Can't login to fresh install: Logout requested by modoboa_frontend

[mickmoon]

With a fresh install of modoboa, I get the initial login page ok and write "admin" and "password" in the boxes, and the result is a blank page with a popup saying "Confirm Logout requested by modoboa_frontend" with Cancel and Logout buttons. I can't get any further.

If I hit "Logout" it takes me back to the login page; if I hit Cancel I get another popup saying "Error: logout_denied Logout has been refused by the user." The password is presumably correct because if I try something else I get a red box telling me it's wrong.

Possibly relevant, but I hope not, is that the server running modoboa is accessed via an http proxy server (running haproxy), and to make it work at all, the domain used has its DNS A record set to the IP of the front end server, which is running haproxy and forwarding the connection to the backend server running modoboa.

Any ideas how to deal with this please?

[mickmoon]

Why does this happen?

DNS resolves locally to the local host, not to proxy.
hostname is correct.
Can't find any error messages in logs, but just wants to logout immediately.
/var/log/auth.log says:
2026-04-22T14:57:04.722100+00:00 owl modoboa.auth: INFO User 'admin' successfully logged in

But then /var/log/uwsgi/app/modoboa_instance.log says:
(my real domain replaced by "mydomain.com" :))
/var/log/uwsgi/app/modoboa_instance.log:
mail.mydomain.com [pid: 1127|app: 1|req: 7/30] 79.117.104.178 () {66 vars in 1496 bytes} [Wed Apr 22 14:57:03 2026] POST /accounts/login/ => generated 0 bytes in 1401 msecs (HTTP/2.0 302) 11 headers in 871 bytes (2 switches on core 0)
mail.mydomain.com [pid: 1127|app: 1|req: 8/31] 79.117.104.178 () {60 vars in 1958 bytes} [Wed Apr 22 14:57:04 2026] GET /api/o/authorize/?client_id=996ce0d4-4171-4716-914b-4d71c5912cfe&redirect_uri=https%3A%2F%2Fmail.mydomain.com%2Flogin%2Flogged&response_type=code&scope=openid+read+write&state=6c063b87681543b5a4c53f19608b2118&code_challenge=5PH7n-kTUqcHaQ7SUWu5ujcYyiYWRLePAEL3Y_d_ADE&code_challenge_method=S256 => generated 0 bytes in 237 msecs (HTTP/2.0 302) 6 headers in 296 bytes (2 switches on core 0)
mail.mydomain.com [pid: 1129|app: 1|req: 15/32] 79.117.104.178 () {56 vars in 1088 bytes} [Wed Apr 22 14:58:41 2026] GET /api/o/.well-known/openid-configuration => generated 848 bytes in 172 msecs (HTTP/2.0 200) 6 headers in 186 bytes (2 switches on core 0)
mail.mydomain.com [pid: 1127|app: 1|req: 9/33] 79.117.104.178 () {62 vars in 1167 bytes} [Wed Apr 22 14:58:42 2026] POST /api/o/token/ => generated 26 bytes in 204 msecs (HTTP/2.0 400) 7 headers in 205 bytes (1 switches on core 0)
mail.mydomain.com [pid: 1128|app: 1|req: 9/34] 79.117.104.178 () {54 vars in 1009 bytes} [Wed Apr 22 14:58:42 2026] GET /api/v2/theme/ => generated 58 bytes in 175 msecs (HTTP/2.0 401) 7 headers in 236 bytes (1 switches on core 0)
mail.mydomain.com [pid: 1128|app: 1|req: 10/35] 79.117.104.178 () {58 vars in 1229 bytes} [Wed Apr 22 14:58:42 2026] GET /api/o/logout/?client_id=996ce0d4-4171-4716-914b-4d71c5912cfe&post_logout_redirect_uri=https%3A%2F%2Fmail.mydomain.com => generated 2968 bytes in 201 msecs (HTTP/2.0 200) 6 headers in 315 bytes (1 switches on core 0)

[tonioo]

Looks like token creation request is failing with a 400 error. Have you checked in the browser console (network tab) if you see any error?

[mickmoon]

Thank you, yes, looking in the browser console network tab as you suggest, I see:
Request URL https://mail.(mydomain)/api/o/token/
Request Method POST
Status Code 400 Bad Request
Remote Address xxx.xxx.xxx.xxx:443
Referrer Policy strict-origin-when-cross-origin

• and the remote address it quotes is the address I call the proxy with. It's not the address that the backend running modoboa sees, because the backend only has IPv6 connectivity, and I only have IPv4. The proxy machine has both, so my browser calls it using IPv4, and it (haproxy) passes the request on over IPv6. Could that be an issue?
  The nginx on the backend is using proxy_protocol etc. and correctly logs my own IPv4 address.

[mickmoon]

P.S. I followed the advice of manf0001 at modoboa/modoboa#2419 and mail.(mydomain) resolves on the backend machine to the local IP. This made no difference to my failure to login; it was similarly not working before I did that.

P.P.S. to be more accurate, I do log in correctly, but modoboa_frontend immediately insists on logging me out again.

[tonioo]

Are you sure the hostname seen by the django instance is properly defined in the ALLOWED_HOSTS setting?

[mickmoon]

Yes.
EDIT: The hostname is logged by nginx, and also if I change it in settings.py I don't even get a login page, just "Attempting to log you in" and a spinner which never stops.

Also, by the way, /var/log/auth.log says:
2026-04-21T09:50:32.629024+00:00 (hostname) modoboa.auth: INFO User 'admin' successfully logged in

I've also set DEBUG=True in settings.py, but get no errors of that kind anyway.

[tonioo]

Can you look at the response tab availble with the failing request?

[mickmoon]

It says:

Failed to load response data
No resource with given identifier found

• in fact, most of the responses say that, it's just the really static resources with no random string identifier in the URL that show anything in their response pane (although they have all succeeded as requests, with a 200 status, not a 4xx).

EDIT: The response tabs do show meaningful responses until the token/ url appears and then they show the "failed to load..." message.