Blank screen with version 5.0.3

[Yogi4301]

Version

5.0.3

Details & Steps to reproduce

Since I updated the docker container to 5.0.3 2fauth only shows a blank screen. There are no errors in the log file. The last time I got a blank screen was when I forgot to set TRUSTED_PROXIES. With v5.0.2 all is fine again. Is there any change to cause this?

Expectation

Show the regular screen with 5.0.3

Error & Logs

No response

Execution environment

Docker is running on an openmediavault installation

Linux openmediavault 6.1.0-0.deb11.13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55 -1~bpo11+1 (2023-10-08) x86_64

with a reverse-proxy on a Synology Diskstation

version: '3.5'
services:
    2fauth:
        container_name: 2fauth
        environment:
            - TZ=Europe/London
            - APP_NAME=2FAuth
            - APP_ENV=local
            - APP_DEBUG=false
            - [email protected]
            - IS_DEMO_APP=false
            - LOG_CHANNEL=daily
            - LOG_LEVEL=notice
            - LOGIN_THROTTLE=5
            - AUTHENTICATION_GUARD=web-guard
            - APP_KEY=1234567890
            - APP_URL=https://2fauth.example.com
            - AUTH_PROXY_HEADER_FOR_USER=null
            - AUTH_PROXY_HEADER_FOR_EMAIL=null
            - PROXY_LOGOUT_URL=null
            - WEBAUTHN_NAME=2FAuth
            - WEBAUTHN_ID=null
            - WEBAUTHN_ICON=null
            - WEBAUTHN_USER_VERIFICATION=preferred
            - TRUSTED_PROXIES=*
            - MAIL_DRIVER=log
            - MAIL_HOST=smtp.1und1.de
            - MAIL_PORT=465
            - [email protected]
            - MAIL_PASSWORD=pwd
            - MAIL_ENCRYPTION=SSL
            - MAIL_FROM_NAME=2Fauth
            - [email protected]
            - MAIL_VERIFY_SSL_PEER=true
            - LOGIN_THROTTLE=1
        ports:
            - 8000:8000/tcp
        volumes:
            - /data/2fauth:/2fauth
        restart: unless-stopped
        image: 2fauth/2fauth:latest

volumes:
  2fauth:

Containerization

• Docker

Additional information

No response

[falkheiland]

same here (docker-compose via exposed port and behind traefik). downgrade to 5.0.2 shows login window again.

[falkheiland]

https://github.com/Bubka/2FAuth/releases/tag/v5.0.3

⚠️ For everyone experiencing a blank screen after updating to v5.*, please set the ASSET_URL env variable to the same value as APP_URL.

this does not change anything for me.
no change applying that:

APP_URL=http://localhost # this was the defined var in 5.0.2, also tried used url
ASSET_URL=http://localhost

[Bubka]

Please run the following in a terminal opened on the 2fauth directory:

php artisan cache:clear
php artisan config:cache
php artisan view:clear

Does it help?

[Yogi4301]

https://github.com/Bubka/2FAuth/releases/tag/v5.0.3

⚠️ For everyone experiencing a blank screen after updating to v5.*, please set the ASSET_URL env variable to the same value as APP_URL.

this does not change anything for me. no change applying that:

APP_URL=http://localhost # this was the defined var in 5.0.2, also tried used url
ASSET_URL=http://localhost

setting ASSET_URL is working for me

[falkheiland]

i did some testing and got it running by using

version: "3.7"
services:
  2fauth:
    environment:
      - ASSET_URL=https://2fauth.${LOCAL_DOMAIN}
      - APP_URL=https://2fauth.${LOCAL_DOMAIN} #this has been http://localhost in 5.0.2

thanks!

[FoxLust]

set the ASSET_URL & APP_URL to pointing of your server that running fix the problem

for some reason browser try to get file from localhost (or url that you pointing in ASSET_URL & APP_URL) that not existing rather than redirect from the url you access

[ryosoftware]

Same!!!

