last paragraph. What I wanted to say was that if you implement the CSRF protection the good way there's no risk to not check IP.
It's 7 am here i'm gonna sleep now ! :)

@jlamur commented on GitHub (Dec 20, 2015): Non sense in last paragraph. What I wanted to say was that if you implement the CSRF protection the good way there's no risk to not check IP. It's 7 am here i'm gonna sleep now ! :)

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@phanan commented on GitHub (Dec 20, 2015):

CSRF is done by Laravel, to whom I'd trust ;)

@phanan commented on GitHub (Dec 20, 2015): CSRF is done by Laravel, to whom I'd trust ;)

kerem commented

2026-02-26 02:32:04 +03:00

Author

Owner

@kevincaradant commented on GitHub (Dec 20, 2015):

I have some news or precisions , maybe that will be able to help you. All cases after is with my external IP , port 8000.

In 3G : On smartphone without cookie, I come on the login page , i click on "log in" button, i get immediatly the error line 2928. with or without my credential, it's the same problem.

In Wifi : On smarthphone with / without cookie , i come on the login page , i can to connect me without problem.

In 3G but share network 3G on my computer (hotspot) : I check on my pc , i have the IP from my phone service , On the computer , i can connect me exactly like with the wifi without any problem.

Personnaly i don't understand why .... it's weird for me but maybe for you , that will help you :)

@kevincaradant commented on GitHub (Dec 20, 2015): I have some news or precisions , maybe that will be able to help you. All cases after is with my external IP , port 8000. In 3G : On smartphone without cookie, I come on the login page , i click on "log in" button, i get immediatly the error line 2928. with or without my credential, it's the same problem. In Wifi : On smarthphone with / without cookie , i come on the login page , i can to connect me without problem. In 3G but share network 3G on my computer (hotspot) : I check on my pc , i have the IP from my phone service , On the computer , i can connect me exactly like with the wifi without any problem. Personnaly i don't understand why .... it's weird for me but maybe for you , that will help you :)

kerem referenced this issue

2026-02-26 02:35:36 +03:00

[PR #76] [CLOSED] Queue media sync when media path is set #1146

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/koel-koel#76

No description provided.

Rows
Columns