Invalid key, but only in Production

[miles200]

Hi it's me again 🤦‍♂️ (sorry)

I've finished every thing I need to do (all emails working etc yay).. everything works great on my local machine.

In Production however, login works fine, I can create a new user (I'm using Internal Requests to create accounts via my UI), this triggers the verification email that gets sent fine, but when I click the verification link it gives me an invalid key error. The same happens on a password reset, invalid key.

The only thing I'm seeing in logs (enabled debug in prod temporarily) is:

INFO 1 27500 GET /verify-account 7672bde3-a249-44c9-b1a5-7115183d9b8e Processing by RodauthController#verify_account as HTML Parameters: {"key"=>"2_hyExH9nGL1fbKyeDaZR5nH5mUXQtkmmiGhMH7H2pbAI"}

DEBUG
b4179c0e-75ad-4d98-a631-72fdc894a7d2
DEBUG 1 28600 GET  /verify-account b4179c0e-75ad-4d98-a631-72fdc894a7d2 Sequel (1.4ms) SELECT "key" FROM "account_verification_keys" WHERE ("id" = 2) LIMIT 1

The other thing I've noticed is the URLs in the email are starting with http rather than https? Could that be a problem? Can't figure out where to configure that...

Any help or pointers would be extremely welcome

[miles200]

Okay I worked out how to sort the http/https issue (added protocol: https) in my action mailer config.

But that made no difference. Still getting invalid key errors.

[janko]

There are several reasons why the verify account token could be invalid:

• verify account key record is not present in the database
• verify account key exists for the account but doesn't match
• account is already verified

Could you try to find out which scenario is it? When comparing the key in the database, make sure to HMAC it before comparing it to the email token, i.e. call rodauth.compute_hmac(...) on the column value.

[miles200]

Evening!

Okay. On my local machine, everything matches up and works.

In production:

• Account created using rodauth.create_account(login)
• Account has a row in ‘accounts’ with a status of ‘1’ (unverified)
• Account has a row in ‘account_verification_keys’

Key in database is How6YCtgkQzyuoOXl4MgEI9L2G9fsoixcwastVxSbpk

Database key pushed through compute_hmac is f503zEMzxUrgAYwNhERz42m53mhvsj_Jy_wtbXVJ3O8

Key in email is IKq4PSH8oqzT1jW82ArDmXara9erZXqJQq4Eu8gy9lY

So for some reason a different key to the db value (once it has been HMAC'd) is being emailed.

Trying to work out what is different in my PROD environment.

It's hosted on digital ocean's app platform. It's built directly from the same source as my local copy (via GitHub).

I believe it's using the secret key base as the HMAC secret? I've compared and those are the same across both (it's stored in and they use the same credentials.yml.enc file)

[janko]

Yes, rodauth-rails defaults HMAC secret to Rails secret key base.

I'm wondering how come the tokens are different. That means a different key value was created/retrieved when sending the email.

[miles200]

I wonder if it has anything to do with the email being created from a different server?

My main rails app runs on one server and emails go via SolidQueue/ActiveJob. SolidQueue is running on a 2nd server, but using the same source code (so same secret key base) and same database.

Is there another factor to how the HMAC is calculated?

I'm going to try running SolidQueue on the same server as my rails app later and see if that changes anything.

[miles200]

@janko I spun up a new instance and ran SolidQueue as a Puma plugin (so all running together on one server) and the key is generating correctly and I'm no longer getting an invalid key error.

So either I've done something strange to my old instance, or the HMAC is calculated differently somehow from the 2nd server.