Wazuh dashboard shows a "Internal Server Error" in 4.10.0 AMI

[DiegoRatto]

Description:

Internal Server Error occurs in Wazuh OpenSearch Dashboards during authentication, causing requests for favicon.ico to fail. Error trace points to HapiResponseAdapter in response_adapter.js and authentication lifecycle in auth.js.

Step to reproduce

The following log messages have been found in the wazuh/wazuh#26798 (comment) testing:

• When we execute the following command:

[root@wazuh-server wazuh-user]# journalctl -r -u wazuh-dashboard | grep -i -E "error|critical|fatal|warning"

One of the logs shows:

Nov 13 00:17:43 wazuh-server opensearch-dashboards[28236]: 
{"type":"error","@timestamp":"2024-11-13T00:17:43Z","tags":[],"pid":28236,"level":"error","error":{"message":"Internal Server Error","name":"Error","stack":"Error: Internal Server Error\n    
at HapiResponseAdapter.toInternalError (/usr/share/wazuh-dashboard/src/core/server/http/router/response_adapter.js:69:19)\n    
at Object.interceptAuth [as authenticate] (/usr/share/wazuh-dashboard/src/core/server/http/lifecycle/auth.js:148:34)\n    
at runMicrotasks (<anonymous>)\n   
at processTicksAndRejections (internal/process/task_queues.js:95:5)\n    
at exports.Manager.execute (/usr/share/wazuh-dashboard/node_modules/@hapi/hapi/lib/toolkit.js:60:28)\n    
at module.exports.internals.Auth._authenticate (/usr/share/wazuh-dashboard/node_modules/@hapi/hapi/lib/auth.js:273:30)\n    
at Request._lifecycle (/usr/share/wazuh-dashboard/node_modules/@hapi/hapi/lib/request.js:371:32)\n    
at Request._execute (/usr/share/wazuh-dashboard/node_modules/@hapi/hapi/lib/request.js:281:9)"},"url":"https://3cccc153/favicon.ico","message":"Internal Server Error"}

[Enaraque]

Update report

After creating a new instance with the AMI and trying to get the error message mentioned in the issue description, it has not been possible to replicate it.

After talking to @DiegoRatto to see what steps he followed to get the error, it was found that the instance of the AMI used to detect this error had already been used previously for other tests, so the problem could be due to the dashboard itself.

The issue is passed to blocked until the next approach is known.