3.1 admin login fails with 401

[erdinc]

Describe the bug
After upgrading from 3.0 to 3.1 I can't access to admin dashboard. Login page displays and after entering the credentials URL changes to /admin but then redirects to /admin/auth/login

Steps to reproduce the behavior

1. follow the migration steps for 3.0 to 3.1
2. navigate to /admin
3. enter credentials for admin user
4. you will be redirected to /admin/auth/login

Expected behavior
Admin UI should be displayed

Screenshots
If applicable, add screenshots to help explain your problem.

Code snippets

[2020-07-23T14:28:01.827Z] debug POST /admin/login (134 ms) 200
[2020-07-23T14:28:01.967Z] debug GET /admin/users/me/permissions (64 ms) 401
[2020-07-23T14:28:01.975Z] debug GET /content-manager/content-types (62 ms) 401

I see permission errors at server logs.

System

• Node.js version: v12.18.3
• NPM version: 6.14.6
• Strapi version: 3.1
• Database: postgresql
• Operating system: macos

[derrickmehaffy]

@alexandrebodin this was the issue I mentioned, trying to reproduce it locally myself.

[alexandrebodin]

Thanks for reporting. We are investing it right now. We haven't be able to reproduce yet

[derrickmehaffy]

I wasn't able to reproduce it.

What I did:

1. Created a new application using the 3.0.6 with npx create-strapi-app@3.0.6 testproject --quickstart
2. Registered an admin user, and created a collection-type with some test data
3. Killed the Strapi server and updated to 3.1.0 following the migration guide
4. Rebuilt the admin and started the server
5. Was able to login with previous admin just fine

[alexandrebodin]

Hi @erdinc

If you have been extending the users-permissions policy called permissions.js then you will need to upgrade it.
Those damn file overwrittes...

make sure to add this to the start of the policy :)

  if (ctx.state.user) {
    // request is already authenticated in a different way
    return next();
  }

[erdinc]

yep, it worked! I overwrote it a while ago to support token-based authentication. may be you should consider adding it to migration docs just because docs have a section explaining how to overwrite it for token based auth.
anyways thank you.

[alexandrebodin]

We will add a warning about custom files :)

[dhazeley]

It took some digging for me to find this. No one would expect an official guide in the Strapi docs would cause them to break their application. I think a note in the migrations docs should be made specifically for this. If not, at least update the guide so that it doesn't break users' applications.

[MattieBelt]

Maybe also add a warning on the extension docs, that people know before hand that when they use extensions the need to check their modified files every upgrade.

[geekplux]

Hey man, great thanks for your guys' solutions, but I got the same 401 error when I just setup a superuser first time in my production server. The local server is running well and the same code pulled from a git repo at the prod server.

Node.js version: v14.14.0
NPM version: 6.14.8
Strapi version: 3.1.4
Database: MySQL 8.0.22
Operating system: debian

BTW: I don't have the extension of permission 😅
I saw the registration is successful and the record has been stored in the database, just queried it. All the things seem good, but get 401 and redirect to the login page every time.

How can I debug the details reason of 401?

[derrickmehaffy]

@geekplux can you move over to the Forum as this issue is a few months old and I don't want to revive an old bug report that may not be entirely related. Thank you!

[lauriejim]

This issue has been mentioned on Strapi Community. There might be relevant details there:

https://forum.strapi.io/t/admin-login-fails-with-401/754/1

[redturtlepower]

I can confirm this behaviour, and here is my docker-compose file.
After a successful login I am redirected back to the auth screen of the dashboard.

The variables are supplied by export VAR=xxx from a bash script that is run before this compose file.

This is running on Ubuntu 20.04 LTS, x86_64.

Update: If I use image strapi/strapi:3.4.3-node10 the login works.

version: "3.3"
services:
  traefik:
    image: "traefik:v2.2.0"
    container_name: "traefik"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=default"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.tls.certResolver=myresolverletsencrypt"
      - "--log=true"
      - "--log.filePath=/logs/traefik.log"
      - "--accesslog=true"
      - "--accesslog.filePath=/logs/access.log"
      - "--certificatesresolvers.myresolverletsencrypt.acme.email=..."
      - "--certificatesresolvers.myresolverletsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.myresolverletsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolverletsencrypt.acme.httpchallenge.entrypoint=web"
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.mybasicauth.basicauth.users=..."
    expose:
      - 8080
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "$TRAEFIK_DATA_DIR:/logs"

  strapi:
    image: strapi/strapi:3.4.3
    container_name: strapi
    restart: unless-stopped
    expose:
      - 1337
    depends_on:
      - postgres
    volumes:
      - $STRAPI_DATA_DIR:/srv/app
    environment:
      - DATABASE_CLIENT=postgres
      - DATABASE_NAME=$STRAPI_DB_NAME
      - DATABASE_HOST=postgres
      - DATABASE_PORT=5432
      - DATABASE_USERNAME=$STRAPI_USER
      - DATABASE_PASSWORD=$STRAPI_USER_PW
    networks:
      - default
      - pgnet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.strapi.rule=Host(`subdomain.domain.com`)"
      - "traefik.http.services.strapi.loadbalancer.server.port=1337"
      - "traefik.http.routers.strapi.entrypoints=websecure"
      - "traefik.http.routers.strapi.tls.certresolver=myresolverletsencrypt"
      - "traefik.http.routers.strapi.middlewares=mybasicauth"
 
networks:
  pgnet:
    driver: bridge