How to configure the backend access path in web.env

[lij82304885]

Self Checks

• I have read the Contributing Guide and Language Policy.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

The web project I started locally is deployed with Docker as the backend. I have already opened API port 5001. After the startup is completed,/signin keeps requesting, causing the page to keep refreshing. I don't know where the problem is now

2. Additional context or comments

No response

3. Can you help us with this feature?

• I am interested in contributing to this feature.

[lij82304885]

[dosubot[bot]]

Your CORS error and signin loop are almost certainly caused by a mismatch between your frontend and backend configuration. Here’s what to check and fix:

1. Make sure your frontend’s NEXT_PUBLIC_API_PREFIX and NEXT_PUBLIC_PUBLIC_API_PREFIX in .env.local point to the public endpoint exposed by nginx (for example, http://your-nginx-domain/api), not directly to the backend container’s port. If you’re running everything on the same machine and network, http://localhost:5001/console/api can work, but if you’re using Docker with nginx as a reverse proxy, use the nginx public URL instead. The browser must be able to reach these URLs directly, and they must match what nginx is proxying to the backend [source].

2. In your backend .env file, set WEB_API_CORS_ALLOW_ORIGINS and CONSOLE_CORS_ALLOW_ORIGINS to the exact origin (protocol, domain/IP, and port) you use to access the frontend in your browser. For example, if you access the frontend at http://192.168.1.100:3000, set:

   WEB_API_CORS_ALLOW_ORIGINS=http://192.168.1.100:3000
   CONSOLE_CORS_ALLOW_ORIGINS=http://192.168.1.100:3000
   

   For development, you can use * to allow all origins, but for production, specify the real domain [source].

3. All backend API URL environment variables (CONSOLE_API_URL, SERVICE_API_URL, APP_API_URL, APP_WEB_URL, etc.) must match the actual endpoints and what the browser and nginx use. Mismatches here can cause authentication failures and signin loops [source].

4. The SECRET_KEY must be identical across all backend containers/services. If it’s not, JWT tokens will be invalid and you’ll get signin loops or 401 errors [source].

5. For IP-based access, leave COOKIE_DOMAIN empty in both frontend and backend. Only set it if you’re using real subdomains and need to share cookies. Setting it to 1 is not correct unless you have a specific reason.

6. If you’re using nginx or any reverse proxy, set RESPECT_XFORWARD_HEADERS_ENABLED=true in your backend .env to ensure headers are forwarded correctly [source].

After making these changes, rebuild and redeploy the frontend (Next.js reads env vars at build time), restart all backend containers, and clear your browser cache/cookies. If the signin loop continues, check your browser’s network tab for failed requests or CORS errors, and verify that cookies are being set correctly.

If you’re still stuck, share your sanitized .env and nginx config for more targeted troubleshooting.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[dosubot[bot]]

The signin loop and CORS errors are likely caused by a mismatch between your frontend and backend configuration. Here’s how to fix it:

1. Make sure your frontend’s NEXT_PUBLIC_API_PREFIX and NEXT_PUBLIC_PUBLIC_API_PREFIX point to the public endpoint exposed by nginx (e.g., http://your-nginx-domain/api), not directly to the backend container’s port. In Docker setups, the default localhost:5001 only works if everything is on the same internal network—otherwise, use the nginx public URL instead (details).

2. In your backend’s .env file, set WEB_API_CORS_ALLOW_ORIGINS and CONSOLE_CORS_ALLOW_ORIGINS to the exact origin (protocol, domain, and port) of your frontend. For example:

   WEB_API_CORS_ALLOW_ORIGINS=http://your-frontend-domain:port
   CONSOLE_CORS_ALLOW_ORIGINS=http://your-frontend-domain:port
   

   For development, you can use * to allow all origins, but for production, specify the real domain (reference).

3. If you’re using nginx or any reverse proxy, set RESPECT_XFORWARD_HEADERS_ENABLED=true in your backend .env to ensure headers are forwarded correctly (reference).

4. After changing any environment variables, you must rebuild and redeploy the frontend container (not just restart it), since Next.js reads these at build time. Also, restart the backend after updating CORS variables (reference).

5. Clear your browser cache if you still see issues with signin or page loading.

If the signin loop continues, check your browser’s network tab for failed requests or CORS errors, and verify that cookies are being set correctly. If you want, share your backend .env and nginx config for a more targeted review.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[RaviTharuma]

were you able to solve this meanwhile?