Error accessing dashboard

[dbr]

I logged in, and tried to click on Dashboard link under my username. It directs to
https://crates.io/me
and gives the following error. Same happens with "Owner Invites" page in same menu, but Account Settings works

Ember Data Request GET /api/v1/crates returned a 403 Payload (application/json; charset=utf-8) [object Object]

  r@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3958:19
r@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3961:100
handleResponse@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:4027:17
handleResponse@https://crates.io/assets/cargo-122a2a85ee957cc7845ce8a377e9170f.js:6:340
r@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:1925:9
o@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3997:14
ajax/</<@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:4033:8
ajax/<@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:4033:19
_@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3640:12
y@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3638:128
invoke@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3219:139
flush@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3211:74
flush@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3222:292
_end@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3273:9
V/this._boundAutorunEnd@https://crates.io/assets/vendor-d56f71d6bbd0a4e94bf420b72ba26f0e.js:3231:605

[jtgeibel]

Thanks for the report @dbr. I'm not able to replicate this on my machine in production or staging right now. Can you capture the JSON response data through the browser tools for the /api/v1/crates response? Also, look at the query string, I have ?following=1.

The only obvious way I see for that endpoint to generate a 403 response is when an invalid letter parameter is passed, however that doesn't seem to be applicable here.

[dbr]

Strange - while I was looking at the JSON responses, this seems to have corrected itself..

From https://crates.io/api/v1/crates?following=1 I was getting this response with an error 403:

{"errors":[{"detail":"must be logged in to perform that action"}]}

At the same time https://crates.io/api/v1/me was giving the expected response of

{"user":{"id":2962,"login":"dbr", ...

Then, for no obvious reason, reloading the problematic crates URL then started giving a valid response of

{"crates":[],"meta":{"total":0,"next_page":null,"prev_page":null}}

Maybe related, I did notice that while clicking on some other links ("Other Invites" etc) earlier I did become logged out, but, only sometimes.

However, all seems to be working okay again for me - could be closed unless you think it's worth investigating any further. Thanks! :D

[jtgeibel]

Thanks for the follow up info. The 403 is definitely related to some auth issue. (I grepped for the wrong thing earlier.)

We should definitely leave this open, I'm seeing other requests in the logs matching status=403 crates?following=1. (Probably a few hundred requests going back the last month. I'd need to pull down archives to try to find a start date.)

@locks and @Turbo87 do you think it's possible a request is being made somewhere before the login completes? I'm not ruling out the backend either, and will look into adding more logging data here.

[Turbo87]

our current auth code is unfortunately a bit hard to follow so I can't rule out the possibility of a race condition somewhere. I haven't noticed any such issues myself yet, but if the request fails like that for @dbr then it seems quite likely that that is the problem.

I do have a few refactorings for the auth code in mind already anyway, so hopefully those would fix this issue too 😅

[carols10cents]

My first thought was a browser or plugin issue, but I looked at the user agents in the logs for the status=403 crates?following=1 query and I'm seeing a pretty wide variety of user agents across mobile, OS, and browser. Ex: Chrome 80 on Android 10, Firefox 73 on macOS (High Sierra), Firefox 73 on Windows 10, Chrome 74 on Linux, Safari 13 on iOS 13.3 Apple iPhone.