Admin Panel 405 Method Not Allowed

[joshcsullivan]

Hello,

I currently serve Isso from a server independent of my blog. When I go to the admin interface I get a 405 Method Not allowed response after submitting the password.

Checking the network response I get a 301 Moved Permanently.

Here is the network response from my browser (Brave):

I'm running isso 0.12.2 on Ubuntu 18.04

[admin]
enabled = true
password = notmyrealpassword

Hosts include every variation of the blog URL and the comments URL, including /login and /admin

Comments are working on the site and SMTP notifications are coming through, the only issue is accessing the admin panel.

Thanks,
Josh

[joshcsullivan]

Had to migrate it to my production server, and it was working afterward. I'm pretty sure it was related to Redirect all HTTP traffic to HTTPS in the Let's Encrypt cert process that I always include.

Can HTTPS access be added to the admin panel?

Thanks,
Josh

[jelmer]

That's all in your server configuration; there is nothing in /admin per se that deals with https vs plain http.

[Losses]

@joshcsullivan @OmisNomis @MrCappuccino I found a lot of people have similar problem, here are some solution:

Solution 1: CSP

Whatever you are using like Apache or Nginx, add a header to the server response:

Content-Security-Policy: upgrade-insecure-requests;

Everything will work now, for a reference, please checkout: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests

If you are using Nginx, please checkout my configuration:

server {
    listen       443;
    server_name  [xxxxxxxxxxx];

    ssl                     on;
    ssl_certificate         [xxxxxxxxxxx];
    ssl_certificate_key     [xxxxxxxxxxx];
    ssl_trusted_certificate [xxxxxxxxxxx];

    location / {
        proxy_set_header  Host $http_host;
        proxy_set_header  X-NginX-Proxy true;
        proxy_pass        http://127.0.0.1:[xxxxxx]/;
        proxy_redirect    off;
        add_header Content-Security-Policy "upgrade-insecure-requests" always;
    }
}

server {
    listen        80;
    server_name   [xxxxxxxxxxx];

    location ^~ /.well-known {
       root [xxxxxxxxxxx];
    }

    location / {
       return 301 https://$server_name$request_uri;
    }
}

But I dont think this could be a proper solution, a proper way to fix this from isso side is replace all http://example.com/xxxx to //example.com/xxx as I said in #576

Solution 2

(Not verified but should work based on the source code)

Edit your configuration file:

[server]
public-endpoint=//example.com

Notice. leave it as //example.com but not http://example.com or https://example.com will make your site works both for http and https

Really hope this would help.