HTTP header are not forwarded breaking OIDC for some apps #169

New Issue

2025-11-13T11:52:01-06:00

GiteaMirror commented

2025-11-13 11:52:01 -06:00

Originally created by @bannert1337 on GitHub (Mar 21, 2025).

After I switched FreshRSS from Cloudflare Tunnel to Pangolin, authentication with Authenik wouldn't work anymore with the error:

This happens because the HTTP headers are not or incorrectly forwarded.

Reference:
https://github.com/FreshRSS/FreshRSS/issues/7296
https://github.com/FreshRSS/FreshRSS/issues/7257

Originally created by @bannert1337 on GitHub (Mar 21, 2025). After I switched FreshRSS from Cloudflare Tunnel to Pangolin, authentication with Authenik wouldn't work anymore with the error: ![Image](https://github.com/user-attachments/assets/7f8252a8-0288-46b8-8dfa-cab057fbfa05) This happens because the HTTP headers are not or incorrectly forwarded. Reference: https://github.com/FreshRSS/FreshRSS/issues/7296 https://github.com/FreshRSS/FreshRSS/issues/7257

GiteaMirror added the stale label 2025-11-13 11:52:01 -06:00

GiteaMirror closed this issue

2025-11-13 11:52:01 -06:00

GiteaMirror commented

2025-11-13 11:52:02 -06:00

@oschwartz10612 commented on GitHub (Mar 24, 2025):

It looks like Traefik is passing the host header along by default: https://doc.traefik.io/traefik/routing/services/#pass-host-header

Here is an excerpt I just tested using the whoami container.

Hostname: db3b364a2cf4
IP: 127.0.0.1
IP: ::1
IP: 172.17.0.4
RemoteAddr: 172.17.0.1:34250
GET / HTTP/1.1
Host: test.mydomain.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Encoding: gzip, br
Accept-Language: en-US,en;q=0.5
Alt-Used: test.mydomain.net
Priority: u=0, i
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 172.70.43.61
X-Forwarded-Host: test.mydomain.net
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 11afa51cd854
X-Real-Ip: 172.70.43.61

@oschwartz10612 commented on GitHub (Mar 24, 2025): It looks like Traefik is passing the host header along by default: https://doc.traefik.io/traefik/routing/services/#pass-host-header Here is an excerpt I just tested using the whoami container. ``` Hostname: db3b364a2cf4 IP: 127.0.0.1 IP: ::1 IP: 172.17.0.4 RemoteAddr: 172.17.0.1:34250 GET / HTTP/1.1 Host: test.mydomain.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8 Accept-Encoding: gzip, br Accept-Language: en-US,en;q=0.5 Alt-Used: test.mydomain.net Priority: u=0, i Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-site Sec-Fetch-User: ?1 Upgrade-Insecure-Requests: 1 X-Forwarded-For: 172.70.43.61 X-Forwarded-Host: test.mydomain.net X-Forwarded-Port: 443 X-Forwarded-Proto: https X-Forwarded-Server: 11afa51cd854 X-Real-Ip: 172.70.43.61 ```

GiteaMirror commented

2025-11-13 11:52:02 -06:00

@davidszerman commented on GitHub (Mar 25, 2025):

Hi,

did you find a workaround ?

@davidszerman commented on GitHub (Mar 25, 2025): Hi, did you find a workaround ?

GiteaMirror commented

2025-11-13 11:52:02 -06:00

@github-actions[bot] commented on GitHub (Apr 11, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

@github-actions[bot] commented on GitHub (Apr 11, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

GiteaMirror commented

2025-11-13 11:52:02 -06:00

@github-actions[bot] commented on GitHub (Apr 26, 2025):

This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.

@github-actions[bot] commented on GitHub (Apr 26, 2025): This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.