The client is not authorized. Request failed with status code 419. Removing token and session.

2
Hi,   I am getting this error when logging in locally :   The client is not authorized. Request failed with status code 419. Removing token and session.   Sometimes it needs for me to press the login button twice to actually log in, but in some cases it logs the user in with a single click of the login button, but I still get this error in the console. The app is started from scratch so no stuck sessions in it.    Could you please help me out with a solution to this?   Thanks. 
asked
3 answers
5

Hi.  In case this helps anyone who searches for this on a later occasion.  I was getting the same error.  I was running a new blank app that I had set up to test something, so I spent some time scratching my head wondering what was wrong.  The Native app wouldn’t start and then I noticed that the message was being generated by an open web page, each time I restarted the app.  Then I rebooted my PC and the error went away.  The problem was probably due to having run another app before running this one and something not getting cleared down.

answered
0

Hello

I have the same issue, but only in Chrome, whereas in Firefox it works.

I'm debugging the network calls, and I see that the second POST to /xas returns 401 to Chrome and 200 to Firefox. The only differences I see the Cookies. With Chrome, there are very few Cookies compared to Firefox. As an example, XAS_SESSIONID is not set in Chrome....

 

I'm still debugging...

answered
0

I finally managed to solve it and I share my solution.

The problem comes from the fact that Mendix Runtime returns this response header to the first request POST /xas that generates the user session : 

Set-Cookie
	__Host-XASSESSIONID=4e096fdc-56fa-42b4-8e37-e6c9b807c783; Path=/; Secure; HttpOnly; SameSite=Strict

 

It is accepted by Firefox but not by Chrome because of the security rules (https://www.ietf.org/archive/id/draft-west-cookie-prefixes-05.txt) that don't accept cookies with prefix __Host on a http connexion.

 

So the solution was to say to mendix that it runs in http by setting this environment variable 

MXRUNTIME_ApplicationRootUrl=http://localhost:8080

 

That explains why the behaviour is different when you run the app in the Mendix studio (it uses http), and in a Docker image with the MXRUNTIME_ApplicationRootUrl variable.

answered