Repository navigation
[BUG] conflicting auth module headers #1125
Description
Activity
I am seeing the same behavior using TinyAuth with SWAG. Versions prior to 5.2 work fine.
Reacted by RemyHello,
Yes this is a security improvements that helps mitigate header injection. The reason this error appears is because Tinyauth sees headers for both
X-Forwarded-Host/X-Forwarded-URIandX-Original-URL.For SWAG, @coral-hungus please see the SWAG guide in the documentation with the updated config. We are also working with the LinuxServer team for updated sample files.
@nebula-it are you using an internal connection with
http://tinyauth.tinyauth.svc.cluster.local:3000/api/auth/nginxas the URL for thenginx.ingress.kubernetes.io/auth-url? Are you sure that no custom headers are being send to Tinyauth? Technically you shouldn't face this issue as ingress Nginx is supposed to only sendX-Original-URL.Reacted by Remy@steveiliop56 thanks for pointing out the documentation. That did the trick.
Nope, I'm using the ingress for tinyauth i.e
nginx.ingress.kubernetes.io/auth-url: https://tinyauth.example.com/api/auth/nginx
I have combed through the nginx config and dont see anything that would add additional headers. Is there any way to log those? I triedTINYAUTH_LOG_LEVEL: tracebut still dont get much more info about the headers causing issue.@nebula-it please use the internal connection instead. The external one is prone to messing with the headers (with/without the latest update) and causing a lot of issues. That's probably what's happening right now.
That fixed it. Thank you
Describe the Bug
Since v5.2 access to pages protected by TinyAuth are failing with error:
How to Reproduce
Expected Behavior
After auth user gets redirected to actual host/page
Additional Context
TINYAUTH_EXPERIMENTAL_DISABLEAUTHMODULEFALLBACK: truedid not help eitherLogs
Operating System
No response
Browser
No response
Tinyauth Version
v5.2.0
Docker Version (if applicable)
No response
Human Written Confirmation