EasyApache4 - 403/405 Errors on Module Config Debug and Token Update

[FernandoHCFaria]

Hi guys

Today Im getting this:

Is this happening to anyone else? Has anything changed, or do I need to do something?

Original thread: https://community.humhub.com/content/perma?id=295970

[ArchBlood]

@luke- from my understanding the following is happening;

Where it breaks

$this->forcePostRequest();

fcm-push/controllers/TokenController.php

Lines 23 to 29 in 3b08950

	public function beforeAction($action)
	{
	Yii::$app->response->format = Response::FORMAT_JSON;
	$this->forcePostRequest();
	return parent::beforeAction($action);
	}

This line only allows POST requests.

Why it breaks

Before the actual POST, the browser sends:

OPTIONS /fcm-push/token/update

That request gets rejected because it's not POST → 405.

The real POST request never runs because an OPTIONS request can happen before the POST request when it comes to Firebase and most push APIs.

[luke-]

Can you please provide steps to reproduce?

[ArchBlood]

Can you please provide steps to reproduce?

Check the Network Tab in Developer Tools.

You will see two things happen:

• The OPTIONS Request: The browser automatically sends an OPTIONS request first.
• The 405 Error: Because of beforeAction calls $this->forcePostRequest(), and OPTIONS is not POST, HumHub will respond with a 405 Method Not Allowed.
  The Actual POST Fails: Because the preflight (OPTIONS) failed, the browser will "cancel" the actual POST request. It will never even hit actionUpdate() function.

[luke-]

e.g. on the Community I cannot find such requests.

[ArchBlood]

e.g. on the Community I cannot find such requests.

CORS Preflight requests OPTIONS then fails because it isn't a POST. That is all I've observed while looking at @FernandoHCFaria HumHub instance, I do not know of a way around this as it is mandatory, maybe we can look into a softer or updated $this->forcePostRequest() solution that checks for OPTIONS before POST to mitigate? 🤔

[ArchBlood]

Maybe we could use something like this?

public function beforeAction($action)
{
    // Set response format first
    Yii::$app->response->format = Response::FORMAT_JSON;

    // FIX: Allow OPTIONS to bypass the forcePostRequest check
    if (Yii::$app->request->getMethod() === 'OPTIONS') {
        return true; 
    }

    // This will now only block GET, PUT, DELETE, etc.
    $this->forcePostRequest();
    
    return parent::beforeAction($action);
}

[FernandoHCFaria]

Although everything is green on the prerequisites screen, no one is receiving notifications via mobile anymore. Is this related to the previous error (405)? The following message appears on the debug screen:

In https://console.cloud.google.com/apis/credentials/key/ I have only 2 enabled APIs. Do I need to enable anything else?

[kilgor-trout-c22]

Hi! Before considering any code changes, it is essential to be able to reliably reproduce the behavior. I haven't been able to do that on Community either. Could you please provide a detailed description?

[FernandoHCFaria]

Hi! Before considering any code changes, it is essential to be able to reliably reproduce the behavior. I haven't been able to do that on Community either. Could you please provide a detailed description?

I don't know what to say beyond what has already been said. Error 405 appears automatically when opening the console (F12). @ArchBlood himself already described this here.

Regarding notifications on mobile devices using the official app, they simply stopped working some time ago. I've already repeated all the steps at least 3 times, deleting everything and recreating it, but the "No app request detected" error keeps appearing.

[FernandoHCFaria]

Hi guys

Any news about it?
Notifications are no longer reaching any users. The settings still show "No app request detected". I've already repeated all the Firebase procedures you provided at least three times, deleting everything and following the tutorial step-by-step, but still no notifications. The only notifications that appear are those red balloons showing the number of notifications using the browser, but no push notifications have appeared on mobile phones for some time.

[PrimozRatej]

Hey @FernandoHCFaria, I was looking into it and can't replicate this problem on my test instances. Could you provide test credentials to your environment so I can take a look? You can send them to my email primozratej@gmail.com. Thanks.

[PrimozRatej]

@FernandoHCFaria , @kilgor-trout-c22

Same 405 error on mobile side:, tested on https://kinkgram.com.br/

log.txt

I don't think it's something on mobile side.

[ArchBlood]

@FernandoHCFaria , @kilgor-trout-c22

Same 405 error on mobile side:, tested on https://kinkgram.com.br/

log.txt

I don't think it's something on mobile side.

As I stated, I've only seen this happen on @FernandoHCFaria instance, but I can confirm that the latest version of the push notification module no longer has been sending out mobile notifications, what's even stranger I see that Firebase tokens aren't generated either? I'd have to look more into this later when I have the time to do so.

[kilgor-trout-c22]

@FernandoHCFaria , I apologise for the pauses in our conversation, which perhaps make it feel as though you are talking to the Voyager space probe 📡.

We currently have no further reports of 405 errors relating to the FCM-Push module. Therefore, it seems likely that this is a local issue affecting your instance only. Let's focus on that for now and see what we can do:

• Did you or your hosting provider make any configuration changes or updates shortly before the error first occurred?

• Speaking of updates: Are the versions of your instance up to date (specifically HumHub: 1.8.2, and Push Notifications (Firebase): 2.2.2?

• Are all users in your network affected, or only individual accounts/groups?

• Does the error occur in all browsers (Safari, Edge, Chrome and Firefox)?

• Which HumHub and FCM Push versions are currently installed?

• On which platform is your network running (Linux, Windows or a service provider)?

• Which web server (e.g. Apache or nginx) and PHP version are in use?

• Do you or your hosting provider use (reverse) proxies, CDNs, web application firewalls or similar?

• Do you see any relevant entries in HumHub under Administration > Information > Logging?

• Does the web server’s error log contain relevant entries?

Gathering this information usually helps a great deal in determining how to identify the error.