Clojurians Log v2

I tried firing up the new biff, and when I get to the point of pasting the signin link into the browser, I'm getting a GET <http://localhost:8080/api/signed-in> 403 (Forbidden)

there's nothing on the console about the 403.. is there extra logging I can turn on?

hm. probably some issue with setting the session cookie. what's the output of curl -v <signin url> ? what OS/browser are you using?

-&gt; curl -v "<http://localhost:8080/api/signin?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJiaWZmIiwiZXhwIjoxNjA1MDQ0NTg3LCJpYXQiOjE2MDQ5NTgxODcsImVtYWlsIjoiYWJjQGV4YW1wbGUuY29tIn0.DR7x5EFAUWSnddbdI-Ejluz44nCBR1oJ7C2QzMoz4Gg>"

*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8080 (#0)
&gt; GET /api/signin?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJiaWZmIiwiZXhwIjoxNjA1MDQ0NTg3LCJpYXQiOjE2MDQ5NTgxODcsImVtYWlsIjoiYWJjQGV4YW1wbGUuY29tIn0.DR7x5EFAUWSnddbdI-Ejluz44nCBR1oJ7C2QzMoz4Gg HTTP/1.1
&gt; Host: localhost:8080
&gt; User-Agent: curl/7.64.1
&gt; Accept: */*
&gt;
&lt; HTTP/1.1 302 Found
&lt; Location: <http://localhost:8080/app>
&lt; Set-Cookie: csrf=FtfID%2BBc1Odn00q6eHydZBOrygMWFbOq1xuJdU8eVkgDdo2JyGMT39HkCoU0AsQpk%2BajwOVfkJDBD10G;Path=/;Max-Age=7776000;SameSite=Lax
&lt; Set-Cookie: ring-session=ir%2BvyHOgmLipwTSyAJtI%2Bv3HtNwY3pkAskrSb7wtUK3CGsSIJgFajRLM189nlafc15b58%2BsI9jFToEzkkl%2FWjzf2ZmD6UElFdG%2FpPO3MHSb15kOnyCQG58b2qhNiTw4EZO87Lli9dMcmJHfrF%2F9VwamWGYIQRCLpCIHWw3QO%2FqrKWKhNgL%2FUVuw90hQ%2FBoc4VZ8D91H2rOeGFY4KjaiuyeeiKGmxySPqbWspyPGZz22T3vXANepVctmiUAjzBURfwJE3Im5icum4BFEUn8cKUA%3D%3D--FP3SajZqufD%2FzF8UsoF%2BwvS4BbICKC9UL9ZoAxCFa3Q%3D;Path=/;HttpOnly;SameSite=Lax;Max-Age=7776000;Secure=
&lt; Content-Type: application/octet-stream
&lt; X-XSS-Protection: 1; mode=block
&lt; X-Frame-Options: SAMEORIGIN
&lt; X-Content-Type-Options: nosniff
&lt; Transfer-Encoding: chunked
&lt; Server: Jetty(9.4.30.v20200611)
&lt;
* Connection #0 to host localhost left intact
* Closing connection 0

Mac with Chrome

I just looked at the output of that on my machine and noticed something that looks funny (it's in your output as well):

Set-Cookie: ring-session=...;Secure=

yep, it's broken for me too, and looks like OS doesn't matter. Pretty embarrassing. Anyway I'll see if I can get a fix pushed before too many others try it out 🙂

no worries.. thanks for the fast response