BookStack MFA Issues After Script Updating to v24.10.3 #224

Closed
opened 2025-11-20 04:45:11 -05:00 by saavagebueno · 2 comments
Owner

Originally created by @clipz98 on GitHub (Dec 20, 2024).

Originally assigned to: @michelroegl-brunner on GitHub.

Have you read and understood the above guidelines?

yes

📜 What is the name of the script you are using?

BookStack

📂 What was the exact command used to execute the script?

update

📝 Provide a clear and concise description of the issue.

I saw the changelog item for 12-19-2024 that said "Fix: Bookstack Update Function" and decided to update my BookStack instance. After updating to v24.10.3 (from 24.10.1) today, I couldn't access my account (which is MFA enabled) and would get the error "An unknown error occurred" every time after submitting my TOTP code.

I don't think this is a version issue, but rather an issue related to the script updates potentially overwriting a file or value. Please see what I mean below:

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 12

🔄 Steps to reproduce the issue.

  1. I first did an apt update/upgrade prior to updating (which had some php updates as well, so I wasn't initially sure if it was part of the issue): apt update && apt upgrade
 php-symfony-finder php-symfony-process php-symfony-string php8.2-bz2 php8.2-cli
 php8.2-common php8.2-curl php8.2-fpm php8.2-gd php8.2-intl php8.2-ldap
 php8.2-mbstring php8.2-mysql php8.2-opcache php8.2-readline php8.2-tidy
 php8.2-xml php8.2-zip tzdata```
  1. Updated BookStack inside the LXC successfully to v24.10.3: update

  2. Logged back into BookStack with my email and password successfully

  3. After submitting the TOTP numbers for MFA, it failed to proceed further: An unknown error occurred

  4. Restored the lxc from this morning's backup and was able to log back into BookStack normally.

  5. Took a manual ZFS snapshot in Proxmox of the restored lxc so that I could easily go back to my last known working config (and not have to destroy/recreate the lxc each time via backup)

  6. Attempted to update via the script again WITHOUT any apt updates/upgrades this time: update

  7. Logged back into BookStack and ran into the same issue after submitting MFA : An unknown error occurred

  8. Restored the snapshot in Proxmox and resurrected my instance again

Paste the full error output (if available).

