github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-03-16 11:51:01 -05:00
Code Issues 94 Packages Projects Releases 48 Wiki Activity

Failed authentications on pangolin returns 400 error code instead of 401 in the DownStreamStatus field in traefik logs #119

New Issue
Closed
opened 2025-11-13 11:50:34 -06:00 by GiteaMirror · 5 comments
GiteaMirror commented 2025-11-13 11:50:34 -06:00
Owner
Copy Link

Originally created by @LePresidente on GitHub (Mar 4, 2025).

Originally assigned to: @oschwartz10612 on GitHub.

When a failed login attempt is done on pangolin the DownStreamStatus is 400 instead of 401 in the traefik logs

snip from the traefik log

{"ClientAddr":"<redacted>:64974","ClientHost":"<redacted>","DownstreamContentSize":114,"DownstreamStatus":400,"Duration":20032776,"RequestMethod":"POST","RequestPath":"/api/v1/auth/login","RequestProtocol":"HTTP/2.0","RetryAttempts":0,"ServiceName":"api-service@file","StartUTC":"2025-03-04T17:36:36.207121382Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","downstream_Content-Type":"application/json; charset=utf-8","downstream_X-Forwarded-Proto":"https","level":"info","msg":"","origin_Content-Type":"application/json; charset=utf-8","origin_X-Forwarded-Proto":"https","request_Content-Type":"application/json","request_User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","request_X-Forwarded-For":"<redacted>","request_X-Forwarded-Proto":"https","request_X-Real-Ip":"<redacted>","time":"2025-03-04T17:36:36Z"}

Current Error Code: 400 Bad Request
Expected Error Code: 401 Unauthorized

Note if the error code is 401, crowdsec will automatically catch these as failed login attempts.

Originally created by @LePresidente on GitHub (Mar 4, 2025). Originally assigned to: @oschwartz10612 on GitHub. When a failed login attempt is done on pangolin the DownStreamStatus is 400 instead of 401 in the traefik logs snip from the traefik log ``` {"ClientAddr":"<redacted>:64974","ClientHost":"<redacted>","DownstreamContentSize":114,"DownstreamStatus":400,"Duration":20032776,"RequestMethod":"POST","RequestPath":"/api/v1/auth/login","RequestProtocol":"HTTP/2.0","RetryAttempts":0,"ServiceName":"api-service@file","StartUTC":"2025-03-04T17:36:36.207121382Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","downstream_Content-Type":"application/json; charset=utf-8","downstream_X-Forwarded-Proto":"https","level":"info","msg":"","origin_Content-Type":"application/json; charset=utf-8","origin_X-Forwarded-Proto":"https","request_Content-Type":"application/json","request_User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","request_X-Forwarded-For":"<redacted>","request_X-Forwarded-Proto":"https","request_X-Real-Ip":"<redacted>","time":"2025-03-04T17:36:36Z"} ``` Current Error Code: 400 Bad Request Expected Error Code: 401 Unauthorized **Note** _if the error code is 401, crowdsec will automatically catch these as failed login attempts._
GiteaMirror added the enhancementapi labels 2025-11-13 11:50:34 -06:00
GiteaMirror commented 2025-11-13 11:50:35 -06:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Mar 5, 2025):

I think this is solved by 654ed46. Let me know what you think!

@oschwartz10612 commented on GitHub (Mar 5, 2025): I think this is solved by [654ed46](https://github.com/fosrl/pangolin/commit/654ed46a46d909b225694a76eb0536aba6cc39a8). Let me know what you think!
GiteaMirror commented 2025-11-13 11:50:36 -06:00
Author
Owner
Copy Link

@LePresidente commented on GitHub (Mar 5, 2025):

LGTM!

@LePresidente commented on GitHub (Mar 5, 2025): LGTM!
GiteaMirror commented 2025-11-13 11:50:36 -06:00
Author
Owner
Copy Link

@hhftechnology commented on GitHub (Mar 5, 2025):

bro has reduced a ton of work. i have scraped my phaser project.

@hhftechnology commented on GitHub (Mar 5, 2025): bro has reduced a ton of work. i have scraped my phaser project.
GiteaMirror commented 2025-11-13 11:50:36 -06:00
Author
Owner
Copy Link

@LePresidente commented on GitHub (Mar 5, 2025):

Is there an eta when a release will be done that includes this? Since this leaves local instances open to a degree

@LePresidente commented on GitHub (Mar 5, 2025): Is there an eta when a release will be done that includes this? Since this leaves local instances open to a degree
GiteaMirror commented 2025-11-13 11:50:36 -06:00
Author
Owner
Copy Link

@hhftechnology commented on GitHub (Mar 7, 2025):

Api is giving 401 error

Image

@hhftechnology commented on GitHub (Mar 7, 2025): Api is giving 401 error ![Image](https://github.com/user-attachments/assets/da02da7c-b32f-4bbb-a998-63731fa9c190)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
No Label api enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#119
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?