If I put the wrong credentials I've got this error message

[Lumiahna]

[candlerb]

My guess would be something wrong with your Apache/Nginx proxy config not setting the X-Forwarded-For: or X-Real-IP: header.

You can find working configs here.

Are you running Netbox standalone or in Docker? And if standalone, which proxy are you using?

[candlerb]

So is demo.netbox.dev, but that doesn't have the problem you report. Therefore, you need to identify what's different about your system.

My guess is that it's to do with incorrect forwarding of the client's IP address, and the tcpdump command I gave will help prove or disprove that. That is: show what actual HTTP headers are being sent from the proxy to Netbox.

It could also help if you show a full backtrace from when the error occurs. You can set ADMINS and EMAIL in configuration.py to have this automatically mailed out to you when an exception occurs, or temporarily set DEBUG=True if configuration.py to have it displayed in the browser.

If we know where the error is raised, it would be possible to make Netbox more robust against misconfiguration.

[strideod]

I am getting a similar problem. I looked at the nginx.conf and there was a change to the server name. I made the change to match the configuration.py then restarted nginx and netbox services. Everything else in the nginx.conf matches the configs mentioned above. I'll see if I can get a debug output in the next few days.

[xcdr]

I have exactly the same problem.

[candlerb]

I suggest that anyone who has this problem tries the debugging steps outlined above:

• Run tcpdump -i lo -nnA -s0 tcp port 8001 and show the full set of headers sent from the proxy to the gunicorn process
• Generate a backtrace

[abhi1693]

I think the issue is due to #14235. Can someone confirm it? If yes, please open a bug report and I'll see if I can help resolve it.

[xcdr]

I found when problem occurs!

I have host without IPv6 (except loopback).

Referenced nginx.conf has bind definition like that listen [::]:443 ssl ipv6only=off; and IP in access log looks like that: ::ffff:10.100.100.1

Error after login with incorrect password was gone after changing bind definition to: listen 0.0.0.0:443 ssl;

[strideod]

I think my config is the same. I'll look tonight and make the change if needed and see if that resolves the issue for me.

[candlerb]

It would still be helpful if you could show the actual HTTP headers from tcpdump, since (a) ::ffff:10.100.100.1 should be parseable, and (b) the error message says that it's trying to parse an empty string.

>>> import netaddr
>>> netaddr.IPAddress('::ffff:10.100.100.1')
IPAddress('::ffff:10.100.100.1')
>>> netaddr.IPAddress('')
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/opt/netbox/venv/lib/python3.8/site-packages/netaddr/ip/__init__.py", line 305, in __init__
    raise AddrFormatError('failed to detect a valid IP ' \
netaddr.core.AddrFormatError: failed to detect a valid IP address from ''
>>>

[strideod]

Here is the output from tcpdump, just left it raw.

�� J   J               � E  <*O@ @��k�  ��  �¶��A¹Yá°     �ÿ×þ0  ��ÿ×���
*�ÔØ    ��� X>je �� J   J               � E  <  @ @�<º�  ��  ��A¶�P�v¹¹Yá± �ÿËþ0  ��ÿ×���
*�ÔØ*�ÔØ��� X>je2�� B   B               � E  4*P@ @��r�  ��  �¶��A¹Yá±P�vº€�� þ(  ���
*�ÔØ*�ÔØX>je“�� §�  §�              � E �™*Q@ @���  ��  �¶��A¹Yá±P�vº€�� �Ž  ���
*�ÔØ*�ÔØPOST /login/ HTTP/1.0
X-Forwarded-Host: netbox.home.life
X-Real-IP: ::ffff:192.168.6.2
X-Forwarded-Proto: https
Host: 127.0.0.1:8001
Connection: close
Content-Length: 126
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="118", "Google Chrome";v="118", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Origin: https://netbox.home.life
DNT: 1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://netbox.home.life/login/?next=/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: csrftoken=XX8JBsDQMOgE5DCx8V0qlJH66X1AbZ8q

