Login fails with "You are not logged in" after 5.0.x -> 5.2.1 upgrade

[Olli]

Hello,

Using official containers zabbix/zabbix-server-mysql:centos-5.2-latest and zabbix/zabbix-web-nginx-mysql:centos-5.2-latest. Updated from 5.0.x to latest 5.2 as of today (2020-11-10).
Login fails with error "You are not logged in". This happens with correct user/pass combination, different error message with wrong credentials.

Tested with Chrome and Firefox and also on Incognito / Private window mode. Tested with serveral user accounts.

Web container log shows error:

2020/11/10 05:57:44 [error] 17#0: *1 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught TypeError: strrpos() expects parameter 1 to be string, null given in /usr/share/zabbix/include/classes/helpers/CCookieHelper.php:72
Stack trace:
#0 /usr/share/zabbix/include/classes/helpers/CCookieHelper.php(72): strrpos(NULL, '/')
#1 /usr/share/zabbix/include/classes/core/CCookieSession.php(126): CCookieHelper::set('zbx_session', 'eyJzZXNzaW9uaWQ...', 0)
#2 [internal function]: CCookieSession->write('3c7dcc52143e2b8...', 'eyJzZXNzaW9uaWQ...')
#3 /usr/share/zabbix/include/func.inc.php(1550): session_write_close()
#4 /usr/share/zabbix/include/classes/mvc/CController.php(379): access_deny(1)
#5 /usr/share/zabbix/include/classes/core/ZBase.php(540): CController->run()
#6 /usr/share/zabbix/include/classes/core/ZBase.php(207): ZBase->processRequest(Object(CRouter))
#7 /usr/share/zabbix/include/config.inc.php(25): ZBase->run('default')
#8 /usr/share/zabbix/zabbix.php(22): require_once('/usr/share/zabb...')
#9 {main}
thrown in /usr/share/zabbix/include/classes/helpers/CC" while reading response header from upstream, client: server.ip.was.here, server: zabbix, request: "POST //zabbix.php?sid=f88a332b09459a18&action=widget.prob lemhosts.view HTTP/1.1", upstream: "fastcgi://unix:/tmp/php-fpm.sock:", host: "zabbixserver.example.com:8080", referrer: "http://zabbixserver.example.com/zabbix/zabbix.php?action=dashboard.view"

What is wrong and how to fix?

[dimir]

Looks like caused by this one: https://support.zabbix.com/browse/ZBXNEXT-5965
Try removing all existing sessions from the database:

delete from sessions;

[Olli]

Installed fresh 5.0 containers with fresh database and verified that everything works. Upgraded to 5.2 and same got same problem.

This seems to be releated on how Zabbix 5.2 handles cookies. I have Apache as reverse proxy using ProxyPass & ProxyPassReverse and if connecting via that, cookie is not saved at all and that error is shown. If I connect directly to container (eg. http://zabbixserver.example.com:8080) everything works, but that is not possible for normal end users. Proxy is on same server so it just forwards from standard 80 (or 443) to container port 8080.

5.0 worked perfectly via proxy.

[Olli]

Looks like caused by this one: https://support.zabbix.com/browse/ZBXNEXT-5965
Try removing all existing sessions from the database:

delete from sessions;

I tried this but it did not help.

[robertsl]

Hello.
How can i see from stack trace problem that request_uri is empty. Maybe server use relative address or your domain contain specific symbol? Try add http at the front of the URL.

[Olli]

Hello.
How can i see from stack trace problem that request_uri is empty. Maybe server use relative address or your domain contain specific symbol? Try add http at the front of the URL.

No any symbols on server or domain name. Server name has number and container, of course, has port number ":8080".
Same problem with http or https.

What has changed on cookie handling between 5.0 and 5.2?

[Olli]

Okay, solved this. Problem was in Apache reverse proxy.

In previous version trailing slash was needed

ProxyPass /testzabbix [URL]http://zabbixserver.example.com:8181/[/URL]
ProxyPassReverse /testzabbix [URL]http://zabbixserver.example.com:8181/[/URL]

but with 5.2, that does not work. This works:

ProxyPass /testzabbix [URL]http://zabbixserver.example.com:8181[/URL]
ProxyPassReverse /testzabbix [URL]http://zabbixserver.example.com:8181[/URL]

[dimir]

You mean this might be incorrect? https://www.zabbix.com/documentation...x/other_issues

[Olli]

You mean this might be incorrect? https://www.zabbix.com/documentation...x/other_issues

I don't think so, on that example there is trailing slash also on left (url on proxy) side:

ProxyPass "[COLOR=#e74c3c]/[/COLOR]" [URL]http://host/zabbix[/URL][COLOR=#e74c3c]/[/COLOR]
ProxyPassReverse "[COLOR=#e74c3c]/[/COLOR]" [URL]http://host/zabbix[/URL][COLOR=#e74c3c]/[/COLOR]

My previous configuration had trailing slash only on right (url on remote host) side:

ProxyPass /testzabbix [URL]http://zabbixserver.example.com:8181[/URL][COLOR=#e74c3c]/[/COLOR]
ProxyPassReverse /testzabbix [URL]http://zabbixserver.example.com:8181[/URL][COLOR=#e74c3c]/[/COLOR]

[dimir]

Oh, correct. Makes sense. Thanks!