Not sure if this can be the issue but from here: Shiny Server v1.5.20 Configuration Reference
7.3.1.2 Custom login templates now must include a CSRF token field
Shiny Server Pro 1.4.6 includes mitigations against CSRF attacks. For the most part, this should not affect your installation of Shiny Server Pro. The exception is if you are using a custom template for your login page. In that case, you’ll need to add a new field to your login
<form>tag:<input id="csrfToken" type="hidden" name="_csrf" value="{{csrf_token}}"/>
I tried to copy the request from the login page and that seems to be a difference (together with the appUri value):
cURL request
rocker/rstudio:4.0.2 (rstudio server 1.3.x):
…
–data-raw ‘username=maffiaa&password=test&csrf-token=MISSING+VALUE&appUri=’
…
rocker/rstudio:4.0.4 (rstudio server 1.4.x):
…
–data-raw ‘username=maffiaa&password=test&csrf-token=db0dc73d-2964-4325-85cf-664274bffd39&appUri=%2F’
…
But I’m not sure how to define the token and not even 100% sure that’s the issue.
Edit:
I could not find any option to disable this check but is seems that’s the issue:
This works:
$ curl ‘URL:PORT/auth-do-sign-in’ -H ‘Cookie: csrf-token=TOKEN’ --data-raw ‘username=USERID&password=PASSWORD&csrf-token=TOKEN&appUri=’
This doesn’t work:
$ curl ‘URL:PORT/auth-do-sign-in’ --data-raw ‘username=USERID&password=PASSWORD&csrf-token=TOKEN&appUri=’
I really used “TOKEN” as token and it worked but it needs to have it as cookie (I couldn’t find if it is stored on the server side).
I’ll stop here and see if anyone can help from this point.
Edit 2:
I just figured out this was mentioned already here: Unable to launch fully containerized Rstudio - #20 by dugan