HTTP 403 Error after syncing commits and deploy

[fluxgravity]

Hi, I'm wondering if others also experienced this issue. After syncing my forked repo with the upstream repo, my app on Heroku started to give the following browser error:

Access to [app_name].herokuapp.com was denied You don't have authorization to view this page. HTTP ERROR 403

I tailed my heroku log and noticed that my host was blocked:

2024-12-05T22:09:26.778033+00:00 app[web.1]: E, [2024-12-05T22:09:26.777931 #26] ERROR -- : [ActionDispatch::HostAuthorization::DefaultResponseApp] Blocked hosts: [app_name].herokuapp.com

I have the PRODUCTION_HOST set in my Heroku config variables. I also ran rails console and checked the environment variable (ENV["PRODUCTION_HOST"]) and configured hosts (Rails.application.config.hosts). Both of them returned the correct host name.

Some additional additional context. My recent fork sync was with the Dec 4th upstream commit (d0e8738) and the prior sync was with the Oct 31st commit (db435e7).

Unfortunately, I wasn't able to resolve the issue and decided to revert to the Oct 31 version to continue using my app and try another day. In the meantime, has anyone run into this and had luck resolving it? Thank you.

[krschacht]

Sorry for the slow reply! I'm surprised that you ran into an issue. We did add an additional configuration to hosts (the APP_URL_HOST) but you should not need to do anything with that. This is just for an optimization and the fact that you double checked Rails.application.config.hosts makes it even more surprising.

I run a heroku instance of the app for testing purposes and i just made sure it deployed the latest version and it's working fine for me. I too am only using the [host].herokuapp.com name. But notably, in my instance PRODUCTION_HOST is not set at all. It's not actually needed it's just recommended for a rare kind of spoof attack (which I, admittedly, don't fully understand).

Could you try temporarily clearing your PRODUCTION_HOST and seeing if the app works that way? It's also possible we fixed the issue in between when you experienced it and the latest commit to main, but I doubt that since I don't think we've done any further changes related to this.

[fluxgravity]

I appreciate the help. I cleared PRODUCTION_HOST and deployed the latest commit to Heroku. That seems to have fixed the issue - not sure exactly what did the trick, but I no longer get the 403 error. I think I'll leave the var out of my app if it's not required. Thank you!