InvalidNonceReferrererror due to missing SCRIPT_URI in Nginx configuration

[skys215]

Hi Matomo team,

I'm encountering an InvalidNonceReferrererror because this core/Nonce.php#L126 if statement returned false due to core/Url.php#L621 can't access $_SERVER['SCRIPT_URI'].

After some research, I learned that SCRIPT_URI needs to be explicitly passed from the web server configuration. However, I noticed that:

1. The current matomo.conf doesn't set this parameter
2. It's also missing from the included fastcgi-php.conf
   I resolved the issue by adding the following to my matomo.conf:

location ~ ^/(index|matomo|piwik|js/index|plugins/HeatmapSessionRecording/configs).php {
  ...
  # other fastcgi_params
  fastcgi_param SCRIPT_URI $scheme://$http_host$request_uri;   #  <-- this line
  fastcgi_pass php-handler;
  ...
}

Would this be the correct fix? If so, I'd be happy to submit a pull request with this change in the coming days.
Thanks for your time and for maintaining Matomo!

[williamdes]

It seems valid, you should make a pull request for it

fastcgi_param SCRIPT_URI $scheme://$http_host$request_uri; can be found on https://mailman.nginx.org/pipermail/nginx/2016-July/051400.html
so it should be correct

Given that I do not find a lot of results on https://github.com/search?q=%22fastcgi_param+SCRIPT_URI%22&type=code

Adding this is suspicious

Same using https://github.com/search?q=org%3Aphp+SCRIPT_URI&type=code

Very weird that I find not much hits