github-starred/newt
2
0
Fork 0
mirror of https://github.com/fosrl/newt.git synced 2026-07-15 21:16:40 -05:00
Code Issues 713 Packages Projects Releases 45 Wiki Activity

[GH-ISSUE #343] Newt 1.12.4 causes redirect loop on HTTPS private (HTTP) resources — 308 redirects to self #5865

New Issue
Closed
opened 2026-06-10 21:01:48 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-06-10 21:01:48 -05:00
Owner
Copy Link

Originally created by @lmcemaj on GitHub (May 8, 2026).
Original GitHub issue: https://github.com/fosrl/newt/issues/343

Describe the Bug

After upgrading from Newt 1.12.3 to 1.12.4, all HTTPS private resources (HTTP mode) enter an infinite 308 redirect loop. Newt's HTTP handler redirects GET / to the same URL it received, instead of proxying to the configured destination. Downgrading to 1.12.3 resolves the issue.
I suspect this is related to the changelog entry: "Update status code on redirect for http resources to 308".

Environment

Pangolin: 1.18.3 (Enterprise Edition, self-hosted)
Newt: 1.12.4 (broken) → 1.12.3 (working)
Image: fosrl/newt:latest
Site type: Newt site connector
Resource type: Private resource, HTTP mode, SSL enabled
Client: Pangolin Client (Olm) on macOS, accessing via browser/curl

To Reproduce

  1. Run Pangolin 1.18.3 self-hosted with a Newt site connector
  2. Create a private resource in HTTP mode (scheme http, destination internal IP:port, subdomain on managed domain, SSL enabled)
  3. Connect via Pangolin Client; confirm DNS resolves the resource hostname to the tunnel-internal address (CGNAT range, 100.96.x.x)
  4. Run curl -IL https://.example.com

Expected Behavior

Newt's HTTP handler proxies the request to the configured destination (e.g. http://10.0.0.50:8000), and the backend response is returned to the client.

Originally created by @lmcemaj on GitHub (May 8, 2026). Original GitHub issue: https://github.com/fosrl/newt/issues/343 ### Describe the Bug After upgrading from Newt 1.12.3 to 1.12.4, all HTTPS private resources (HTTP mode) enter an infinite 308 redirect loop. Newt's HTTP handler redirects GET / to the same URL it received, instead of proxying to the configured destination. Downgrading to 1.12.3 resolves the issue. I suspect this is related to the changelog entry: "Update status code on redirect for http resources to 308". ### Environment Pangolin: 1.18.3 (Enterprise Edition, self-hosted) Newt: 1.12.4 (broken) → 1.12.3 (working) Image: fosrl/newt:latest Site type: Newt site connector Resource type: Private resource, HTTP mode, SSL enabled Client: Pangolin Client (Olm) on macOS, accessing via browser/curl ### To Reproduce 1. Run Pangolin 1.18.3 self-hosted with a Newt site connector 2. Create a private resource in HTTP mode (scheme http, destination internal IP:port, subdomain on managed domain, SSL enabled) 3. Connect via Pangolin Client; confirm DNS resolves the resource hostname to the tunnel-internal address (CGNAT range, 100.96.x.x) 4. Run curl -IL https://<resource>.example.com ### Expected Behavior Newt's HTTP handler proxies the request to the configured destination (e.g. http://10.0.0.50:8000), and the backend response is returned to the client.
GiteaMirror commented 2026-06-10 21:01:50 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (May 8, 2026):

When you have TLS option disabled?

<!-- gh-comment-id:4403944395 --> @AstralDestiny commented on GitHub (May 8, 2026): When you have TLS option disabled?
GiteaMirror commented 2026-06-10 21:01:50 -05:00
Author
Owner
Copy Link

@lmcemaj commented on GitHub (May 8, 2026):

Image

You mean this on the Private Ressource settings? Enabled for all ressources.

<!-- gh-comment-id:4403970959 --> @lmcemaj commented on GitHub (May 8, 2026): <img width="736" height="70" alt="Image" src="https://github.com/user-attachments/assets/848c9b96-a780-4804-8d9e-f264b5a7a2e1" /> You mean this on the Private Ressource settings? Enabled for all ressources.
GiteaMirror commented 2026-06-10 21:01:50 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (May 8, 2026):

Yeah think Owen put it on the wrong entrypoint will get it fixed asap.

<!-- gh-comment-id:4404093857 --> @AstralDestiny commented on GitHub (May 8, 2026): Yeah think Owen put it on the wrong entrypoint will get it fixed asap.
GiteaMirror commented 2026-06-10 21:01:51 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (May 8, 2026):

It's supposed to only be served on the http side not https

<!-- gh-comment-id:4404095040 --> @AstralDestiny commented on GitHub (May 8, 2026): It's supposed to only be served on the http side not https
GiteaMirror commented 2026-06-10 21:01:51 -05:00
Author
Owner
Copy Link

@LaurenceJJones commented on GitHub (May 8, 2026):

#345

<!-- gh-comment-id:4408193441 --> @LaurenceJJones commented on GitHub (May 8, 2026): #345
GiteaMirror commented 2026-06-10 21:01:52 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (May 8, 2026):

Fixing in 1.12.5

<!-- gh-comment-id:4408752123 --> @oschwartz10612 commented on GitHub (May 8, 2026): Fixing in 1.12.5
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
dependencies
docker
enhancement
go
good first issue
help wanted
Improvement
needs investigating
pull-request
Mirrored from GitHub Pull Request
 stale
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/newt#5865
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?