Admin login permission error on v3.0.0-beta.17.4

[arnoldgamboa]

Describe the bug
After I updated on beta 17.4, I can't login anymore and is getting a 403 permissions/init error. See screenshot

Steps to reproduce the behavior

1. Upgrade to beta 17.4
2. Login to admin
   2.1 This is particulary seen on instances I've deployed. Locally, It's weird that it's working.

Screenshots

System

• Node.js version: 10
• NPM version:
• Strapi version: Beta 17.4
• Database: MySQL
• Operating system: Ubuntu

[derrickmehaffy]

Generally this is caused by slow response from a remote database, can you try bumping up the wait timeout in config/hook.json to something like 10000

[arnoldgamboa]

Database is within the same machine though, so latency is not an issue.

…

-Arnold

On Mon, Oct 28, 2019 at 1:31 PM DMehaffy ***@***.***> wrote: Generally this is caused by slow response from a remote database, can you try bumping up the wait timeout in config/hook.json to something like 10000 — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#4373?email_source=notifications&email_token=AAEPOU26T7ETG6O3RVATXT3QQZ2MPA5CNFSM4JFVGLQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECLXK3A#issuecomment-546796908>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEPOU75INC7TORM6MJTFYTQQZ2MPANCNFSM4JFVGLQA> .

[derrickmehaffy]

We will need more information as to your setup as we had seen previous issues related to this and wasn't able to reproduce it outside an extremely slow database.

[alexandrebodin]

@arnoldgamboa DO you have any error in your console so we can get more details ?

If you downgrade back to a previous version does it work again ?

[arnoldgamboa]

1. There's no console error. I know that's weird. It's most like a front end issue I guess? But really it's not. I've tested this on other browsers and also on Incognito to be sure. Same result. 2. Another weird thing is when I downgraded to 16, result is the same.

…

-Arnold

On Mon, Oct 28, 2019 at 4:26 PM Alexandre BODIN ***@***.***> wrote: @arnoldgamboa <https://github.com/arnoldgamboa> DO you have any error in your console so we can get more details ? If you downgrade back to a previous version does it work again ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4373?email_source=notifications&email_token=AAEPOU62S2LRRGIZAOGUYL3QQ2O4ZA5CNFSM4JFVGLQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECMCFAA#issuecomment-546841216>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEPOU5NMANOKSYIWUIQS2TQQ2O4ZANCNFSM4JFVGLQA> .

[alexandrebodin]

@arnoldgamboa From what I gather the issue is because the init permissions isn't enable on the public role for some reason...

If you run this query

SELECT *
FROM `users-permissions_permission`
WHERE role = 2 and action = 'init';

You should get sth like

type	controller	action	enable	policy	role
users-permissions	userspermissions	init	1	NULL	2

Can you share your result ?

[arnoldgamboa]

So weird. I reinstalled everything, including the database, and it suddenly worked. I don't know how to replicate it. I just hope it won't come back again :D

…

-Arnold

On Mon, Oct 28, 2019 at 5:02 PM Alexandre BODIN ***@***.***> wrote: @arnoldgamboa <https://github.com/arnoldgamboa> From what I gather the issue is because the init permissions isn't enable on the public role for some reason... If you run this query SELECT * FROM `users-permissions_permission` WHERE role = 2 and action = 'init'; You should get sth like type controller action enable policy role users-permissions userspermissions init 1 NULL 2 Can you share your result ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4373?email_source=notifications&email_token=AAEPOU72VFNKX5KIUXBQ7M3QQ2TBLA5CNFSM4JFVGLQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECMFCOI#issuecomment-546853177>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEPOU5ITERYOZR7MAXGGETQQ2TBLANCNFSM4JFVGLQA> .

[jsonpj3wt]

We are also seeing this in our production environment. Works fine in dev even locally but once it is out on our servers, same problem. We cannot just wipe the database easily since it is production.

@alexandrebodin We have three entries for what you asked for:

{
    "_id" : ObjectId("5db72274659c45c762f927e0"),
    "type" : "users-permissions",
    "controller" : "userspermissions",
    "action" : "init",
    "enabled" : true,
    "policy" : "",
    "createdAt" : ISODate("2019-10-28T17:16:37.144Z"),
    "updatedAt" : ISODate("2019-10-28T17:16:38.485Z"),
    "__v" : 0,
    "role" : ObjectId("5d9bbded40bc86614d8ec017") // Public
},
{
    "_id" : ObjectId("5db72275659c45c762f92929"),
    "type" : "users-permissions",
    "controller" : "userspermissions",
    "action" : "init",
    "enabled" : true,
    "policy" : "",
    "createdAt" : ISODate("2019-10-28T17:16:37.156Z"),
    "updatedAt" : ISODate("2019-10-28T17:16:38.486Z"),
    "__v" : 0,
    "role" : ObjectId("5d9bc52bbb285a6176539a15")  // Location Upload
},
{
    "_id" : ObjectId("5db72274659c45c762f92697"),
    "type" : "users-permissions",
    "controller" : "userspermissions",
    "action" : "init",
    "enabled" : true,
    "policy" : "",
    "createdAt" : ISODate("2019-10-28T17:16:37.131Z"),
    "updatedAt" : ISODate("2019-10-28T17:16:38.487Z"),
    "__v" : 0,
    "role" : ObjectId("5d9bbded40bc86614d8ec018") // Authenticated
}

[derrickmehaffy]

@jsonpj3wt include your error also because I think your code was different believe it was a 500 code not a 403

[jsonpj3wt]

ah ok:

We modified it to do some cleanup and do an npm run build to make sure everything is correct. Now we are getting an error running admin /users-permissions/init - response: 500. Literally tried everything and it works locally just fine. Only difference I can see is it is running in production.

Also, this works fine in another database instance and also works fine running the container locally as well as running strapi locally. Super strange that once in AWS/ECS, this happens.

There are no logs that describe the issue either. Attempted to call the users_permissions/init endpoint 50+ times to make sure I didn't miss the log error, but nothing but 500 from the call.

[derrickmehaffy]

@arnoldgamboa can you confirm you are also using AWS either as a host or for their managed database?

[BinLiang1990]

If you are using MySQL and you are the first time login to Admin, you will call "user-permissions/init", but that permission's role is 1, which is "Authenticated". at that time, you are not login yet
So you need to change it to 2, which is "public".
Change from

Type	controller	action	enabled	policy	role
users-permissions	userspermissions	init	1		1

To

Type	controller	action	enabled	policy	role
users-permissions	userspermissions	init	1		2

[derrickmehaffy]

This issue has been mentioned on Strapi Community. There might be relevant details there:

https://forum.strapi.io/t/admin-panel-401-error-on-custom-permissions-with-httponly-cookie/1067/1