full stack examples return Forbidden on last step

[axife]

I did

docker stop $(docker ps -aq)
docker rm $(docker ps -aq)
make start-full-stack

Following curls worked without errors by returning some JSON

$ curl http://localhost:4445/clients
$ curl http://localhost:4456/rules
$ curl http://localhost:4466/policies

 hydra token user --client-id example-auth-code --client-secret secret --endpoint http://localhost:4444 --port 5555

opens safari and every works fine to end page with introspection

But when I open http://127.0.0.1:4477 there are 4 example links. First 3 links fail in same way.

They ask for login then they ask for consent and then they print "Forbidden"

URL looks like http://localhost:4477/auth/callback?code=SBOIQzPSKeMy3GmtzcCOV3H0cTBfRuYzY7zlZlNvPwA.Sm5hL36-kRH2Vq9w1DYfG9BYLdkFM5UwVEW5GViAI60&scope=offline%20openid%20articles.read&state=Z2VgU7vQAmSTIsBSsGI7DrV9

[aeneasr]

I can reproduce this.

[aeneasr]

Oh boy, looks like this is related to PassportJS, my eternal impossible-to-debug enemy. Not sure why passport is killing the request on callback...

[aeneasr]

Hm...the CLI works fine hydra token user --client-id example-auth-code --client-secret secret --endpoint http://localhost:4444 --port 5555, not sure what's going on here...

[aeneasr]

Actually, I think this might have to do with how the browser handles cookies...are you in incognito mode or something?

[aeneasr]

I found the issue, if you call http://127.0.0.1:4477 it redirects you to localhost which then causes the cookies to fail because the host does not have the cookies. If you call http://localhost:4477/ then it works.

[axife]

I have not used incognito mode. But it was Chrome not safari. Safari was used when hydra started and opened some URL automatically. I am not following you. When I open http://127.0.0.1:4477 it gives just HTML page with link and final error was on http://localhost:4477/auth/callback?code=SBOIQzPSKeMy3GmtzcCOV3H0cTBfRuYzY7zlZlNvPwA.Sm5hL36-kRH2Vq9w1DYfG9BYLdkFM5UwVEW5GViAI60&scope=offline%20openid%20articles.read&state=Z2VgU7vQAmSTIsBSsGI7DrV9

[aeneasr]

Yup, you need to open http://localhost:4477, not http://127.0.0.1:4477

[axife]

It fixed it. Thanks!

[aeneasr]

Nice :)