{"action":"created","issue":{"url":"https://api.github.com/repos/TryGhost/Ghost/issues/6106","labels_url":"https://api.github.com/repos/TryGhost/Ghost/issues/6106/labels{/name}","comments_url":"https://api.github.com/repos/TryGhost/Ghost/issues/6106/comments","events_url":"https://api.github.com/repos/TryGhost/Ghost/issues/6106/events","html_url":"https://github.com/TryGhost/Ghost/issues/6106","id":118077946,"number":6106,"title":"Revisit origin validation","user":{"login":"ErisDS","id":101513,"avatar_url":"https://avatars.githubusercontent.com/u/101513?v=3","gravatar_id":"","url":"https://api.github.com/users/ErisDS","html_url":"https://github.com/ErisDS","followers_url":"https://api.github.com/users/ErisDS/followers","following_url":"https://api.github.com/users/ErisDS/following{/other_user}","gists_url":"https://api.github.com/users/ErisDS/gists{/gist_id}","starred_url":"https://api.github.com/users/ErisDS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ErisDS/subscriptions","organizations_url":"https://api.github.com/users/ErisDS/orgs","repos_url":"https://api.github.com/users/ErisDS/repos","events_url":"https://api.github.com/users/ErisDS/events{/privacy}","received_events_url":"https://api.github.com/users/ErisDS/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/TryGhost/Ghost/labels/api","name":"api","color":"FA18A8"},{"url":"https://api.github.com/repos/TryGhost/Ghost/labels/blocker","name":"blocker","color":"111111"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/TryGhost/Ghost/milestones/25","html_url":"https://github.com/TryGhost/Ghost/milestones/Public%20API%20v1","labels_url":"https://api.github.com/repos/TryGhost/Ghost/milestones/25/labels","id":1353786,"number":25,"title":"Public API v1","description":"This milestone contains the issues we need to resolve in order to ship a first version of public API access.","creator":{"login":"ErisDS","id":101513,"avatar_url":"https://avatars.githubusercontent.com/u/101513?v=3","gravatar_id":"","url":"https://api.github.com/users/ErisDS","html_url":"https://github.com/ErisDS","followers_url":"https://api.github.com/users/ErisDS/followers","following_url":"https://api.github.com/users/ErisDS/following{/other_user}","gists_url":"https://api.github.com/users/ErisDS/gists{/gist_id}","starred_url":"https://api.github.com/users/ErisDS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ErisDS/subscriptions","organizations_url":"https://api.github.com/users/ErisDS/orgs","repos_url":"https://api.github.com/users/ErisDS/repos","events_url":"https://api.github.com/users/ErisDS/events{/privacy}","received_events_url":"https://api.github.com/users/ErisDS/received_events","type":"User","site_admin":false},"open_issues":14,"closed_issues":7,"state":"open","created_at":"2015-10-13T18:33:26Z","updated_at":"2015-11-26T01:20:42Z","due_on":"2015-10-27T00:00:00Z","closed_at":null},"comments":6,"created_at":"2015-11-20T16:37:01Z","updated_at":"2015-11-26T07:11:36Z","closed_at":null,"body":"A large part of the work to get public API access to be available, involved implementing client authentication. The Ghost admin panel is a client, and is allowed to authenticate to the API via its very own client credentials. \r\n\r\nAs a layer of security,  client authentication includes origin validation. This means that we check that requests to the API come from a permitted url. These are the urls defined in `config.js` and at the moment can be either `url` or `urlSSL`. If the origin validation fails, the client is denied access.\r\n\r\nThis means that, if at any time you try to login or access your admin panel from a URL which is not the URL set in config.js, you will see an error, and at the moment that error is not at all clear.\r\n\r\n### The problem\r\n\r\nAt the moment, the first you might know that this is affecting you, is that you'll be unable to login. The easiest way to reproduce this right now on a standard dev install, is to try loading the admin panel from `http://127.0.0.1:2368` rather than `http://localhost:2368` and see that you can't login:\r\n\r\n![](http://puu.sh/lskv4.png)\r\n\r\nThe `access denied` error message makes it look like your login has failed, when in fact, it was the admin client being denied access to the API to even try to log you in. The only other things you might see are the client console error:\r\n\r\n![](http://puu.sh/lskvW.png)\r\n\r\nAnd server console error:\r\n![](http://puu.sh/lskwH.png)\r\n\r\nNone of which gives you a clear idea of what is wrong.\r\n\r\n### The solution\r\n\r\nThere are a few things that we can do to improve the user experience here.\r\n\r\nThe first thing is to update the error message to be as clear as possible, both on the client side and in the server console. The error should clearly state that the problem is due to the URL not matching the one in config.js, something like:\r\n\r\nE.g. 'Access Denied from url: xxx. Please use the url configured in config.js'\r\n\r\nAs this error is most likely to happen to people just setting up or developing on Ghost (using ngrok will cause this) we should also make sure we output one of our 3-colour error messages on the console. This should be the error, some context, and how to find the solution\r\n\r\n- Access Denied from url: xxx. Please use the url configured in config.js\r\n- You have attempted to access your Ghost admin panel from a url that does not appear in config.js\r\n- For information on how to fix this, please visit http://support.ghost.org/some-new-docs-url\r\n\r\nAs well as improving the error message, it may also make sense to add both localhost and 127.0.0.1 as valid origins for `development` mode, to account for this, in the vein of having sensible defaults. If anyone has any other ideas for sensible defaults, please say :)\r\n\r\nAt some point soon, we will be adding a UI for managing clients, where you will be able to add any additional trusted domains that you want to be able to access your blog (see #4177)\r\n\r\n- [ ] Improve the error message on the client\r\n- [ ] Improve the error message in the server logs\r\n- [ ] add sensible defaults like localhost and 127.0.0.1 for dev mode"},"comment":{"url":"https://api.github.com/repos/TryGhost/Ghost/issues/comments/159829387","html_url":"https://github.com/TryGhost/Ghost/issues/6106#issuecomment-159829387","issue_url":"https://api.github.com/repos/TryGhost/Ghost/issues/6106","id":159829387,"user":{"login":"ErisDS","id":101513,"avatar_url":"https://avatars.githubusercontent.com/u/101513?v=3","gravatar_id":"","url":"https://api.github.com/users/ErisDS","html_url":"https://github.com/ErisDS","followers_url":"https://api.github.com/users/ErisDS/followers","following_url":"https://api.github.com/users/ErisDS/following{/other_user}","gists_url":"https://api.github.com/users/ErisDS/gists{/gist_id}","starred_url":"https://api.github.com/users/ErisDS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ErisDS/subscriptions","organizations_url":"https://api.github.com/users/ErisDS/orgs","repos_url":"https://api.github.com/users/ErisDS/repos","events_url":"https://api.github.com/users/ErisDS/events{/privacy}","received_events_url":"https://api.github.com/users/ErisDS/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T07:11:36Z","updated_at":"2015-11-26T07:11:36Z","body":"Long term (although probably more like Mid term) the url config will be moved into the setup process. If we have write access to config.js, we'll write it, if we don't, we'll show sensible info to help the user sort it out.\r\n\r\nShort term just from the client side perspective, we need to make it so that an error message appears under the form, exactly the same as on signin. \r\n\r\nThat + fixing up serverside with overrides for now should tide us over until we can add a proper setup step for the URL. "}}