0

I was unable to run typesafe activator in cloud9 :

The activator page loads OK but then I get the following error messages :

  • in the browser :

"Connection lost; you will need to reload the page or restart Activator. It's also possible that Activator is open in another tab, which causes this error."

  • in the cloud9 terminal :

"! @6j9pn9913 - Internal server error, for (GET) [/home/stream?token=cba94...64394] -> play.api.Application$$anon$1: Execution exception[[RuntimeException: Bad CSRF token for websocket]]"

Any help on how to solve this ?

John Powell
  • 12,253
  • 6
  • 59
  • 67
Laurent Blain
  • 11
  • 1
  • Where is the browser running, is it on your local computer and activator is on the cloud 9 VM? how is cloud 9 set up? You may have to use plain `activator shell` and not `activator ui`, the activator UI is not really intended to be available on the public internet (anyone could delete your files), though I don't know exactly why it is failing in that way... – Havoc P Aug 21 '14 at 21:29
  • @Havoc P - You guessed right : The browser is running on my local computer and activator is on the Cloud9 VM. No special setup for Cloud9, I installed activator in the workspace from a terminal. All this might not be secured but it is just to play with scala and activator. Tx – Laurent Blain Aug 21 '14 at 21:48

1 Answers1

0

Activator listens on 127.0.0.1 and is not even supposed to be listening on an external interface; it isn't completely clear to me why you can connect to it at all.

But however that connection works, it looks like the result is that the CSRF check fails. The CSRF check is checking that the query parameter there (?token=cba94...) matches a cookie that should have been set by the Activator page load. This demonstrates that the /home/stream request (to open the websocket) is coming from a page that has the cookie, i.e. from the same domain. Perhaps Activator doesn't know the domain you are loading the page from and therefore the cookie gets lost? Just a guess.

When the CSRF check fails that would then fail the websocket and cause the "Connection lost" error, though that error can also be caused by other things (such as proxies and antivirus software) that interfere with websockets.

You could possibly fix this, or take a step towards fixing this, by configuring the http.address system property to be picked up here: https://github.com/typesafehub/activator/blob/52012321b3a5a9f9dcf53582664e385d92763718/ui/app/activator/UIMain.scala#L130 You could also try setting application.defaultCookieDomain to the domain you are using (this is a Play config option and Activator's UI is a play app).

However:

  • you may well find other bugs in this scenario - it is not tested or supported
  • it is not at all secure unless you have some kind of authenticated proxy in front of it (there's no auth on the activator UI, and the UI has buttons to view and delete files, etc).

The activator shell command line is maybe a better option when you have your project build on a headless server, though I won't say running the UI is 100% impossible - you might be able to get it to work.

Havoc P
  • 8,365
  • 1
  • 31
  • 46
  • Tx Havoc for the answer, it will certainly help me finding a way to make this work :) To be able to access activator ui from an external interface, I use `-Dhttp.address=$IP` and `-Dhttp.port=$PORT`, `$IP` and `$PORT` being Cloud9 env variables pointing to an open external interface. As you mention I guess there's a might be a proxy or something on Cloud9 interfering somewhere. Fun and instructive to try this though ;-) – Laurent Blain Aug 22 '14 at 08:23
  • The Cloud9 proxy sends everything to the backend but indeed the cookiedomain must be relative to the *.c9.io workspace name. – lcipriani Aug 25 '14 at 15:09