Redirect loop, can&#39;t access any resources, can only access pangolin itself. #106

@hhftechnology commented on GitHub (Feb 27, 2025):

It is possible CrowdSec is blocking some of the authentication attempts or interfering with session validation.

@hhftechnology commented on GitHub (Feb 27, 2025): It is possible CrowdSec is blocking some of the authentication attempts or interfering with session validation.

GiteaMirror commented

@hhftechnology commented on GitHub (Feb 27, 2025):

Try temporarily disabling CrowdSec to see if that resolves the issue:

Comment out the CrowdSec middleware in traefik_config.yml
Restart Traefik

@hhftechnology commented on GitHub (Feb 27, 2025): Try temporarily disabling CrowdSec to see if that resolves the issue: ```Comment out the CrowdSec middleware in traefik_config.yml``` ``Restart Traefik``

GiteaMirror commented

@ellite commented on GitHub (Feb 27, 2025):

Hi. Thanks.
I've never setup crowdsec. And there's nothing related to crowdsec on the config file.

@ellite commented on GitHub (Feb 27, 2025): Hi. Thanks. I've never setup crowdsec. And there's nothing related to crowdsec on the config file.

GiteaMirror commented

@adrianipopescu commented on GitHub (Mar 20, 2025):

having this without crowdsec as well, but also without auth as I am relying on the app's built-in one

LE: it was caused by cloudflare's proxying

anyone know why cloudflare's acting up?

LE: needed strict ssl

@adrianipopescu commented on GitHub (Mar 20, 2025): having this without crowdsec as well, but also without auth as I am relying on the app's built-in one LE: it was caused by cloudflare's proxying anyone know why cloudflare's acting up? LE: needed strict ssl

GiteaMirror commented

@BingoRox commented on GitHub (Mar 21, 2025):

I'm having the same issues on v1.0.0 and v1.0.1. On Firefox Windows 11 24H2 and on iOS 18.3.2 Safari (and other browsers). On Chrome desktop it's hard to reproduce, but on iOS all the browsers I have use the Safari webkit so they all act the same. Unfortunately, the issue persists on Safari even after clearing the website data. On Firefox desktop if I clear the site data it will work for about a minute before breaking again. The resources that have the correct rules (e.g. allowed path /api/*) work on Firefox desktop, but the same resources redirect loop on Safari iOS.

I've reinstalled Pangolin 3 times on 2 different VPSs. I've tried with and without Crowdsec, I've tried with HHFs recent Traefik config/rules improvements (thanks for those btw), but the only thing that works is either disabling auth in Pangolin or sometimes setting an allowed IP rule in Pangolin (this is still inconsistent on Safari for some reason).

I've enabled debug logs and failed attempt logs in Pangolin, and when the redirect loop is happening I see the failed login attempts in the console with the resource value and my ip listed, but the debug logs just show Badger and the resource sending mismatched cookies back and forth and auth being denied. I can provide logs if helpful, sorry I'm currently on mobile but I wanted to join the discussion at least. Thanks everyone!

@BingoRox commented on GitHub (Mar 21, 2025): I'm having the same issues on v1.0.0 and v1.0.1. On Firefox Windows 11 24H2 and on iOS 18.3.2 Safari (and other browsers). On Chrome desktop it's hard to reproduce, but on iOS all the browsers I have use the Safari webkit so they all act the same. Unfortunately, the issue persists on Safari even after clearing the website data. On Firefox desktop if I clear the site data it will work for about a minute before breaking again. The resources that have the correct rules (e.g. allowed path /api/*) work on Firefox desktop, but the same resources redirect loop on Safari iOS. I've reinstalled Pangolin 3 times on 2 different VPSs. I've tried with and without Crowdsec, I've tried with HHFs recent Traefik config/rules improvements (thanks for those btw), but the only thing that works is either disabling auth in Pangolin or sometimes setting an allowed IP rule in Pangolin (this is still inconsistent on Safari for some reason). I've enabled debug logs and failed attempt logs in Pangolin, and when the redirect loop is happening I see the failed login attempts in the console with the resource value and my ip listed, but the debug logs just show Badger and the resource sending mismatched cookies back and forth and auth being denied. I can provide logs if helpful, sorry I'm currently on mobile but I wanted to join the discussion at least. Thanks everyone!

GiteaMirror commented

@ellite commented on GitHub (Mar 21, 2025):

Happy to see I'm not alone.
As I have it working on Brave, I just use it on the desktop. But yeah, on the iphone nothing works on the browser.

