403 on change smtp behind cloudflare

[moofone]

Hi, new to pocketbase here.

I'm trying to test pocketbase on a vps behind a full proxy cloudflare but unable to change smtp data.

Steps to reproduce:

1. create full proxy auth.mydomain.com proxy on cloudflare which points to my vps id (using "full" ssl option)
2. run pocketbase --serve auth.mydomain.com --dev
3. login to https://auth.mydomain.com/_/ and create new user
4. attempt to modify smtp setting for sender from "Support" to "Support2" and it says something went wrong. I get an error 403 on https://auth.mydomain.com/api/settings.

Note1: If I serve --http 0.0.0.0:80 and browse to the ip directly with no cloudflare I can save the same setting.
Note2: If I use nginx to proxy locally ssl into non-ssl 9030 it works as long as I'm hitting the nginx ip directly (and of course with the certificate errors that go with it). But as soon as I hit the cloudflare dns which proxies 443 in, it has the same error with unable to save smtp. so something with cloudflare is not happy.

[ganigeorgiev]

The error is not PocketBase or SMTP related. Based on the status code it looks like the Authorization header is not proxied to the application server.

I don't think I'll be able to help you with the Cloudflare configuration but note that when running the serve command with a domain (in your case auth.mydomain.com) the process will bind to 0.0.0.0:443/0.0.0.0:80 and will issue a Let's Encrypt certificate for the domain. If you are have a reverse proxy (cloudflare, nginx, etc.) that takes care for the certificate then you don't need to specify a domain argument to the command (if you haven't already see also "Using reverse proxy").

[moofone]

Well that's strange. If I use cloudflare transform rules to modify the Authorization header, to something invalid, I can no longer log in (401) via the https://auth.mydomain.com/_/. If I remove the rule, it starts allowing me to log in again. Wouldn't this imply The Authorization header is working correctly?

Its even more strange I can create a collection for example but not modify SMTP settings.

Also in the logs I do see "The request requires valid admin authorization token to be set." when I broke the Authorization header, but no errors otherwise

I also tried using only ./pocketbase serve --https "0.0.0.0:443" and removing the domain, but same thing

[ganigeorgiev]

On second read, if the Authorization: TOKEN header wasn't proxied then the expected error should be 401 and not 403.

The settings APIs are no different then the collections APIs in terms of required permissions so I have no idea why it is failing in your case with 403 only for the settings (double check your custom hooks code if you have any).

Either you are not reporting it correctly or something else is going on in your env setup but the only way to verify it is to create a Cloudflare account and to try it on my own but I'm not willing to invest time doing this as I don't think your problem is PocketBase related.

[ganigeorgiev]

I also tried using only ./pocketbase serve --https "0.0.0.0:443" and removing the domain, but same thing

This will be documented better but you shouldn't use the --https flag if you have a reverse proxy that takes care for the certificate. When the --https flag is provided we try to issue a Let's encrypt certificate with the associated domain/address. See also #3190.