Can not figure out how to login with correct password.

[sulisu]

Hello, I started rustical with docker-compose.yml

services:
  rustical:
    image: ghcr.io/lennart-k/rustical:main
    container_name: rustical
    ports:
      - "4000:4000"
    volumes:
      - ${PWD}/rustical/config.toml:/etc/rustical/config.toml

Then, I created password hash with following commands and put them in config
docker exec -it rustical /usr/local/bin/rustical pwhash --algorithm argon2
docker exec -it rustical /usr/local/bin/rustical pwhash --algorithm pbkdf2

password is 123456

config.toml

[data_store]
backend = "sqlite"
db_url = ""

[auth]
backend = "static"

[[auth.users]]
id = "default"
displayname = "Default user"
password = "$argon2id$v=19$m=19456,t=2,p=1$KDiKMiJJ3RnZUojM49wx3w$wCnSBm9glJL2xxna++2pW5wDTAS0WPQ8AGkAllj85Co"
app_tokens = ["$pbkdf2-sha256$i=1000,l=32$RGDaZ3tILIRGMmuBhLoUMA$oXCNM6UcrcxYOLWt/TK4utYaH1fWFsjm6JBYTyTb7yM"]

[http]
host = "0.0.0.0"
port = 4000

[frontend]
secret_key = "e773b8322ebf0d3495183fce33761bf76dee224e978a47d89c58679b81b6a24fae35081a8ecef78d3820dd09939af82816ae6aea3e66579cfaf4c8247f35aca5"

[tracing]
opentelemetry = false

But I cannot login web frontend with default:123456, it always return unauthorized. And what the usage of frontend secret_key?

[lennart-k]

Hey, thanks for the report.
I don't yet know why this happens but for me it was fixed by clearing the cookies.
I'll have to take a closer look into this later :/
The secret_key is the key to sign the session cookie since at the moment there's no server-side session store (I might implement one in the future).

[lennart-k]

Okay this problem seems to occur when the Cookie header contains sequences that look url-escaped but don't resolve to valid characters, e.g. %db.
Then when trying to parse the Cookie header containing the session we get a Utf8Error.
That's something actix_web does and I'm not too sure if it should do that.

[lennart-k]

Here's our culprit:
https://docs.rs/actix-web/latest/src/actix_web/request.rs.html#352
I guess actix should either not assume that every cookie is percent-encoded (since it doesn't have to) or give out results on a per-cookie basis.

[lennart-k]

For the record, this is the corresponding issue on the actix-web repo:
actix/actix-web#3542