But, 3 days ago I changed some values on the config.yml

from:

session_cookie_name: p_session_token
resource_access_token_param: p_token
resource_session_request_param: p_session_request

to:

session_cookie_name: p_session_token_s
resource_access_token_param: p_token_s
resource_session_request_param: p_session_request_s

I had to login everywhere again, but it is still working. Not sure if it will at some point return to not working, but it usually only works for a couple of minutes after I clear the website data, so, this looks promising.

@ellite commented on GitHub (Mar 21, 2025): Happy to see I'm not alone. As I have it working on Brave, I just use it on the desktop. But yeah, on the iphone nothing works on the browser. But, 3 days ago I changed some values on the config.yml from: ``` session_cookie_name: p_session_token resource_access_token_param: p_token resource_session_request_param: p_session_request ``` to: ``` session_cookie_name: p_session_token_s resource_access_token_param: p_token_s resource_session_request_param: p_session_request_s ``` I had to login everywhere again, but it is still working. Not sure if it will at some point return to not working, but it usually only works for a couple of minutes after I clear the website data, so, this looks promising.

GiteaMirror commented

@hhftechnology commented on GitHub (Mar 21, 2025):

i did my tests it happens when using enhanced tracking protection. try adding exceptions for your domains.

server:
  # Other settings...
  session_cookie_name: p_session_token
  resource_access_token_param: p_token
  resource_session_request_param: p_session_request
  trust_proxy: true           # try this mark it as true if behind a adblocker. 
  cors:
    credentials: true         # I am not sure how safe this is but this prevents it when credentials are allowed in CORS

@hhftechnology commented on GitHub (Mar 21, 2025): i did my tests it happens when using enhanced tracking protection. try adding exceptions for your domains. ``` server: # Other settings... session_cookie_name: p_session_token resource_access_token_param: p_token resource_session_request_param: p_session_request trust_proxy: true # try this mark it as true if behind a adblocker. cors: credentials: true # I am not sure how safe this is but this prevents it when credentials are allowed in CORS ```

GiteaMirror commented

@BingoRox commented on GitHub (Mar 21, 2025):

I tried with the following Safari settings on and off for the host, pangolin subdomain, and resource subdomains: Advanced Tracking and Fingerprint Protection, Prevent Cross-Site Tracking, Hide IP Address, content blockers toggled on/off.

I tried enabling trust_proxy in the config but it didn't work unfortunately. I didn't try cors credentials: true.

Thankfully ellite's solution worked for me as well, changing the server config has resolved all the redirect loops so far:

session_cookie_name: p_session_token_s
resource_access_token_param: p_token_s
resource_session_request_param: p_session_request_s

I don't know how this has fixed anything because the cookies in the console are listed as "p_session_token_s_s" now, but it's working at least!

@BingoRox commented on GitHub (Mar 21, 2025): I tried with the following Safari settings on and off for the host, pangolin subdomain, and resource subdomains: Advanced Tracking and Fingerprint Protection, Prevent Cross-Site Tracking, Hide IP Address, content blockers toggled on/off. I tried enabling trust_proxy in the config but it didn't work unfortunately. I didn't try cors credentials: true. Thankfully ellite's solution worked for me as well, changing the server config has resolved all the redirect loops so far: > session_cookie_name: p_session_token_s > resource_access_token_param: p_token_s > resource_session_request_param: p_session_request_s I don't know how this has fixed anything because the cookies in the console are listed as "p_session_token_s_s" now, but it's working at least!

GiteaMirror commented

@miloschwartz commented on GitHub (Mar 21, 2025):

I think what could be happening here is the browser is rejecting the new cookie and not overwriting the old one. I'm assuming the browsers aren't playing nice with the way we're setting the cookies in the proxy middleware.

I am going to try to test and release a change which will append a random string to the end of the cookie name for new cookies when they need to refresh. My hope is that this will solve the issue.

@miloschwartz commented on GitHub (Mar 21, 2025): I think what could be happening here is the browser is rejecting the new cookie and not overwriting the old one. I'm assuming the browsers aren't playing nice with the way we're setting the cookies in the proxy middleware. I am going to try to test and release a change which will append a random string to the end of the cookie name for new cookies when they need to refresh. My hope is that this will solve the issue.

