github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-05-07 20:38:54 -05:00
Code Issues 1.6k Packages Projects Releases 55 Wiki Activity

[GH-ISSUE #2781] [Bug]: Reverse proxy header auth still prompts for password #26900

New Issue
Closed
opened 2026-04-18 03:15:45 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-18 03:15:45 -05:00
Owner
Copy Link

Originally created by @slapcat on GitHub (May 19, 2024).
Original GitHub issue: https://github.com/actualbudget/actual/issues/2781

Verified issue does not already exist?

  • I have searched and found no existing issue
  • I will be providing steps how to reproduce the bug (in most cases this will also mean uploading a demo budget file)

What happened?

When using header auth, the web UI still prompts for a password. I'm asked to enter one, but then it will accept any password. Server logs show this when I login:

May 18 16:05:32 actualbudget yarn[832]: Logging in via header
May 18 16:05:32 actualbudget yarn[832]: HEADER VALUE: ************
May 18 16:05:32 actualbudget yarn[832]: Header Auth Login permitted from xx.xx.xx.xx

Header auth has been configured in the src/load-config.js file as the default login method:

let defaultConfig = {
  loginMethod: 'header',

I'm using Apache2 reverse proxy and configured it along the lines of the example here:

  <LocationMatch "/account/login/">
  ProxyPass http://xx.xx.xx.xx:5006/
  ProxyPassReverse http://xx.xx.xx.xx:5006/
  Header add X-ACTUAL-PASSWORD "****"
  RequestHeader set X-ACTUAL-PASSWORD "****"
  </LocationMatch>

  ProxyPass / http://xx.xx.xx.xx:5006/
  ProxyPassReverse / http://xx.xx.xx.xx:5006/

  Header add X-ACTUAL-PASSWORD "****"
  RequestHeader set X-ACTUAL-PASSWORD "****"

I can see the header is correctly added when I am given the password prompt:
image

Where are you hosting Actual?

Locally via Yarn

What browsers are you seeing the problem on?

Firefox, Chrome

Operating System

Linux

Originally created by @slapcat on GitHub (May 19, 2024). Original GitHub issue: https://github.com/actualbudget/actual/issues/2781 ### Verified issue does not already exist? - [X] I have searched and found no existing issue - [X] I will be providing steps how to reproduce the bug (in most cases this will also mean uploading a demo budget file) ### What happened? When using header auth, the web UI still prompts for a password. I'm asked to enter one, but then it will accept any password. Server logs show this when I login: ``` May 18 16:05:32 actualbudget yarn[832]: Logging in via header May 18 16:05:32 actualbudget yarn[832]: HEADER VALUE: ************ May 18 16:05:32 actualbudget yarn[832]: Header Auth Login permitted from xx.xx.xx.xx ``` Header auth has been configured in the `src/load-config.js` file as the default login method: ``` let defaultConfig = { loginMethod: 'header', ``` I'm using Apache2 reverse proxy and configured it along the lines of [the example here](https://github.com/twk3/actual-auth-header-example/blob/main/nginx-data/default.conf): ``` <LocationMatch "/account/login/"> ProxyPass http://xx.xx.xx.xx:5006/ ProxyPassReverse http://xx.xx.xx.xx:5006/ Header add X-ACTUAL-PASSWORD "****" RequestHeader set X-ACTUAL-PASSWORD "****" </LocationMatch> ProxyPass / http://xx.xx.xx.xx:5006/ ProxyPassReverse / http://xx.xx.xx.xx:5006/ Header add X-ACTUAL-PASSWORD "****" RequestHeader set X-ACTUAL-PASSWORD "****" ``` I can see the header is correctly added when I am given the password prompt: ![image](https://github.com/actualbudget/actual/assets/52802566/0a5324c8-025e-43b0-8c30-d47a375ab3d6) ### Where are you hosting Actual? Locally via Yarn ### What browsers are you seeing the problem on? Firefox, Chrome ### Operating System Linux
GiteaMirror added the bug label 2026-04-18 03:15:45 -05:00
GiteaMirror commented 2026-04-18 03:15:46 -05:00
Author
Owner
Copy Link

@twk3 commented on GitHub (May 20, 2024):

@slapcat the changes to support header auth are only in the master branch at the moment. So you need both the master branch of acutal-server AND the master branch of the UI. The server master branch comes with the released version of the UI, and not master, which is likely resulting in the issue you are seeing.

<!-- gh-comment-id:2120707601 --> @twk3 commented on GitHub (May 20, 2024): @slapcat the changes to support header auth are only in the master branch at the moment. So you need both the master branch of acutal-server AND the master branch of the UI. The server master branch comes with the released version of the UI, and not master, which is likely resulting in the issue you are seeing.
GiteaMirror commented 2026-04-18 03:15:47 -05:00
Author
Owner
Copy Link

@slapcat commented on GitHub (May 20, 2024):

Thanks for clarifying that @twk3 ! I'm trying to figure out how to use the master branch of the UI with the actual-server, but I'm having trouble finding the common files between the two. Can you share the steps?

<!-- gh-comment-id:2120829413 --> @slapcat commented on GitHub (May 20, 2024): Thanks for clarifying that @twk3 ! I'm trying to figure out how to use the master branch of the UI with the actual-server, but I'm having trouble finding the common files between the two. Can you share the steps?
GiteaMirror commented 2026-04-18 03:15:47 -05:00
Author
Owner
Copy Link

@twk3 commented on GitHub (May 21, 2024):

In the actual checkout, you build the UI using:

  1. yarn install
  2. ./bin/package-browser

Then in the actual-server checkout, you add the UI as a file path based dependency.

  1. yarn add <path-to-actual-checkout/packages/desktop-client

And then running the server like normal should give you the UI that you built

<!-- gh-comment-id:2122859366 --> @twk3 commented on GitHub (May 21, 2024): In the actual checkout, you build the UI using: 1. `yarn install` 2. `./bin/package-browser` Then in the actual-server checkout, you add the UI as a file path based dependency. 1. `yarn add <path-to-actual-checkout/packages/desktop-client` And then running the server like normal should give you the UI that you built
GiteaMirror commented 2026-04-18 03:15:48 -05:00
Author
Owner
Copy Link

@slapcat commented on GitHub (May 21, 2024):

Thanks! Once I did that the header auth worked as expected.

<!-- gh-comment-id:2122908425 --> @slapcat commented on GitHub (May 21, 2024): Thanks! Once I did that the header auth worked as expected.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#26900
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?