Impossible to access 2FA codes. Please, solve ASAP! Thanks

[ryosoftware]

https://github.com/Bubka/2FAuth/releases/tag/v5.0.3

⚠️ For everyone experiencing a blank screen after updating to v5.*, please set the ASSET_URL env variable to the same value as APP_URL.

this does not change anything for me. no change applying that:

APP_URL=http://localhost # this was the defined var in 5.0.2, also tried used url
ASSET_URL=http://localhost

this solved the issue for me

[ryosoftware]

Please run the following in a terminal opened on the 2fauth directory:

php artisan cache:clear
php artisan config:cache
php artisan view:clear

Does it help?

I'm running 2fa in a docker. What's the 2fa directory? the physical directory where the 2fa data volume are mapped?

[FoxLust]

if you running 2FAuth on External Server or Cloud, Change ASSET_URL & APP_URL that pointing to your Server IP:PORT or URL FIX the problem

[masterwishx]

Have same issue ,usinf lasted version on Unraid docker .
After added ASSET_URL & APP_URL both = http://192.168.0.199:8000

[masterwishx]

also tryed befor:

php artisan cache:clear
php artisan config:cache
php artisan view:clear

[masterwishx]

Have same issue ,usinf lasted version on Unraid docker . After added ASSET_URL & APP_URL both = http://192.168.0.199:8000

in Firefox working fine after added ASSET_URL & APP_URL , but in chrome get CSRF token mismatch.

[yllekz]

FYI what worked for me was adjusting (and in the case of ASSET_URL, adding) the variables to be as such (adjust "myservername" to your server name + port number to whatever you assigned it to be:

- APP_URL=http://myservername:8000 #https://github.com/Bubka/2FAuth/issues/284
- ASSET_URL=http://myservername:8000 #https://github.com/Bubka/2FAuth/issues/284

Prior to this I did attempt the php artisan cache clears that others tried above. No idea if that factored into the fix.

[masterwishx]

but in chrome get CSRF token mismatch.

After reboot also fixed in chrome

[abelmferreira]

Add ASSET_URL solved for me

[danielwdlh]

I was able to add the variable manually when deploying through TrueNAS Scale, and ASSET_URL fixed it for me too.
It would be great if a change could be made so that ASSET_URL is made optional instead of defaulting to http://localhost, ie.,
if (ASSET_URL == NULL) ASSET_URL=$APP_URL ;

[Citroene]

I have the same problem with a bare metal install
i used 5.0.4

i followed this tutorial https://docs.2fauth.app/getting-started/installation/self-hosted-server/

my .env file looks like this

# You can change the name of the app

APP_NAME=2FAuth


# You can leave this on "local". If you change it to production most console commands will ask for extra confirmation.
# Never set it to "testing".

APP_ENV=local


# Set to true if you want to see debug information in error screens.

APP_DEBUG=false


# This should be your email address

[email protected]


# The encryption key for your database and sessions. Keep this very secure.
# If you generate a new one all existing data must be considered LOST.
#
# You can leave this empty if you use `php artisan 2fauth:install`.
# Otherwise, change it to a string of exactly 32 chars or use command
# `php artisan key:generate` to generate it.

APP_KEY=***


# This variable must match your installation's external address.
# Webauthn won't work otherwise.

APP_URL=http://192.168.1.213:8000


# If you want to serve js assets from a CDN (like https://cdn.example.com),
# uncomment the following line and set this var with the CDN url.
# Otherwise, let this line commented.

ASSET_URL=http://192.168.1.213:8000


# The domain subdirectory from which you want to serve 2FAuth.
# This must reflect the path targeted by APP_URL.
#
# For example, if you set APP_URL=https://mydomain.org/2fa to access 2FAuth from the '/2fa/' subdirectory
# you have to set APP_SUBDIRECTORY=2fa
#
# Leave blank if you serve 2FAuth from the domain root.

APP_SUBDIRECTORY=


# Turn this to true if you want your app to react like a demo.
# The Demo mode reset the app content every hours and set a generic demo user.

IS_DEMO_APP=false


# The log channel defines where your log entries go to.
# 'daily' is the default logging mode giving you 7 daily rotated log files in /storage/logs/.
# Also available are 'errorlog', 'syslog', 'stderr', 'papertrail', 'slack' and a 'stack' channel
# to combine multiple channels into a single one.

