Repository files, collaboration, releases and project activity.
ARCHFORGE HISTORY
Blame · FIX-ADMIN-403-1.0.5.md
Branch main · the Commit author is not necessarily a verified ArchForge account.
b0c4351f2earchadmin2026-10-11
1 # 1.0.5 — `403 Invalid origin` after login (Debian 13 + Caddy)b0c4351f2earchadmin2026-10-11
2 b0c4351f2earchadmin2026-10-11
3 The status website can open normally but `POST /admin/login` may be rejectedb0c4351f2earchadmin2026-10-11
4 **before username/password/2FA verification** if the configured public originb0c4351f2earchadmin2026-10-11
5 is stale or the request contains a valid but non-textually-equal HTTPS origin.b0c4351f2earchadmin2026-10-11
6 b0c4351f2earchadmin2026-10-11
7 ## Apply through ArchForge Gitb0c4351f2earchadmin2026-10-11
8 b0c4351f2earchadmin2026-10-11
9 1. Download `ArchForge-External-Status-v1.0.5-ADMIN-ORIGIN-FIX-UPDATE-FROM-1.0.4.zip`.b0c4351f2earchadmin2026-10-11
10 2. Extract its contents **over the same Git checkout** that you use forb0c4351f2earchadmin2026-10-11
11 ArchForge External Status; commit and push changes to your ArchForge Git host.b0c4351f2earchadmin2026-10-11
12 3. On VPS 2 (your current root account), run:b0c4351f2earchadmin2026-10-11
13 b0c4351f2earchadmin2026-10-11
14 ```bashb0c4351f2earchadmin2026-10-11
15 cd ~/archforge-external-statusb0c4351f2earchadmin2026-10-11
16 git pull --ff-onlyb0c4351f2earchadmin2026-10-11
17 bash ./fix-admin-origin.shb0c4351f2earchadmin2026-10-11
18 ```b0c4351f2earchadmin2026-10-11
19 b0c4351f2earchadmin2026-10-11
20 No `install.sh` or generic `update.sh` is required. Do not delete or recreateb0c4351f2earchadmin2026-10-11
21 `/etc/archforge-status/status.env` or SQLite data.b0c4351f2earchadmin2026-10-11
22 b0c4351f2earchadmin2026-10-11
23 The script verifies the configured Caddy site is `status.archforge.nl`, checksb0c4351f2earchadmin2026-10-11
24 the existing application's loopback health endpoint, takes a privateb0c4351f2earchadmin2026-10-11
25 configuration backup, synchronizes only `STATUS_PUBLIC_URL` if needed,b0c4351f2earchadmin2026-10-11
26 then uses the existing deployment script to back up SQLite, install and restartb0c4351f2earchadmin2026-10-11
27 with rollback-on-failed-start protection. It tests the external HTTPS loginb0c4351f2earchadmin2026-10-11
28 origin without sending any credentials. The verification POST is deliberatelyb0c4351f2earchadmin2026-10-11
29 missing a valid CSRF token: success means **a CSRF rejection, NOT a login**.b0c4351f2earchadmin2026-10-11
30 b0c4351f2earchadmin2026-10-11
31 Afterwards, reload `https://status.archforge.nl/admin/login` in a fresh tabb0c4351f2earchadmin2026-10-11
32 and log in with your existing password and authenticator code.b0c4351f2earchadmin2026-10-11
33 b0c4351f2earchadmin2026-10-11
34 ### Securityb0c4351f2earchadmin2026-10-11
35 b0c4351f2earchadmin2026-10-11
36 `Origin` and `Referer` must match the configured HTTPS origin; an attackerb0c4351f2earchadmin2026-10-11
37 cannot bypass this with custom `Host` or `X-Forwarded-*` headers. Cookies remainb0c4351f2earchadmin2026-10-11
38 Secure and SameSite=Strict, and all POSTs still need a valid CSRF token.b0c4351f2earchadmin2026-10-11
39 Admin accounts, existing sessions, monitoring and data remain unchanged.b0c4351f2earchadmin2026-10-11
40 b0c4351f2earchadmin2026-10-11
41 ### If the script rejects the local HTTPS testb0c4351f2earchadmin2026-10-11
42 b0c4351f2earchadmin2026-10-11
43 Look only at sanitized web/app service messages:b0c4351f2earchadmin2026-10-11
44 b0c4351f2earchadmin2026-10-11
45 ```bashb0c4351f2earchadmin2026-10-11
46 journalctl -u archforge-status -n 30 --no-pagerb0c4351f2earchadmin2026-10-11
47 ```b0c4351f2earchadmin2026-10-11
48 b0c4351f2earchadmin2026-10-11
49 Never share `/etc/archforge-status/status.env`, TOTP secrets or passwords.