403 Forbidden error inviting new member on self-hosted Retool

[Henry_Leung]

Hi retool team

I have the same issue as mentioned in another post.

403 Forbidden error while inviting new member on self-hosted Retool

Hello, I am trying to invite a new member on our self-hosted deployment of Retool. I am using the current admin user (which was created as part of self-hosted setup). When I try to invite another member, I get a 403 Forbidden error. You can see screenshots of the error and of our internal database tables below: [Error 1] [Error 4] [Error 3] [Error 2] [DB] We are running Retool container tryretool/backend:2.97.5. I tried checking the container logs but couldn't find anything indicating an …

The resolution is to open up AWS WAF. But after checking with our infrastructure team, opening up https://[retool on-prem domain]/api/ may be too board and defeat the purpose of WAF.

I wonder if there is any special rules we can setup in AWS WAF to limit to those endpoints which are absolutely necessary. Is there a list?

Thanks.

Henry

[Jack_T]

Hello @Henry_Leung,

Unfortunately I do not believe we currently have a list of all endpoints from Retool that are needed to be given access for internal processes

Do you have any more specific details on what endpoints were triggering the 403 error or any other errors that were hitting the firewall?

Check network tab of browser to see which requests from the frontend to the backend are failing and being met with error messages.

We sometimes see this with body size limit being exceeded from what a firewall has set. Or if there are granular rules set on the body of requests being sent, that could be another reason for the firewall blocking requests.

There is definitely a middle group between having the AWS WAF completely opened up and the current rules which are preventing new users from being added.