LOG_CHANNEL=daily


# Log level. You can set this from least severe to most severe:
# debug, info, notice, warning, error, critical, alert, emergency
# If you set it to debug your logs will grow large, and fast. If you set it to emergency probably
# nothing will get logged, ever.

LOG_LEVEL=notice


# If you're looking for performance improvements, you could install memcached.

CACHE_DRIVER=file
SESSION_DRIVER=file
FILESYSTEM_DRIVER=local


#### Database config & credentials ####

# Supported values for DB_CONNECTION: mysql|pgsql|sqlsrv|sqlite
# mysql => MySQL
# pgsql => PostGreSQL
# sqlsrv => SQL server
# sqlite => SQLite

# Example for a MySQL database connection
#
# DB_CONNECTION=mysql
# DB_DATABASE=my_2fauth_DB_name
# DB_HOST=127.0.0.1
# DB_PORT=3306
# DB_USERNAME=my_2fauth_db_user
# DB_PASSWORD=My_d8_S3cr3t

# Example for SQLite (linux)
#
# DB_CONNECTION=sqlite
# DB_DATABASE="path/to/your/database.sqlite"

# Example for SQLite (windows)
#
# DB_CONNECTION=sqlite
# DB_DATABASE="C:\\path\\to\\your\\database.sqlite"

DB_CONNECTION=pgsql
DB_HOST=192.168.1.237
DB_PORT=5432
DB_DATABASE=2fauthdb
DB_USERNAME=2fauth
DB_PASSWORD=***

# The absolute path to the root CA bundle if you're connecting to the MySQL database via SSL.

MYSQL_ATTR_SSL_CA=


#### Mail settings ####

# Refer your email provider documentation to configure your mail settings
# Set a value for every available setting to avoid issue

MAIL_DRIVER=smtp
MAIL_HOST=mail.***.be
MAIL_PORT=587
MAIL_USERNAME=2fauth@***.be
MAIL_PASSWORD=***
MAIL_ENCRYPTION=ssl
MAIL_FROM_NAME="2fauth"
MAIL_FROM_ADDRESS=2fauth@***.be


# SSL peer verification.
# Set this to false to disable the SSL certificate validation.
#
# WARNING
# Disabling peer verification can result in a major security flaw.
# Change it only if you know what you're doing.

MAIL_VERIFY_SSL_PEER=true


#### API settings ####

# The maximum number of API calls in a minute from the same IP.
# Once reached, all requests from this IP will be rejected until the minute has elapsed.
#
# Set to null to disable the API throttling.

THROTTLE_API=60


#### Authentication settings ####

# The number of times per minute a user can fail to log in before being locked out.
# Once reached, all login attempts will be rejected until the minute has elapsed.
#
# This setting applies to both email/password and webauthn login attemps.

LOGIN_THROTTLE=5

# The default authentication guard
#
# Supported:
#   'web-guard' : The Laravel built-in auth system (default if nulled)
#   'reverse-proxy-guard' : When 2FAuth is deployed behind a reverse-proxy that handle authentication
#
# WARNING
# When using 'reverse-proxy-guard' 2FAuth only look for the dedicated headers and skip all other built-in
# authentication checks. That means your proxy is fully responsible of the authentication process, 2FAuth will
# trust him as long as headers are presents.

AUTHENTICATION_GUARD=web-guard


# Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level.
# Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...)
# (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard')

AUTH_PROXY_HEADER_FOR_USER=null
AUTH_PROXY_HEADER_FOR_EMAIL=null


# Custom logout URL to open when using an auth proxy.

PROXY_LOGOUT_URL=null


#### WebAuthn settings ####

# Relying Party name, aka the name of the application.
# If blank, defaults to APP_NAME. Do not set to null.

WEBAUTHN_NAME=2FAuth


# Relying Party ID. If null, the device will fill it internally.
# See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#how-to-determine-the-relying-party-id

WEBAUTHN_ID=null

# [DEPRECATED]
# Optional image data in BASE64 (128 bytes maximum) or an image url
# See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#relying-party-icon

