[BUG] Fider activation email not working on Heroku

[duncan-m]

Fider Cloud or Self Hosted
Self Hosted - Heroku

Describe the bug
With a complete new clean install and the correct email settings deployed to a new heroku instance we receive the email but the activation link takes us to 'Page not found'

To Reproduce
Clean install to Heroku and click on activation link in email.

Expected behaviour
Product set-up page

Screenshots

Additional context
Add any other context about the problem here.

[goenning]

Did you open that email on Microsoft Outlook?

I just deployed Fider to Heroku ( https://example-fider.herokuapp.com ) and it worked fine.

[duncan-m]

I opened it on Gmail.

…

On Wed, 15 Sep 2021, 19:59 Guilherme Oenning, ***@***.***> wrote: Did you open that email on Microsoft Outlook? I just deployed Fider to Heroku ( https://example-fider.herokuapp.com ) and it worked fine. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1007 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAYIGXM7JTX2QTAV3GTK7ALUCDNHNANCNFSM5D4B443Q> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[jaanttil]

Thanks, yes apparently it is somehow related to Outlook/email client/email protection we are using. Based on logs it seems that the URL is already consumed before I receive/click the link. If I set incorrect SMTP details, and pick the link directly from logs/db signup succeeds. Gmail works as well...

[indyteo]

Maybe the solution would be to add an extra step requiring a humain action when visiting the link (clicking on a confirmation button ?) because some protection bots (like with Gmail) fetch the link first to see if nothing is suspicious.

I don't think the User-Agent header could help us to identify if the request was from a bot, otherwise a malicious website would be able to send clean pages to pass protections and malicious ones to clients, so there must be not way to identify those requests in my opinion.

[goenning]

The other option I had in mind was to add an X minutes grace period, so that when the email client opens the link, it's marked as 'used', but there is still X minutes where the user can still use that link. There are some flaws with this approach, so the user action is probably the best option

[kellystevenstextel]

I just deploy in Azure and I am running into the same issue as well. I originally opened the email in Outlook but then I sent the verification email to my personal gmail account and both give a 404 error.

[sandro2205]

Me too. I deploy on Heroku and use Mailgun as smtp server, sending the mail to my gmail account. I receive the email but the activation link takes us to 'Page not found', and the site on the heroku dont work more.

[goenning]

@sandro2205 can you start the process from scratch to collect some logs?

Add the Environment Variable LOG_LEVEL with value DEBUG to get more details.

Please share all the logs. Thanks

[sandro2205]

Hi goenning, tks by the answer. Here is the log
heroku_issue.csv.

[goenning]

@sandro2205 I had a look at your logs and there was nothing suspicious there. I also started the process all over again and after clicking the link, the site was activated as expected.

I need two extra things from you to help me troubleshoot this:

1. Which commit have you deployed? Is is the latest?
2. Can you also run these queries and share the result?

select * from tenants
select * from email_verifications

Thanks

[kellystevenstextel]

Hello, We tried to do a hosted version by you as well and we got the same error unfortunately. Kelly [cid:7de47fe4-934c-4724-b14f-586b10a26518] Kelly Stevens VP of Product Engineering Cell: 314-504-2170 | www.textel.net<http://www.textel.net/> | [https://s3.amazonaws.com/images.wisestamp.com/icons_32/facebook.png]<https://www.facebook.com/textyourbusiness/> [https://s3.amazonaws.com/images.wisestamp.com/icons_32/linkedin.png] <https://www.linkedin.com/company/textel?trk=vsrp_companies_cluster_name&trkInfo=VSRPsearchId%3A3589213991437074096100%2CVSRPtargetId%3A10061782%2CVSRPcmpt%3Acompanies_cluster> [https://s3.amazonaws.com/images.wisestamp.com/icons_32/twitter.png] <https://twitter.com/textelnow>

…

________________________________ From: Guilherme Oenning ***@***.***> Sent: Tuesday, October 26, 2021 2:33 PM To: getfider/fider ***@***.***> Cc: Kelly Stevens ***@***.***>; Comment ***@***.***> Subject: Re: [getfider/fider] [BUG] Fider activation email not working on Heroku (#1007) @sandro2205<https://github.com/sandro2205> I had a look at your logs and there was nothing suspicious there. I also started the process all over again and after clicking the link, the site was activated as expected. I need two extra things from you to help me troubleshoot this: 1. Which commit have you deployed? Is is the latest? 2. Can you also run these queries and share the result? select * from tenants select * from email_verifications Thanks — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#1007 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ARUVZRKZBE5ZRXX6P22H3GLUI4GATANCNFSM5D4B443Q>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[sandro2205]

Hi @goenning.
About the version, i use the v0.19.1, the latest.

Follow the select result.
tenants.csv
mail_verif.csv
.
In time....
Yesterday i try using the docker solution, and the same error occoured. I receive the activation mail, click on the link, and the site dead.

[goenning]

What value do you have on HOST_DOMAIN env var? I was able to reproduce this issue by using an invalid value on this variable. In you case @sandro2205, the value should be dokauservoice.herokuapp.com

[sandro2205]

Hi @goenning
You're right! I always typed a different name in the HOST_DOMAIN variable. The correct is type the same name used on app creation form on Heroku.

I just set the variable using the same url name in Heroku, and it WORKED!
Thank you very much, and sorry about my mistakes.

[goenning]

Thanks for confirming. I'll add a WARN log to facilitate troubleshooting in future.