403 When viewing log content

[lem-doghouse]

Hello,

I have the log viewer working on my local and staging environments, but I'm encountering issues viewing the log content in production. Here are my current environment settings for production:

APP_ENV=production
APP_URL=https://shop.myshop.com
LOG_VIEWER_API_STATEFUL_DOMAINS=myshop.com,shop.myshop.com

I've changed the log-viewer route to /admin/logs
The production site can successfully get a response for
/admin/logs/api/folders?direction=desc
but it's getting 403 for
/admin/logs/api/logs?file=2b592428-laravel-2024-08-14.log&direction=desc&query=&per_page=25&shorter_stack_traces=false

I have also checked if there any blocking directives in apache config for storage/logs but there isn't any.

Any ideas on what might be causing this? Any help would be greatly appreciated. Thanks!"

[arukompas]

hey @lem-doghouse , a few things pop to my head.

1. Is your app really served over HTTPS? Certificate valid?
2. Do you have a viewLogViewer authorization gate defined? Or maybe using LogViewer::auth($callback) to define authorization? Can you share what it is?
3. What are your middleware and api_middleware values from Log Viewer config?
4. Can you share the request/response headers for the failing request from browser's Network tab?
5. Which version of Log Viewer are you using?

[MNhat0308]

same issue

1. I use http

2. i use spatie permission in this discusstion to handle auth in prodution but in larravel 11
   

3. I'm using lasted version Log Viewer

4. my file config middleware
   

[arukompas]

Hey @MNhat0308

You've created your own authorisation middleware, but the original LogViewer's auth middleware is still used, which disables access in production by default unless explicitly allowed.

You should:

1. Remove Log Viewer's Authorization middleware from the "middleware" config option, and
2. Add your custom middleware to the "api_middleware" config option, and remove the default Log Viewer's Authorization middleware.

Hope this makes sense 😃

[MNhat0308]

Thanks , i made it!

[lem-doghouse]

Hi @arukompas,

Thank you for your reply. Please see my answer below.

1. Is your app really served over HTTPS? Certificate valid? Yes

2. Do you have a viewLogViewer authorization gate defined? Or maybe using LogViewer::auth($callback) to define authorization? Can you share what it is?

LogViewer::auth(function ($request) {
    $user = resolve(MyUserInterface::class);
    return $user->canViewLogs();
});

3. What are your middleware and api_middleware values from Log Viewer config?

 'middleware' => [
        'web',
        \Opcodes\LogViewer\Http\Middleware\AuthorizeLogViewer::class,
        \App\Http\Middleware\BasicAuthMiddleware::class,
    ],

    /*
    |--------------------------------------------------------------------------
    | Log Viewer API middleware.
    |--------------------------------------------------------------------------
    | Optional middleware to use on every API request. The same API is also
    | used from within the Log Viewer user interface.
    |
    */

    'api_middleware' => [
        \Opcodes\LogViewer\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
        \Opcodes\LogViewer\Http\Middleware\AuthorizeLogViewer::class,
    ],

4. Can you share the request/response headers for the failing request from browser's Network tab?
   

5. Which version of Log Viewer are you using? v3.10.1

Hopefully, there's something I'm overlooking that stands out to you. I really appreciate your help. Thank you!

[arukompas]

Hm, the fact that it's responding with text/html content type tells me that it didn't really hit Laravel for some reason 🤔

Is there anything in ELB logs or something like that? Are you sure the request isn't being cut-off at some earlier stage?

Lastly, I see you have custom auth middleware too, \App\Http\Middleware\BasicAuthMiddleware::class. What does it do, and have you tried adding it to the api_middleware as well?

[lem-doghouse]

Hi @arukompas ,

We have resolved the issues, it's one of the rules in the Load Balancer. Thanks for your help!
Really appreciate it!

[RumoneAndersonCornerstone]

What exactly in your load balancer was mis configured? if you don't mind me asking

[digarahayu]

I think there is some url that block all requests that indicates have access to .log
Like query string xx=filename.log