# WEBAUTHN_ICON=null
# [/DEPRECATED]


# Use this setting to control how user verification behave during the
# WebAuthn authentication flow.
#
# Most authenticators and smartphones will ask the user to actively verify
# themselves for log in. For example, through a touch plus pin code,
# password entry, or biometric recognition (e.g., presenting a fingerprint).
# The intent is to distinguish one user from any other.
#
# Supported:
#   'required': Will ALWAYS ask for user verification
#   'preferred' (default) : Will ask for user verification IF POSSIBLE
#   'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow)

WEBAUTHN_USER_VERIFICATION=preferred


#### SSO settings (for Socialite) ####

# Uncomment and complete lines for the OAuth providers you want to enable.

# OPENID_AUTHORIZE_URL=
# OPENID_TOKEN_URL=
# OPENID_USERINFO_URL=
# OPENID_CLIENT_ID=
# OPENID_CLIENT_SECRET=

# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=


#### Proxy settings ####

# Use this setting to declare trusted proxied.
# Supported:
#   '*': to trust any proxy
#   A comma separated IP list: The list of proxies IP to trust

TRUSTED_PROXIES=null


# Proxy for outgoing requests like new releases detection or logo fetching.
# You can provide a proxy URL that contains a scheme, username, and password.
# For example, "http://username:[email protected]:10".

PROXY_FOR_OUTGOING_REQUESTS=null


# Leave the following configuration vars as is.
# Unless you like to tinker and know what you're doing.

BROADCAST_DRIVER=log
QUEUE_DRIVER=sync

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_APP_CLUSTER=mt1

VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

MIX_ENV=local

[FrankSchoene]

Same here with 5.0.4 -- I have rolled back to 5.0.2

[FrankSchoene]

Running in Docker on a Synology:

Double-Checked with version 5.1.0
I ran the artisan commands to clear the cache etc., deleted browser cache ...
Tried ASSET_URL (and APP_URL) to be the FQDN, localhost, on http and https (via nginx)

I always get a blank page. I'm again back on 5.0.2

[Bubka]

@FrankSchoene how do you set the env vars? With the cmd line option -e or via a docker-compose file?
Your instance is behind a proxy?

[FrankSchoene]

I just managed to get it working 10mins ago :-)
I use docker-compose files with Portainer GUI or sometimes with Synology GUI.
Yes I'm behind NPM.
Anyhow, I did it from scratch and now it works. Not sure what was wrong before.
But thanks for asking .... love this project. :-)

[daymr]

I just managed to get it working 10mins ago :-) I use docker-compose files with Portainer GUI or sometimes with Synology GUI. Yes I'm behind NPM. Anyhow, I did it from scratch and now it works. Not sure what was wrong before. But thanks for asking .... love this project. :-)

I am trying to do the same setup with portainer and NPM, but receive a blank white screen as well. Do you have any idea how you got it working? I have removed all the images, removed the folder on the host, rebooted, and tried every single suggestion in this thread to no avail. It simply does not work.

ANY help on this would be grealtly appreciated, as the official documentation does not address this issue. Thank you in advance.

[Bubka]

@daymr Open your browser dev tools (F12), on the Network tab. You should see some failed requests for js files. If the domain for those requests is not the same as the domain in the browser address bar then your APP_URL env var is not set correctly. Also, unless you want to fetch js assets from another server, let the ASSET_URL env var commented.

[Akenjeru]

@daymr Open your browser dev tools (F12), on the Network tab. You should see some failed requests for js files. If the domain for those requests is not the same as the domain in the browser address bar then your APP_URL env var is not set correctly. Also, unless you want to fetch js assets from another server, let the ASSET_URL env var commented.

I managed to solve the problem by also rolling back to 5.0.2. I have the following question: I will be directing to my domain through NPM, will I need to register some additional settings or will the settings in NPM and valid SSL be enough?

[Bubka]

@Akenjeru

If the communication between the proxy and 2FAuth is not secured, you need to set the TRUSTED_PROXY env var.

edit: And maybe the PROXY_FOR_OUTGOING_REQUESTS

[Akenjeru]

@Akenjeru

If the communication between the proxy and 2FAuth is not secured, you need to set the TRUSTED_PROXY env var.

and in parament TRUSTED_PROXY set ip NPM, right?

[Bubka]

yes 👍🏻