csrfmiddlewaretoken=fgyYDFRwYe5PtVr95YZGP37noQyzevyA23wx4XkcASbjooTw3JPW0CEjkDpZfkwQ&next=%2F&username=strid&password=passwordX>je¡�� B   B               � E  4îÔ@ @�Mí�  ��  ��A¶�P�vº¹Yæ�€��÷þ(  ���
*�ÔØ*�ÔØY>jedò� Ë�  Ë�              � E �½îÕ@ @�Lc�  ��  ��A¶�P�vº¹Yæ�€�� ÿ±  ���
*�×®*�ÔØHTTP/1.0 500 Internal Server Error
Server: gunicorn
Date: Fri, 01 Dec 2023 20:13:13 GMT
Connection: close
Content-Type: text/html; charset=utf-8
X-Request-ID: cee52a92-5ff3-4c0f-b5d4-923b80e9a970
Vary: HX-Request, Cookie, origin
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Content-Length: 1644

Y>je�ò� B   B               � E  4*R@ @��p�  ��  �¶��A¹Yæ�P�xC€��ýþ(  ���
*�×®*�×®Y>je¤ò� ®�  ®�              � E � îÖ@ @�G��  ��  ��A¶�P�xC¹Yæ�€�� �•  ���
*�׮*�׮

<!DOCTYPE html>
<html lang="en">

<head>
    <title>Server Error</title>
    <link rel="stylesheet" href="/static/netbox-light.css" />
    <meta charset="UTF-8">
</head>

<body>
    <div class="container-fluid">
        <div class="row">
            <div class="col col-md-6 offset-md-3">
                <div class="card border-danger mt-5">
                    <h5 class="card-header">
                        <i class="mdi mdi-alert"></i> Server Error
                    </h5>
                    <div class="card-body">
                        
                            <p>
                                There was a problem with your request. Please contact an administrator.
                            </p>
                        
                        <hr />
                        <p>
                            The complete exception is provided below:
                        </p>
<pre class="block"><strong>&lt;class &#x27;netaddr.core.AddrFormatError&#x27;&gt;</strong><br />
failed to detect a valid IP address from &#x27;&#x27;

Python version: 3.10.12
NetBox version: 3.6.5
Plugins: None installed
</pre>
                        <p>
                            If further assistance is required, please post to the <a href="https://github.com/netbox-community/netbox/discussions">NetBox discussion forum</a> on GitHub.
                        </p>
                        <div class="text-end">
                            <a href="/" class="btn btn-primary">Home Page</a>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</body>

</html>
Y>je®ò� B   B               � E  4*S@ @��o�  ��  �¶��A¹Yæ�P�~¯€��ôþ(  ���
*�×®*�×®Y>jeÿò� B   B               � E  4*T@ @��n�  ��  �¶��A¹Yæ�P�~¯€�� þ(  ���
*�×®*�×®Y>je-ô� B   B               � E  4î×@ @�Mê�  ��  ��A¶�P�~¯¹Yæ�€�� þ(  ���
*�ׯ*�×®Y>jeCô� B   B               � E  4*U@ @��m�  ��  �¶��A¹Yæ�P�~°€�� þ(  ���
*�ׯ*�ׯ

[candlerb]

Here is the output from tcpdump, just left it raw.

OK, I think I have an idea what might be happening.

I saw recently that somebody had made a patch to separate off the port number for an address, like "1.2.3.4:443". References: commit 217a9ed, #14085, as a workaround for Windows IIS being broken (surprise surprise).

I'm guessing this breaks an IPv6 address like ::ffff:192.168.6.2, because by splitting before the first colon, it leaves ithe IP address empty.

This patch was applied 3 weeks ago, and has been present since v3.6.5

I guess the solution is: if the string contains only a single colon, then do the IIS workaround. Otherwise, don't touch it.