Skip to Content
Last modified by Alexandru Pentilescu on 2023/06/25 18:56
From version 46.1
edited by Alexandru Pentilescu
on 2022/06/09 23:19
Change comment: There is no comment for this version
To version 47.1
edited by Alexandru Pentilescu
on 2022/06/09 23:25
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -277,7 +277,14 @@
277 277  Please be sure to use the appropriate IP address as configured in your "docker-compose.yml" file for your xwiki service.
278 278  For more information about postfix and setting it up, please visit the "How to setup a postfix SMTP server" article in the external references section at the bottom of this article!
279 279  
280 -== Modifying cookie encryption keys==
280 +
281 +=== Correcting "localhost" directing URLs in received emails ===
282 +
283 +This might be just a problem on my end but, after configuring my SMTP server and then requesting an unnecessary password reset for my account to test my configuration, the arrived email contained a password-reset URL which, instead of pointing to my server, as it should have, it pointed to http://localhost:8081. This is obviously wrong and NOT correct.
284 +Fix: go to "<your XWiki directory>/data/xwiki-data/data/" and open the "xwiki.cfg" configuration file there. Find the "xwiki.home" configuration option in that file, uncomment it if you have to, and set it to point to your actual fully qualified domain name (including the trailing "/" at the end) to correct this issue. Please remember to restart the XWiki docker container afterwards for the changes to take effect!
285 +
286 +== Modifying cookie encryption keys ==
287 +
281 281  XWiki has an interesting login mechanism. It doesn't use session tokens to keep track of your user account. What it does do is that it stores two session cookies in your browser: one for your username and one for your password.
282 282  Every time you make a request to your server, these two session cookies are sent along with each request, effecitvely authenticating it.
283 283  This might seem as a huge security problem, as the password is stored in the session cookie and it can be easily viewed by anyone with local access to the web browser's machine.