POST /main/register returns 400 Bad Request Invalid signature

[prologic]

Registration isn't working. I get a 400 Bad Request and "Invalid signature" in the Body.

[ghost]

@prologic clean your cookies and try again, I think for installation help is better on the IRC: https://github.com/pump-io/pump.io/wiki/Community#communication-channels

[prologic]

Okay I'll try... Are you on FreeNode?

Also are we able to return better errors to the UI? I had to pull out the Chrome Debugger to see the "Invalid Signature" in the response.

[ghost]

@prologic the current version in master has that fix, and yes in freenode #pump.io

[prologic]

Nope clearing cookies, ingocnito, different browser I never use. Same error: "400: error
"

[ghost]

The error was the HTTPS validation that requires a key values even if 443 port is set up

[prologic]

Ti be more prcise; this was some assumptions being made in the code that led to an incorrect value for oauth_protocol of http when the request uri are all https from the client.

This hacked up dif worked around that:

diff --git a/lib/app.js b/lib/app.js
index 8cbea1ea..5e766944 100644
--- a/lib/app.js
+++ b/lib/app.js
@@ -396,7 +396,7 @@ var makeApp = function(configBase, callback) {
             contentSecurityPolicy: {
                 directives: {
                     "default-src": ["'self'"],
-                    "connect-src": ["'self'", (useHTTPS ? "wss://" : "ws://") + URLMaker.makeHost()],
+                    "connect-src": ["'self'", ("wss://") + URLMaker.makeHost()],
                     "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"].concat(config.noCDN ? [] : ["cdnjs.cloudflare.com"]),
                     "style-src": ["'self'", "'unsafe-inline'"].concat(config.noCDN ? [] : ["cdnjs.cloudflare.com", "maxcdn.bootstrapcdn.com"]),
                     "font-src": ["'self'"].concat(config.noCDN ? [] : ["cdnjs.cloudflare.com"]),
@@ -471,7 +471,7 @@ var makeApp = function(configBase, callback) {
         app.use(auth([auth.Oauth({name: "client",
                                   realm: "OAuth",
                                   oauth_provider: app.provider,
-                                  oauth_protocol: (useHTTPS) ? "https" : "http",
+                                  oauth_protocol: (true) ? "https" : "http",
                                   authenticate_provider: null,
                                   authorize_provider: null,
                                   authorization_finished_provider: null
@@ -479,7 +479,7 @@ var makeApp = function(configBase, callback) {
                       auth.Oauth({name: "user",
                                   realm: "OAuth",
                                   oauth_provider: app.provider,
-                                  oauth_protocol: (useHTTPS) ? "https" : "http",
+                                  oauth_protocol: (true) ? "https" : "http",
                                   authenticate_provider: oauth.authenticate,
                                   authorize_provider: oauth.authorize,
                                   authorization_finished_provider: oauth.authorizationFinished

[prologic]

This needs either smarter validation or a configuration option.

Terminating TLS on both ends (Load Balancer and Application) is excessive when your internal network is already secure.