Can't post with GoToSocial

[moan0s]

Describe the bug
Can't post with GoToSocial

• Which site: phanpy.social

To Reproduce
Steps to reproduce the behavior:

1. Login with a GoToSocial Account
2. Write a post and click post
3. See error (CORS Missing allow header)

Expected behavior
a post to be sent

Response header data

HTTP/2 204 No Content
access-control-allow-headers: Origin,Content-Length,Content-Type,Authorization,Upgrade,Sec-Websocket-Extensions,Sec-Websocket-Key,Sec-Websocket-Protocol,Sec-Websocket-Version,Connection
access-control-allow-methods: POST,PUT,DELETE,GET,PATCH,OPTIONS
access-control-allow-origin: *
access-control-max-age: 120
content-security-policy: frame-ancestors 'self'
date: Fri, 31 Mar 2023 12:04:34 GMT
permission-policy: interest-cohort=()
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: yggrwdw704001hhvymg0
x-xss-protection: 1; mode=block
X-Firefox-Spdy: h2

Desktop (please complete the following information):

• OS: linux
• Browser: firefox
• Version: 111.0.1

Additional context
Posting works with Pinafore.

The GoToSocial server has the following traefik (reverse proxy) configuration.

traefik.docker.network=traefik

traefik.http.middlewares.mash-gpa-gotosocial-add-response-headers.headers.customresponseheaders.X-XSS-Protection=1; mode=block
traefik.http.middlewares.mash-gpa-gotosocial-add-response-headers.headers.customresponseheaders.X-Frame-Options=SAMEORIGIN
traefik.http.middlewares.mash-gpa-gotosocial-add-response-headers.headers.customresponseheaders.X-Content-Type-Options=nosniff
traefik.http.middlewares.mash-gpa-gotosocial-add-response-headers.headers.customresponseheaders.Content-Security-Policy=frame-ancestors 'self'
traefik.http.middlewares.mash-gpa-gotosocial-add-response-headers.headers.customresponseheaders.Permission-Policy=interest-cohort=()
traefik.http.middlewares.mash-gpa-gotosocial-add-response-headers.headers.customresponseheaders.Strict-Transport-Security=max-age=31536000; includeSubDomains

traefik.enable=true
traefik.http.routers.mash-gpa-gotosocial.rule=Host("gay-pirate-assassins.de")
traefik.http.routers.mash-gpa-gotosocial.middlewares=mash-gpa-gotosocial-add-response-headers
traefik.http.routers.mash-gpa-gotosocial.service=mash-gpa-gotosocial
traefik.http.routers.mash-gpa-gotosocial.entrypoints=web-secure
traefik.http.routers.mash-gpa-gotosocial.tls=true
traefik.http.routers.mash-gpa-gotosocial.tls.certResolver=default
traefik.http.services.mash-gpa-gotosocial.loadbalancer.server.port=8080

[cheeaun]

Hey, thanks for the bug report. I'll probably need more info and time to fix this since I don't have a test account for any GoToSocial instance(s).

As for the "Response header data", is that from the POST call?

[moan0s]

Yes, that is from the POST call.

Feel free to send me a DM (e.g. to @moanos@chaos.social) for a throwaway account on the instance (or just ask questions and I'll try to provide answers)

[cheeaun]

@moan0s looks like the bug is fixed on GTS's side in the mentioned issue, maybe need to update your instance's GTS (or wait for the next release?) to see if it works 🤞

[moan0s]

Thank you a lot. I just tried but building GtS from source and putting it in a docker container is not something that I can do with my ansible setup (in reasonable time) so I'll wait for the next release and report back

[moan0s]

I can now confirm that GoTosocial version 0.8.0-rc1 fixes the problem. Thank you very much for digging up what was wrong!

[moan0s]

This bug seems to have resurfaced with GTS 13.0.x. Will reopen in GTS, just wanted to let interested users here too