AWS Elastic Load balancer not working for rails devise gem. Getting invalid Authenticity Token error.
Need to use AWS load balancer without sticky sessions for ruby on rails devise gem. But it gives invalid authenticity token error. Please help.
Thanks in advance.
Related
I need to setup some CORS rules for my S3 Bucket hosted on Swisscom Cloudfoundry. Where or how can i set my CORS rules?
In the Cloudfoundry dashboard I can't find any settings, that belongs to CORS.
And setting CORS through the API with the Postman App (using the AWS Signature Authentication method) gives me the following Exception:
<Error>
<Code>SignatureDoesNotMatch</Code>
<Message>The request signature we calculated does not match the signature you provided. Check your Secret Access Key and signing method. For more information, see REST Authentication and SOAP Authentication for details.</Message>
<RequestId>8abebc99:1683be0bcde:5db02:2c2f</RequestId>
</Error>
Does Swisscom Cloudfoundry S3 support CORS settings?
How can i set CORS rules?
Swisscoms Dynamic Storage is based on Dell EMCs Elastic Cloud Storage. You can define your CORS setting according to the official documentation provided by Dell EMC: http://doc.isilon.com/ECS/3.3/API/S3BucketCorsOperations_setBucketCors_7609e2df22a3c1aba6f55696c1eb3fc3_ba672412ac371bb6cf4e69291344510e_detail.html
The error message you posted suggests that there is an issue with the signature calculation. This can be caused by you system clock getting out of sync.
I have been struggling with getting Windows authentication to work on IIS10 for a .Net Core API. The error I am getting is 401.2:
You are not authorized to view this page due to invalid authentication headers.
I have made the following configurations:
Only windows authentication has been enabled on the site (Anonymous is disabled)
SPNs have been created for the site and the server has been enabled for delegation.
The application pool is configured to run under a domain account
Both cURL and Postman give me the same result. Interestingly, when I make use of the SwaggerUI on the API directly, I get the expected behavior, but when making external calls (from another server), I get the 401.2 error.
Some additional content from the error is that the Logon Method and Logon User is Not Yet Determined.
How do I resolve this issue?
I was under the assumption that Postman and cURL were sending the NTLM credentials/token as a part of the request by default, but was incorrect. I had to enable Failed Request Tracing on IIS and saw that they were trying to make use of anonymous authentication. Apparently Postman does not support NTLM authentication so I made use of cURL and appended the credentials. With this I could get the authentication to work with cURL.
I added security to AWS Kibana using this blog. Kibana is now secure and I have to login with a user from the user pool. But now filebeat can't write to the elastic search endpoint anymore. I tried adding the username and password to filebeat config, but I still get Failed to connect: 403 Forbidden. If I remove Cognito authentication filebeat can write again.
Any help on this would be appreciated
Filebeat doesn't have an option for anything other than Basic Auth, so it isn't possible to configure it in a way that works for AWS Kibana. We went around this issue by whitelisting the IP address of the machine on the access policy of our Kibana instance.
I have a Drupal deployed on a Bitnami Image containing some content that I use in a mobile application. For that, I sat a Rest API to request Drupal and get the data.
Using Postman and the basic_auth credentials, I am able to get my API response properly with no problems.
After that, I deployed Azure API Management and tried to pass the call of Drupal API through it, I provided the credentials via an authentication-basic policy, everything worked perfectly for a moment then suddenly I now getting a 403 Forbidden Access.
I still can request the Drupal API directly via POSTMAN using the same credentials with no problems.
Thanks
Actually, When I was creating the API on API Management, I used wrong authentication credentials many times for that, Drupal had blocked the API from access to the data.
I fixed that by doing a Truncate on the table flood of my database
I would like to limit access to some resources provided by my apache server. e.g. images and videos. The main web-application managing the users runs on ruby on rails.
Now I would like to let apache check whether the access request is valid.
The user should provide an authentication token, he received from my rails app, so apache can grant or reject the access to the files.
It would be best, if the request could look like this:
http://myserver.com/filexyz.mp4?token=jhg987gojhg876
Are there some approaches for this?
Maybe an nginx module?
The module http://code.google.com/p/mod-auth-token/
does exactly what I was looking for.
The rails app and the module share the same key for token generation, so that the access to a resource can be restricted outside a time window and to a specific IP.