Sidekiq's UI logs out the user session (multiple suggestions tried)

[altjx]

Versions
Sidekiq Pro: 5.2.1
Ruby on Rails: 5.2.3
Ruby: 2.5.8

Issue
I've been trying to figure out what's causing my app to do this for quite some time, and I finally just realized yesterday that the Sidekiq UI is logging out my session.

Issue reproduction

1. Navigate to my application's URL and login
2. Navigate to my application's URL in a second tab with /sidekiq appended, to visit the Sidekiq Pro Web UI
3. Refresh the first tab
4. First tab now requires me to login again

Suggestion 1 (unsuccessful)
RE: https://stackoverflow.com/questions/38742116/rails-devise-and-sidekiq-routes
RE: #3085
RE: #3792

I've tried adding this to my Rails routes file:

devise_scope :user do
  authenticated :user do
    mount Sidekiq::Web => '/sidekiq'
  end
end

at the very top of my config/routes.rb file, but no luck. Still logs out the user when browsing to the Sidekiq Pro web interface.

Suggestion 2 (unsuccessful)
The comment in #3792 suggests https://github.com/mperham/sidekiq/wiki/Monitoring#forbidden, which suggests adding

require "sidekiq/pro/web"
Sidekiq::Web.set :session_secret, Rails.application.credentials[:secret_key_base]

to the config/initializers/sidekiq.rb file.

I have tried doing that and nothing has changed -- still logs me out when navigating to the Sidekiq UI. I have also confirmed that the secret_key_base variable in the Rails credentials exist, so it's definitely getting a valid string there returned.

One observation that I made was that, when I login to my application, ActiveRecord::SessionStore::Session is setting my session to a pretty long value, as shown here (from the rails console):

  ActiveRecord::SessionStore::Session Update (1.9ms)  UPDATE "sessions" SET "data" = $1, "updated_at" = $2 WHERE "sessions"."id" = $3  [["data", "BAh7CUkiGXdhcmRlbi51c2VyLnVzZXIua2V5BjoGRVRbB1sGaQZJIiIkMmEk\nMTEkZVpPR1YubDBUb0MwT3o1eEt0QS8wTwY7AFRJIh13YXJkZW4udXNlci51\nc2VyLnNlc3Npb24GOwBUewZJIhRsYXN0X3JlcXVlc3RfYXQGOwBUbCsHWeQv\nYEkiFHJlZGlyZWN0X2RvbWF
pbgY7AEZJIht2cGVudGVzdC1kZXYudm9uYWhp\nLmlvBjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMVB5TXhoeXFRRmpTZDZhNW5R\nTVFDaURWelhKL0VzOXNYY2hqK2ZzcXJZcWM9BjsARg==\n"], ["updated_at", "2021-02-19 16:16:26.179589"], ["id", 4820716]]  

But when I navigate to the Sidekiq Pro UI, I notice that the session data is a lot shorter:

  ActiveRecord::SessionStore::Session Update (2.0ms)  UPDATE "sessions" SET "data" = $1, "updated_at" = $2 WHERE "sessions"."id" = $3  [["data", "BAh7B0kiD3Nlc3Npb25faWQGOgZFVEkiRWFlNGJjNGRjZjU1NzFiNWMxNjAx\nOTVmOTQwYTBiMWM1OTdkM2Q0N2U5ZTdkN2RmMTUyMDFhY2I0MTBkYTNkOGEG\nOwBGSSIJY3NyZgY7AEZJIjFKR3NSMDYyejRnNlNoeWRGV0IzYmtrNG5pc09w\ndEVKMW1WSTRZZVZSS2VBPQY7AEY=\n"], ["updated_at", "2021-02-19 16:18:23.368663"], ["id", 4820718]]

Any other tips that I can use to further investigate?

[mperham]

I've heard one other report that ActiveRecord::SessionStore didn't work well with Sidekiq for some reason. If you remove the two authentication lines, does it work fine?

#devise_scope :user do
  #authenticated :user do
    mount Sidekiq::Web => '/sidekiq'
  #end
#end

Another thing you can do is run Sidekiq master. I've re-written the Web UI session configuration to be simpler and hopefully less error-prone.

[mperham]

To run master, use this in your Gemfile:

gem "sidekiq", github: "mperham/sidekiq"

Let me know if that helps, I have a suspicion it will.

[altjx]

Hey @mperham,

I've heard one other report that ActiveRecord::SessionStore didn't work well with Sidekiq for some reason. If you remove the two authentication lines, does it work fine?

#devise_scope :user do
  #authenticated :user do
    mount Sidekiq::Web => '/sidekiq'
  #end
#end

This is how I used to do it before, but never worked. However, the following solution worked for me:

Another thing you can do is run Sidekiq master. I've re-written the Web UI session configuration to be simpler and hopefully less error-prone.

Any way I can get that working with the Sidekiq Pro gem?

[mperham]

Using Sidekiq master should work with Sidekiq Pro just fine.

…

On Fri, Feb 19, 2021 at 14:52 Alton Johnson, OSCP, OSCE < ***@***.***> wrote: Hey @mperham <https://github.com/mperham>, Yep that worked perfectly -- wow! Any way I can replicate this using the Sidekiq Pro gem? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4821 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAWX5R7EX26Q65W6KKXC3S73TSXANCNFSM4X4ULXPA> .

