Error 403 - Dark Mode

[vls2021]

Describe the bug

Dark Mode in AdminLte 3 is returning error 403. Permissions are correct. I've already reviewed the code, and everything is normal.

Steps To Reproduce

Steps to reproduce the behavior:

1. Go to 'Google Chrome F12 '
2. Click on 'Console '
3. Select 'Log XmlHttpRequests'
4. See error

Expected behavior

When I select the icon to activate Dark Mode, the error reported occurs. Some computers work in Dark mode, and save the data in the Database, but in others, it gives a 403 error and does not save the user's option to have or without Dark mode.

Screenshots

Environment

Complete the next environment information.

Item	Version
Laravel	8
Project	Adminlte 3
OS	Linux Amazon EC2

Additional context

Please, help-me. :-)

[dfsmania]

@vls2021 Could you add more detailed info about the error displayed when making the POST to the adminlte/darkmode/toggle route. You can inspect it on the Network tab too.

Also:

1. What version of this package are you using currently?
2. Execute php artisan route:list and check if the darkmode routes are registered in that list.

[vls2021]

What version of this package are you using currently?
R: Version 3.9
Execute php artisan route:list and check if the darkmode routes are registered in that list.
R:

[dfsmania]

What about detailed information of the POST to adminlte/darkmode/toggle route?

[vls2021]

Error 403 appears on this computer. Every time I have to change the dark or light mode, the error occurs in this part of the code.

See:

[dfsmania]

For what I can see, you're hardcoding the X-CSRF-TOKEN and that's a mistake. Laravel's generates a CSRF token for each active session (and they expire when the session ends), so you can't use a hardcoded value, that's why you get 403 Forbidden. Replace your fetch configuration by something like next:

const fetchCfg = {
    headers: {'X-CSRF-TOKEN': '{{ csrf_token() }}' },
    method: 'POST',
};

Read more about this on: https://laravel.com/docs/csrf

[vls2021]

I didn't modify it. It is part of the original AdminLte

Script

[dfsmania]

OK, I see, your previous mage was part of a debug procedure then?

So, if I understood correctly, the Laravel app you created works on some devices (clients) and do not work on other devices? If that's the case, please try to review the logs at the server, there should be a reason it's rejecting the request with 403.

[vls2021]

Correct. I will check if there is any notification in the log.

[vls2021]

logs have no errors

:-(

[dfsmania]

You'll need to track down in the server code in what point that 403 response is generated. You can also try to add a logging middleware to grab more information from each request-response cycle: https://medium.com/@mehhfooz/log-requests-and-responses-in-laravel-f859d1f47b74

It's hard to know how to proceed otherwise...

What's the difference you see in the request-response cycle when it works in comparison when it do not work?

[vls2021]

I'll check. About how it works, it is as follows: The application is hosted on Amazon EC2. In my work the error appears in the debug, but dark mode works. When I do the test at home, or in another location outside of where I work, the error occurs but the operation does not complete, and 403 appears. It's a big mystery.

[dfsmania]

OK, what's that error your are experiencing when the dark mode works?

I'm not sure why the request is rejected by 403 Forbidden, I don't think the related controller method is even hit. Maybe some middleware of the "web" group is rejecting the request, or a firewall in the server, and we need to know why first...

You may add some logs at vendor/jeroennoten/laravel-adminlte/src/Http/Controllers/DarkModeController.php to check if the methods are hit, but it seems the request is rejected before reaching the controller.

[vls2021]

I suspect there is a problem with the session. It is returning in: return session($this->sessionKey); in DarkModeController.php in the IsEnabled function

[dfsmania]

@vls2021 Why would that be an error? That logic inspects if dark mode state is stored in the current user session and uses that value to check whether it's enabled or not. Otherwise it will fallback to the package configuration value (the default one by config). Returning there doesn't mean anything wrong, unless you are experiencing some sort of exception.

[dfsmania]

@vls2021 did you found a solution to this issue?