403 when deleting a comment from different origin

[chendachao]

I got bellow error when deleting a comment from site https://chendachao.netlify.app/.

I know this maybe a cross origin issue but I added the site https://chendachao.netlify.app to isso's configuration file.

The create api work, but the delete api can work. Any suggestions would be appreciate.

[ix5]

How about adding some logging to isso to figure out where exactly it's failing?

A CORS issue would manifest itself a bit differently in the dev console, I'm afraid. Are you sure it's not a cookie/auth issue?

Also, for people to reproduce, it would help to post your whole config file, domain setup (from which to which hosts) and the exact versions of isso and python you use.

[chendachao]

Here's my isso configuation:

[general]
dbpath = /db/comments.db
host = 
  http://127.0.0.1:5500
  http://localhost:5500
  http://127.0.0.1:8088
  http://localhost:8088
  https://chendachao.github.io
  https://chendachao.netlify.app
  https://chendachao.vercel.app
  https://chendachao-github-io.chendachao.vercel.app
max-age = 15m
notify = stdout, smtp
reply-notifications = true
log-file = /log/logs.txt

[server]
listen = http://0.0.0.0:8066/
reload = off
profile = off

[guard]
enabled = true
ratelimit = 20
direct-reply = 10
reply-to-self = true
require-author = true
require-email = false

[markup]
options = strikethrough, superscript, autolink
allowed-elements = img, blockquote, br, code, del, em, h1, h2, h3, h4, h5, h6, hr, ins, ul, li, ol, p, pre, strong, table, tbody, td, th, thead
allowed-attributes = src

The domain https://larrychen.tech/'s nginx proxy configuration:

location / {
        resolver 127.0.0.11 valid=30s;
        proxy_pass https://chendachao.netlify.app;
        proxy_intercept_errors on;
        expires off;
    }

If I delete the comment under domain https://larrychen.tech/, it works well, however in https://chendachao.netlify.app/ it's not.

[thomasjsn]

This error looks very much like the one I got when the SameSite cookie property wasn't set and I was using different domains for the site and comments...