[2024-12-20 16:03:55] production.ERROR: The MAC is invalid. {"exception":"[object] (Illuminate\Contracts\Encryption\DecryptException(code: 0): The MAC is invalid. at /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php:222)
[stacktrace]
#0 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php(151): Illuminate\Encryption\Encrypter->getJsonPayload()
#1 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php(373): Illuminate\Encryption\Encrypter->decrypt()
#2 /opt/bookstack/app/Access/Mfa/MfaValue.php(66): decrypt()
#3 /opt/bookstack/app/Access/Mfa/MfaValue.php(58): BookStack\Access\Mfa\MfaValue->getValue()
#4 /opt/bookstack/app/Access/Controllers/MfaTotpController.php(89): BookStack\Access\Mfa\MfaValue::getValueForUser()
#5 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): BookStack\Access\Controllers\MfaTotpController->verify()
#6 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(43): Illuminate\Routing\Controller->callAction()
#7 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(259): Illuminate\Routing\ControllerDispatcher->dispatch()
#8 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\Routing\Route->runController()
#9 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(806): Illuminate\Routing\Route->run()
#10 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\Routing\Router->Illuminate\Routing\{closure}()
#11 /opt/bookstack/app/Http/Middleware/RedirectIfAuthenticated.php(28): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#12 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\RedirectIfAuthenticated->handle()
#13 /opt/bookstack/app/Http/Middleware/Localization.php(32): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#14 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\Localization->handle()
#15 /opt/bookstack/app/Http/Middleware/RunThemeActions.php(26): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#16 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\RunThemeActions->handle()
#17 /opt/bookstack/app/Http/Middleware/CheckEmailConfirmed.php(47): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#18 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\CheckEmailConfirmed->handle()
#19 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#20 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle()
#21 /opt/bookstack/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#22 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\View\Middleware\ShareErrorsFromSession->handle()
#23 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#24 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\Session\Middleware\StartSession->handleStatefulRequest()
#25 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Session\Middleware\StartSession->handle()
#26 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#27 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle()
#28 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#29 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Cookie\Middleware\EncryptCookies->handle()
#30 /opt/bookstack/app/Http/Middleware/ApplyCspRules.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#31 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\ApplyCspRules->handle()
#32 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#33 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(805): Illuminate\Pipeline\Pipeline->then()
#34 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(784): Illuminate\Routing\Router->runRouteWithinStack()
#35 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(748): Illuminate\Routing\Router->runRoute()
#36 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(737): Illuminate\Routing\Router->dispatchToRoute()
#37 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(200): Illuminate\Routing\Router->dispatch()
#38 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}()
#39 /opt/bookstack/app/Http/Middleware/PreventResponseCaching.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#40 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\PreventResponseCaching->handle()
#41 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(39): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#42 /opt/bookstack/app/Http/Middleware/TrustProxies.php(41): Illuminate\Http\Middleware\TrustProxies->handle()
#43 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\TrustProxies->handle()
#44 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#45 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(40): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle()
#46 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\TrimStrings->handle()
#47 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#48 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle()
#49 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(99): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#50 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance->handle()
#51 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#52 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(175): Illuminate\Pipeline\Pipeline->then()
#53 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(144): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter()
#54 /opt/bookstack/public/index.php(52): Illuminate\Foundation\Http\Kernel->handle()
#55 {main}
"}
[2024-12-20 16:06:44] production.ERROR: The MAC is invalid. {"exception":"[object] (Illuminate\Contracts\Encryption\DecryptException(code: 0): The MAC is invalid. at /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php:222)
[stacktrace]
#0 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php(151): Illuminate\Encryption\Encrypter->getJsonPayload()
#1 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php(373): Illuminate\Encryption\Encrypter->decrypt()
#2 /opt/bookstack/app/Access/Mfa/MfaValue.php(66): decrypt()
#3 /opt/bookstack/app/Access/Mfa/MfaValue.php(58): BookStack\Access\Mfa\MfaValue->getValue()
#4 /opt/bookstack/app/Access/Controllers/MfaTotpController.php(89): BookStack\Access\Mfa\MfaValue::getValueForUser()
#5 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): BookStack\Access\Controllers\MfaTotpController->verify()
#6 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(43): Illuminate\Routing\Controller->callAction()
#7 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(259): Illuminate\Routing\ControllerDispatcher->dispatch()
#8 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\Routing\Route->runController()
#9 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(806): Illuminate\Routing\Route->run()
#10 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\Routing\Router->Illuminate\Routing\{closure}()
#11 /opt/bookstack/app/Http/Middleware/RedirectIfAuthenticated.php(28): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#12 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\RedirectIfAuthenticated->handle()
#13 /opt/bookstack/app/Http/Middleware/Localization.php(32): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#14 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\Localization->handle()
#15 /opt/bookstack/app/Http/Middleware/RunThemeActions.php(26): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#16 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\RunThemeActions->handle()
#17 /opt/bookstack/app/Http/Middleware/CheckEmailConfirmed.php(47): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#18 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\CheckEmailConfirmed->handle()
#19 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#20 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle()
#21 /opt/bookstack/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#22 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\View\Middleware\ShareErrorsFromSession->handle()
#23 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#24 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\Session\Middleware\StartSession->handleStatefulRequest()
#25 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Session\Middleware\StartSession->handle()
#26 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#27 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle()
#28 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#29 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Cookie\Middleware\EncryptCookies->handle()
#30 /opt/bookstack/app/Http/Middleware/ApplyCspRules.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#31 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\ApplyCspRules->handle()
#32 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#33 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(805): Illuminate\Pipeline\Pipeline->then()
#34 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(784): Illuminate\Routing\Router->runRouteWithinStack()
#35 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(748): Illuminate\Routing\Router->runRoute()
#36 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(737): Illuminate\Routing\Router->dispatchToRoute()
#37 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(200): Illuminate\Routing\Router->dispatch()
#38 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}()
#39 /opt/bookstack/app/Http/Middleware/PreventResponseCaching.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#40 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\PreventResponseCaching->handle()
#41 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(39): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#42 /opt/bookstack/app/Http/Middleware/TrustProxies.php(41): Illuminate\Http\Middleware\TrustProxies->handle()
#43 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\Http\Middleware\TrustProxies->handle()
#44 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#45 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(40): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle()
#46 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\TrimStrings->handle()
#47 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#48 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle()
#49 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(99): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#50 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance->handle()
#51 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#52 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(175): Illuminate\Pipeline\Pipeline->then()
#53 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(144): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter()
#54 /opt/bookstack/public/index.php(52): Illuminate\Foundation\Http\Kernel->handle()
#55 {main}
"}