GiteaMirror commented

@BingoRox commented on GitHub (Mar 21, 2025):

Well looks like I spoke too soon of course Safari iOS is acting up again, although it does seem like Firefox desktop has been stable. I noticed that the base domain and pangolin subdomain are not having issues, it's only the other subdomains that are redirect looping and timing out. I'm using a wildcard cert for the subdomains, not sure if it's related but just wanted to mention in case it's helpful.

@BingoRox commented on GitHub (Mar 21, 2025): Well looks like I spoke too soon of course Safari iOS is acting up again, although it does seem like Firefox desktop has been stable. I noticed that the base domain and pangolin subdomain are not having issues, it's only the other subdomains that are redirect looping and timing out. I'm using a wildcard cert for the subdomains, not sure if it's related but just wanted to mention in case it's helpful.

GiteaMirror commented

@miloschwartz commented on GitHub (Mar 22, 2025):

@BingoRox

I don't know how this has fixed anything because the cookies in the console are listed as "p_session_token_s_s" now, but it's working at least!

Does this mean you see two cookies? You should have p_session_token_s_s and p_session_token_s, which is the new cookie and the old cookie?

I just added added the thing to append the timestamp to the cookie name, and will be releasing soon. It's hard for me to tell if it's fixing the issue because I can't figure out how to replicate the redirect loop, but my fingers are crossed!

@miloschwartz commented on GitHub (Mar 22, 2025): @BingoRox > I don't know how this has fixed anything because the cookies in the console are listed as "p_session_token_s_s" now, but it's working at least! Does this mean you see two cookies? You should have `p_session_token_s_s` and `p_session_token_s`, which is the new cookie and the old cookie? I just added added the thing to append the timestamp to the cookie name, and will be releasing soon. It's hard for me to tell if it's fixing the issue because I can't figure out how to replicate the redirect loop, but my fingers are crossed!

GiteaMirror commented

@BingoRox commented on GitHub (Mar 22, 2025):

@miloschwartz

Does this mean you see two cookies?

So on pangolin.example.com (has it's own cert) I see two:

p_session_token_s (with domain listed as .pangolin.example.com)
p_session_token_s_s (with domain listed as .exmaple.com)

On example.com (has it's own cert) I see:

p_session_token_s_s (with domain listed as .exmaple.com)

On all sub.example.com (wildcard cert) I see two:

p_session_token_s_s (with domain listed as .pangolin.example.com)
p_session_token_s_s (with domain listed as .exmaple.com)

I will try the changes once they are up, should I switch to dev branch for testing or wait for main?

@BingoRox commented on GitHub (Mar 22, 2025): @miloschwartz > Does this mean you see two cookies? So on pangolin.example.com (has it's own cert) I see two: - `p_session_token_s` (with domain listed as `.pangolin.example.com`) - `p_session_token_s_s` (with domain listed as `.exmaple.com`) On example.com (has it's own cert) I see: - `p_session_token_s_s` (with domain listed as `.exmaple.com`) On all sub.example.com (wildcard cert) I see two: - `p_session_token_s_s` (with domain listed as `.pangolin.example.com`) - `p_session_token_s_s` (with domain listed as `.exmaple.com`) I will try the changes once they are up, should I switch to dev branch for testing or wait for main?

GiteaMirror commented

@miloschwartz commented on GitHub (Mar 22, 2025):

@BingoRox Thanks for the info.

Just release 1.1.0 with the changes to the cookies. Hope this makes some progress on this issue!

@miloschwartz commented on GitHub (Mar 22, 2025): @BingoRox Thanks for the info. Just release 1.1.0 with the changes to the cookies. Hope this makes some progress on this issue!

GiteaMirror commented

@BingoRox commented on GitHub (Mar 23, 2025):

@miloschwartz thank you so much! I have been on 1.1.0 for just over a day now with 0 redirect loop issues on both mobile and desktop. Fingers crossed others are having the same luck!

@BingoRox commented on GitHub (Mar 23, 2025): @miloschwartz thank you so much! I have been on 1.1.0 for just over a day now with 0 redirect loop issues on both mobile and desktop. Fingers crossed others are having the same luck!

GiteaMirror commented

@miloschwartz commented on GitHub (Mar 31, 2025):

Marking those closed. Report back if the issue is still not entirely fixed.

@miloschwartz commented on GitHub (Mar 31, 2025): Marking those closed. Report back if the issue is still not entirely fixed.

GiteaMirror commented