[mperham]

And thanks for testing this, Alton. This session rewrite is a brand new approach that no one but myself had tested before so I was hoping I could find a victim^wtester to try it in the wild for me. Now you've given me more confidence this will fix similar issues others are seeing. 😎

[altjx]

Haha @mperham sounds good. If you need anyone to test anything man, add me to the list. I can't thank you enough for the hard work you've put behind this gem. The least I could do was go with Pro and I've been super happy with it.

Just let me know! 😁😁

[altjx]

Quick question, I tried doing this:

source "https://gems.contribsys.com/" do
  gem "sidekiq-pro", github: "mperham/sidekiq"
end

but got the following error when running bundle install:

Fetching gem metadata from https://rubygems.org/.......
Fetching source index from https://rubygems.org/
Could not find gem 'sidekiq-pro' in https://github.com/mperham/sidekiq.git (at master@f0ddebc).
The source does not contain any versions of 'sidekiq-pro'

[mperham]

Sidekiq and Sidekiq Pro are separate gems, you just explicitly list it instead of pulling it in implicitly as a transitive dependency:

gem "sidekiq", github: "mperham/sidekiq"

source "https://gems.contribsys.com/" do
  gem "sidekiq-pro"
end

[altjx]

Gotcha. Confirmed this works. Much appreciated!

[altjx]

Hey @mperham,

With that suggestion, I actually just experienced something pretty rough. Check this out:

2021-02-20T14:56:45.099Z pid=136 tid=gq2jwkuuo INFO: Booting Sidekiq 6.2.0 with redis options {:url=>"redis://vpe-re-1cyc0i7ww4zym.atlaug.0001.use1.cache.amazonaws.com:6379/0"}
2021-02-20T14:56:45.271Z pid=136 tid=gq2jwkuuo WARN: NoMethodError: undefined method `use' for Sidekiq::Web:Class
2021-02-20T14:56:45.271Z pid=136 tid=gq2jwkuuo WARN: /myapp/config/routes.rb:496:in `block in <top (required)>'
/usr/local/bundle/gems/actionpack-5.2.4/lib/action_dispatch/routing/route_set.rb:432:in `instance_exec'
/usr/local/bundle/gems/actionpack-5.2.4/lib/action_dispatch/routing/route_set.rb:432:in `eval_block'
/usr/local/bundle/gems/actionpack-5.2.4/lib/action_dispatch/routing/route_set.rb:414:in `draw'

It's referring to this:

    Sidekiq::Web.use(Rack::Auth::Basic) do |user, password|
      [user, password] == ["sidekiqadmin", "mypassword"]
    end

The only thing that fixed this was removing the Sidekiq master by changing:

gem "sidekiq", github: "mperham/sidekiq"
# Sidekiq used for backgrounding tasks.
source "https://gems.contribsys.com/" do
  gem "sidekiq-pro"
end

back to

# Sidekiq used for backgrounding tasks.
source "https://gems.contribsys.com/" do
  gem "sidekiq-pro"
end

Any thoughts on this by chance?

EDIT

I re-read the FAQ and was able to implement a better solution for authentication:

  constraints lambda { |request| request.remote_ip == "my_ip_address" } do
    authenticated :user, ->(u) { (u.email == "my_email_address") } do
      mount Sidekiq::Web => "/sidekiq-pro"
    end
  end

and this works. Sweet!!

[mperham]

Thanks, I will fix that on Monday.

…

On Sat, Feb 20, 2021 at 07:01 Alton Johnson, OSCP, OSCE < ***@***.***> wrote: Hey @mperham <https://github.com/mperham>, With that suggestion, I actually just experienced something pretty rough. Check this out: 2021-02-20T14:56:45.099Z pid=136 tid=gq2jwkuuo INFO: Booting Sidekiq 6.2.0 with redis options {:url=>"redis://vpe-re-1cyc0i7ww4zym.atlaug.0001.use1.cache.amazonaws.com:6379/0"} 2021-02-20T14:56:45.271Z pid=136 tid=gq2jwkuuo WARN: NoMethodError: undefined method `use' for Sidekiq::Web:Class 2021-02-20T14:56:45.271Z pid=136 tid=gq2jwkuuo WARN: /myapp/config/routes.rb:496:in `block in <top (required)>' /usr/local/bundle/gems/actionpack-5.2.4/lib/action_dispatch/routing/route_set.rb:432:in `instance_exec' /usr/local/bundle/gems/actionpack-5.2.4/lib/action_dispatch/routing/route_set.rb:432:in `eval_block' /usr/local/bundle/gems/actionpack-5.2.4/lib/action_dispatch/routing/route_set.rb:414:in `draw' It's referring to this: Sidekiq::Web.use(Rack::Auth::Basic) do |user, password| [user, password] == ["sidekiqadmin", "mypassword"] end The only thing that fixed this was removing the Sidekiq master by changing: gem "sidekiq", github: "mperham/sidekiq" # Sidekiq used for backgrounding tasks. source "https://gems.contribsys.com/" do gem "sidekiq-pro" end back to # Sidekiq used for backgrounding tasks. source "https://gems.contribsys.com/" do gem "sidekiq-pro" end Any thoughts on this by chance? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4821 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAWX5ASMIGA6RMHDATDSDS77FFZANCNFSM4X4ULXPA> .