🖼️ Additional context (optional).

From what I learned, it's possible that the mechanism that's updating the lxc is also changing the APP_KEY created by php artisan key:generate from the initial install, meaning it can't decrypt any older values (in this case, the previous TOTP info). My only clue that led to that conclusion was the line in the logs I posted above (found in /opt/bookstack/storage/logs) that said ERROR: The MAC is invalid, which I learned is a universal error related to the Laravel PHP framework in general (rather than a specific BookStack error).

Not sure how many others are using MFA to test this out, but this could definitely be an issue if you don't have frequent backups and update blindly. I noticed the bookstack.sh/bookstack-install.sh scripts have php artisan key:generate --no-interaction --force on there prior to the php artisan migrate, which probably isn't a necessary step because of an issue like this if I'm understanding their normal update procedures correctly.

Originally created by @clipz98 on GitHub (Dec 20, 2024). Originally assigned to: @michelroegl-brunner on GitHub. ### ✅ Have you read and understood the above guidelines? yes ### 📜 What is the name of the script you are using? BookStack ### 📂 What was the exact command used to execute the script? update ### 📝 Provide a clear and concise description of the issue. I saw the changelog item for 12-19-2024 that said "Fix: Bookstack Update Function" and decided to update my BookStack instance. After updating to v24.10.3 (from 24.10.1) today, I couldn't access my account (which is MFA enabled) and would get the error "An unknown error occurred" every time after submitting my TOTP code. I don't think this is a version issue, but rather an issue related to the script updates potentially overwriting a file or value. Please see what I mean below: ### ⚙️ What settings are you using? - [ ] Default Settings - [X] Advanced Settings ### 🖥️ Which Linux distribution are you using? Debian 12 ### 🔄 Steps to reproduce the issue. 1. I first did an apt update/upgrade prior to updating (which had some php updates as well, so I wasn't initially sure if it was part of the issue): `apt update && apt upgrade` > > ```libapache2-mod-php8.2 php-symfony-console php-symfony-filesystem > php-symfony-finder php-symfony-process php-symfony-string php8.2-bz2 php8.2-cli > php8.2-common php8.2-curl php8.2-fpm php8.2-gd php8.2-intl php8.2-ldap > php8.2-mbstring php8.2-mysql php8.2-opcache php8.2-readline php8.2-tidy > php8.2-xml php8.2-zip tzdata``` 2. Updated BookStack inside the LXC successfully to v24.10.3: `update` 3. Logged back into BookStack with my email and password successfully 4. After submitting the TOTP numbers for MFA, it failed to proceed further: `An unknown error occurred` 5. Restored the lxc from this morning's backup and was able to log back into BookStack normally. 6. Took a manual ZFS snapshot in Proxmox of the restored lxc so that I could easily go back to my last known working config (and not have to destroy/recreate the lxc each time via backup) 7. Attempted to update via the script again WITHOUT any apt updates/upgrades this time: `update` 8. Logged back into BookStack and ran into the same issue after submitting MFA : `An unknown error occurred` 9. Restored the snapshot in Proxmox and resurrected my instance again ### ❌ Paste the full error output (if available). [2024-12-20 16:03:55] production.ERROR: The MAC is invalid. {"exception":"[object] (Illuminate\\Contracts\\Encryption\\DecryptException(code: 0): The MAC is invalid. at /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php:222) [stacktrace] #0 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php(151): Illuminate\\Encryption\\Encrypter->getJsonPayload() #1 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php(373): Illuminate\\Encryption\\Encrypter->decrypt() #2 /opt/bookstack/app/Access/Mfa/MfaValue.php(66): decrypt() #3 /opt/bookstack/app/Access/Mfa/MfaValue.php(58): BookStack\\Access\\Mfa\\MfaValue->getValue() #4 /opt/bookstack/app/Access/Controllers/MfaTotpController.php(89): BookStack\\Access\\Mfa\\MfaValue::getValueForUser() #5 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): BookStack\\Access\\Controllers\\MfaTotpController->verify() #6 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(43): Illuminate\\Routing\\Controller->callAction() #7 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(259): Illuminate\\Routing\\ControllerDispatcher->dispatch() #8 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\\Routing\\Route->runController() #9 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(806): Illuminate\\Routing\\Route->run() #10 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\\Routing\\Router->Illuminate\\Routing\\{closure}() #11 /opt/bookstack/app/Http/Middleware/RedirectIfAuthenticated.php(28): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #12 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\RedirectIfAuthenticated->handle() #13 /opt/bookstack/app/Http/Middleware/Localization.php(32): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #14 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\Localization->handle() #15 /opt/bookstack/app/Http/Middleware/RunThemeActions.php(26): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #16 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\RunThemeActions->handle() #17 /opt/bookstack/app/Http/Middleware/CheckEmailConfirmed.php(47): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #18 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\CheckEmailConfirmed->handle() #19 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #20 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken->handle() #21 /opt/bookstack/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #22 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle() #23 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #24 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\\Session\\Middleware\\StartSession->handleStatefulRequest() #25 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Session\\Middleware\\StartSession->handle() #26 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #27 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle() #28 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #29 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle() #30 /opt/bookstack/app/Http/Middleware/ApplyCspRules.php(33): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #31 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\ApplyCspRules->handle() #32 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #33 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(805): Illuminate\\Pipeline\\Pipeline->then() #34 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(784): Illuminate\\Routing\\Router->runRouteWithinStack() #35 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(748): Illuminate\\Routing\\Router->runRoute() #36 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(737): Illuminate\\Routing\\Router->dispatchToRoute() #37 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(200): Illuminate\\Routing\\Router->dispatch() #38 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}() #39 /opt/bookstack/app/Http/Middleware/PreventResponseCaching.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #40 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\PreventResponseCaching->handle() #41 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(39): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #42 /opt/bookstack/app/Http/Middleware/TrustProxies.php(41): Illuminate\\Http\\Middleware\\TrustProxies->handle() #43 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\TrustProxies->handle() #44 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #45 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(40): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle() #46 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\TrimStrings->handle() #47 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #48 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize->handle() #49 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(99): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #50 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance->handle() #51 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #52 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(175): Illuminate\\Pipeline\\Pipeline->then() #53 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(144): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter() #54 /opt/bookstack/public/index.php(52): Illuminate\\Foundation\\Http\\Kernel->handle() #55 {main} "} [2024-12-20 16:06:44] production.ERROR: The MAC is invalid. {"exception":"[object] (Illuminate\\Contracts\\Encryption\\DecryptException(code: 0): The MAC is invalid. at /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php:222) [stacktrace] #0 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php(151): Illuminate\\Encryption\\Encrypter->getJsonPayload() #1 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php(373): Illuminate\\Encryption\\Encrypter->decrypt() #2 /opt/bookstack/app/Access/Mfa/MfaValue.php(66): decrypt() #3 /opt/bookstack/app/Access/Mfa/MfaValue.php(58): BookStack\\Access\\Mfa\\MfaValue->getValue() #4 /opt/bookstack/app/Access/Controllers/MfaTotpController.php(89): BookStack\\Access\\Mfa\\MfaValue::getValueForUser() #5 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): BookStack\\Access\\Controllers\\MfaTotpController->verify() #6 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(43): Illuminate\\Routing\\Controller->callAction() #7 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(259): Illuminate\\Routing\\ControllerDispatcher->dispatch() #8 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\\Routing\\Route->runController() #9 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(806): Illuminate\\Routing\\Route->run() #10 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\\Routing\\Router->Illuminate\\Routing\\{closure}() #11 /opt/bookstack/app/Http/Middleware/RedirectIfAuthenticated.php(28): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #12 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\RedirectIfAuthenticated->handle() #13 /opt/bookstack/app/Http/Middleware/Localization.php(32): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #14 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\Localization->handle() #15 /opt/bookstack/app/Http/Middleware/RunThemeActions.php(26): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #16 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\RunThemeActions->handle() #17 /opt/bookstack/app/Http/Middleware/CheckEmailConfirmed.php(47): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #18 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\CheckEmailConfirmed->handle() #19 