mirror of
https://github.com/actualbudget/actual.git
synced 2026-07-12 05:00:59 -05:00
[GH-ISSUE #2793] [Bug]: Service Worker preventing correct execution of bootstrap when using NGINX reverse proxy #70855
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/actual#70855
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @andreygal on GitHub (May 23, 2024).
Original GitHub issue: https://github.com/actualbudget/actual/issues/2793
Verified issue does not already exist?
What happened?
Thank you for developing this fantastic project! However, I've encountered a problem with the service worker when passing the connection through an nginx reverse proxy. When the server is accessed directly, everything functions without issues. However, when the connection is proxied, the resources load, but the loading script fails to start. If the sw.js is unregistered, the page then loads correctly.
Where are you hosting Actual?
Docker
What browsers are you seeing the problem on?
Chrome, Microsoft Edge, Desktop App (Electron), Other
Operating System
Windows 10
@VoltaicGRiD commented on GitHub (May 24, 2024):
I was just having a similar issue setting up my reverse proxy for a VPN tunnel for my own setup, can you share a redacted copy of your NGINX configuration file for this site (and the regular
nginx.conffile that you have if you have modified it from the default). I'm curious enough to work on finding a solution for this as a new contributor (if at all possible).@andreygal commented on GitHub (May 25, 2024):
nginx.conf***
user nginxuser;
worker_processes 1;
error_log /var/log/nginx/error.log;
error_log /var/log/nginx/error.log notice;
error_log /var/log/nginx/error.log info;
pid /run/nginx.pid;
events {
worker_connections 1024;
}
http {
default_type application/octet-stream;
server_tokens off;
add_header X-Frame-Options "SAMEORIGIN";
}
ssl_settings.conf*******
server {
listen [::]:443 ssl;
listen 443 ssl;
http2 on;
server_name actual.myserver.com;
}
Mutual TLS redirect for Actual
server {
listen [::]:port ssl;
listen port ssl;
http2 on;
server_name mtls.myserver.com;
}
@safehome-jdev commented on GitHub (Jun 9, 2024):
Is there a particular requirement for predetermining the default
Content-Typeheader? It could be this is inferring a differentContent-Typeand causing your headaches@safehome-jdev commented on GitHub (Jun 9, 2024):
Here's more specifically about the
default_typemodule.@andreygal commented on GitHub (Jun 9, 2024):
Thank you so much for taking a look. Will try to implement and see if it helps.
On June 8, 2024 9:15:30 PM EDT, safehome-jdev @.***> wrote:
@Towerism commented on GitHub (Jun 23, 2024):
I have a similar problem. My problem is that I am reverse proxying and using authentik as SSO. When authentik login session expires, actual breaks, I suppose because the service worker bypasses the reverse proxy.
I got around this, by updating my reverse proxy with a directive that responds to the path /registerSW.js with a 404. This prevents the service worker from ever starting.
Obviously this is not ideal, as now actual will not work without an internet connection. But at least without the service worker, the application will redirect me to my SSO instead of breaking.
@safehome-jdev commented on GitHub (Jun 23, 2024):
@Towerism Are you able to post your NGINX config for this? As well as any browser errors/failure responses from your browser's console and network tools for when a login expires?
A quick search shows that workers do not retry upon failure, which checks out so far.
@Towerism commented on GitHub (Jun 23, 2024):
Sure I’d be happy to. ’m using caddy which has a lot going on in it due to
other stuff that I’m hosting. I’ll take some time to put together a more
minimal docker compose and caddy file and share it here.
On Sun, Jun 23, 2024 at 01:32 safehome-jdev @.***>
wrote:
@Towerism commented on GitHub (Jun 23, 2024):
@safehome-jdev, when my auth endpoint is queried via fetch, it is giving cors errors. So it seems that the error is something I should be able to work out on the authentik configuration side.
@safehome-jdev commented on GitHub (Jun 23, 2024):
Ah, you'll need to add something like the following to allow auth requests from your domain name to Authentik's auth servers:
Change the asterisk in
Access-Control-Allow-Originto yourreferrerheader from your request headers in your browser's network tools. That should get you what you need 👍🏼@Towerism commented on GitHub (Jun 23, 2024):
@safehome-jdev I could try that, but I believe what's going on is that the fetch to /authorize results in a redirect, so the preflight request has ERR_INVALID_REDIRECT. So authentik is expecting the application to navigate to the authorize url rather than make an XHR request. I think?
@Towerism commented on GitHub (Jun 23, 2024):
@safehome-jdev i was able to get caddy to handle cors properly. However, this didn't fix the issue that with authentik configured in caddy using forward_auth, actual tries to use an XHR request instead of navigating.
Error from service worker in the console:
@Towerism commented on GitHub (Jun 23, 2024):
@safehome-jdev I just realized what's happening. i have caddy configured to redirect to authentik. the service worker is serving the page, completely bypassing caddy. in this case, the service worker tries to authenticate with actual-server but is redirected to authentik instead since the cookie expired. I think I just have to disable the service worker in my case in order to have authentik work correctly.
@mdelpire commented on GitHub (Jul 12, 2024):
@Towerism were you able to solve the issue you have with authentik? I have the same issue. Using actual budget with Nginx Proxy Mnager and Authentik. If yes, could you explain how?
Thanks a lot
@Towerism commented on GitHub (Jul 12, 2024):
@mdelpire i did not solve this directly. I’m using a workaround currently where I intercept the request to load the service worker and return a 404 not found.
@mdbell commented on GitHub (Aug 13, 2024):
While not directly related to this issue, I was also able to get the "Sign Out" button to actually sign me out of Authentik by replacing
registerSW.jswith:And then using it with the following location directive in nginx:
I imagine there's a better way to do this by building actual myself, but this is a quick fix for me.
@TimQuelch commented on GitHub (Aug 18, 2024):
I've opened https://github.com/actualbudget/actual/pull/3286 with a workaround for this.
@alexyao2015 commented on GitHub (Oct 12, 2024):
@TimQuelch
Just updated to 24.10.1 which includes #3286 and still seem to experiencing the same issue. Did some quick digging and it seems like this kcab.worker.js script is attempting to pull from /sync but it isn't reloading. Manually calling the reload code from that PR from the console does work, meaning that there are probably some other places that need to be hooked with the force reload code.
@TimQuelch commented on GitHub (Oct 27, 2024):
I can't seem to reproduce this. Mine is now refreshing correctly when sync is redirected. Are you sure your client has updated and is using the new version? Try clearing caches and refreshing.
@alexyao2015 commented on GitHub (Oct 28, 2024):
Pretty sure it was. I've since disabled the sw again using nginx rules, but I had checked the mangled sources in Firefox and could see it was the updated version.
@matt-fidd commented on GitHub (Jun 5, 2025):
I believe this should now be fixed, please reopen if you're still having trouble