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #20 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken->handle() #21 /opt/bookstack/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #22 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle() #23 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #24 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\\Session\\Middleware\\StartSession->handleStatefulRequest() #25 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Session\\Middleware\\StartSession->handle() #26 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #27 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle() #28 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #29 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle() #30 /opt/bookstack/app/Http/Middleware/ApplyCspRules.php(33): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #31 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\ApplyCspRules->handle() #32 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #33 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(805): Illuminate\\Pipeline\\Pipeline->then() #34 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(784): Illuminate\\Routing\\Router->runRouteWithinStack() #35 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(748): Illuminate\\Routing\\Router->runRoute() #36 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(737): Illuminate\\Routing\\Router->dispatchToRoute() #37 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(200): Illuminate\\Routing\\Router->dispatch() #38 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(144): Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}() #39 /opt/bookstack/app/Http/Middleware/PreventResponseCaching.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #40 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\PreventResponseCaching->handle() #41 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(39): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #42 /opt/bookstack/app/Http/Middleware/TrustProxies.php(41): Illuminate\\Http\\Middleware\\TrustProxies->handle() #43 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): BookStack\\Http\\Middleware\\TrustProxies->handle() #44 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #45 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(40): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle() #46 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\TrimStrings->handle() #47 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #48 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize->handle() #49 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(99): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #50 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance->handle() #51 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}() #52 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(175): Illuminate\\Pipeline\\Pipeline->then() #53 /opt/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(144): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter() #54 /opt/bookstack/public/index.php(52): Illuminate\\Foundation\\Http\\Kernel->handle() #55 {main} "} ### 🖼️ Additional context (optional). From [what I learned](https://github.com/BookStackApp/BookStack/issues/3229#issuecomment-1027994188), it's possible that the mechanism that's updating the lxc is also changing the APP_KEY created by `php artisan key:generate` from the initial install, meaning it can't decrypt any older values (in this case, the previous TOTP info). My only clue that led to that conclusion was the line in the logs I posted above (found in _/opt/bookstack/storage/logs_) that said `ERROR: The MAC is invalid`, which I learned is a universal error related to the Laravel PHP framework in general (rather than a specific BookStack error). Not sure how many others are using MFA to test this out, but this could definitely be an issue if you don't have frequent backups and update blindly. I noticed the bookstack.sh/bookstack-install.sh scripts have `php artisan key:generate --no-interaction --force` on there prior to the `php artisan migrate`, which probably isn't a necessary step because of an issue like this if I'm understanding [their normal update procedures](https://www.bookstackapp.com/docs/admin/updates/) correctly.
saavagebueno added the bug label 2025-11-20 04:45:11 -05:00
Author
Owner

@michelroegl-brunner commented on GitHub (Dec 20, 2024):

Should be fixed, please try again in 10-15 minutes if you can!

@michelroegl-brunner commented on GitHub (Dec 20, 2024): Should be fixed, please try again in 10-15 minutes if you can!
Author
Owner

@clipz98 commented on GitHub (Dec 20, 2024):

Should be fixed, please try again in 10-15 minutes if you can!

Yes, confirmed fixed! Thank you for the quick response! It didn't even log me out, but I could confirm the version change since I was in settings and just hit refresh. I logged out anyway to manually test and verified that the problem is gone.

@clipz98 commented on GitHub (Dec 20, 2024): > Should be fixed, please try again in 10-15 minutes if you can! Yes, confirmed fixed! Thank you for the quick response! It didn't even log me out, but I could confirm the version change since I was in settings and just hit refresh. I logged out anyway to manually test and verified that the problem is gone.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/ProxmoxVE#224