First of all, thanks for the great work on Pangolin — I’m new to the project and really enjoying it so far!
Today I tried to add a rule to block specific login URLs for my self-hosted services, starting with Audiobookshelf. I’d like to block all requests to:
/audiobookshelf/login/?autoLaunch=0
This URL allows bypassing the automatic redirect to the OAuth provider, which I neither want nor need. I’d like to prevent direct access via this query parameter.
I encountered the same issue with Immich:
/auth/login?autoLaunch=0
Unfortunately, I couldn’t get it to work — even when trying with wildcards.
Is there a recommended way to block requests with specific query parameters like this in Pangolin?
Thanks in advance for your help!
Originally created by @rudoma on GitHub (Jun 4, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/839
Hi everyone,
First of all, thanks for the great work on Pangolin — I’m new to the project and really enjoying it so far!
Today I tried to add a rule to block specific login URLs for my self-hosted services, starting with Audiobookshelf. I’d like to block all requests to:
/audiobookshelf/login/?autoLaunch=0
This URL allows bypassing the automatic redirect to the OAuth provider, which I neither want nor need. I’d like to prevent direct access via this query parameter.
I encountered the same issue with Immich:
/auth/login?autoLaunch=0
Unfortunately, I couldn’t get it to work — even when trying with wildcards.
Is there a recommended way to block requests with specific query parameters like this in Pangolin?
Thanks in advance for your help!
I believe that's because everything after ? is a token or parameter rather than being part of the URL itself.
I think parameter support for URLs would be great!
<!-- gh-comment-id:2942982682 -->
@seamon67 commented on GitHub (Jun 5, 2025):
I believe that's because everything after ? is a token or parameter rather than being part of the URL itself.
I think parameter support for URLs would be great!
From what I found, there are two bugs working together here :
isValidUrlGlobPattern in server/lib/validators.ts doesn't allow ? in its character allowlist, so saving a PATH rule like /login?autoLaunch=0 is being rejected at the API level before it even hits the database.
isPathAllowed in server/routers/badger/verifySession.ts only matches against the path segment, it has no awareness of query parameters at all, so even if a rule with ? somehow gets saved, it would never match.
I can work on this, can somebody assign it to me please?
<!-- gh-comment-id:4312846972 -->
@sidd190 commented on GitHub (Apr 24, 2026):
From what I found, there are two bugs working together here :
`isValidUrlGlobPattern` in `server/lib/validators.ts` doesn't allow `?` in its character allowlist, so saving a PATH rule like `/login?autoLaunch=0` is being rejected at the API level before it even hits the database.
`isPathAllowed` in `server/routers/badger/verifySession.ts` only matches against the path segment, it has no awareness of query parameters at all, so even if a rule with `?` somehow gets saved, it would never match.
I can work on this, can somebody assign it to me please?
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @rudoma on GitHub (Jun 4, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/839
Hi everyone,
First of all, thanks for the great work on Pangolin — I’m new to the project and really enjoying it so far!
Today I tried to add a rule to block specific login URLs for my self-hosted services, starting with Audiobookshelf. I’d like to block all requests to:
/audiobookshelf/login/?autoLaunch=0
This URL allows bypassing the automatic redirect to the OAuth provider, which I neither want nor need. I’d like to prevent direct access via this query parameter.
I encountered the same issue with Immich:
/auth/login?autoLaunch=0
Unfortunately, I couldn’t get it to work — even when trying with wildcards.
Is there a recommended way to block requests with specific query parameters like this in Pangolin?
Thanks in advance for your help!
@seamon67 commented on GitHub (Jun 5, 2025):
I believe that's because everything after ? is a token or parameter rather than being part of the URL itself.
I think parameter support for URLs would be great!
@sidd190 commented on GitHub (Apr 24, 2026):
From what I found, there are two bugs working together here :
isValidUrlGlobPatterninserver/lib/validators.tsdoesn't allow?in its character allowlist, so saving a PATH rule like/login?autoLaunch=0is being rejected at the API level before it even hits the database.isPathAllowedinserver/routers/badger/verifySession.tsonly matches against the path segment, it has no awareness of query parameters at all, so even if a rule with?somehow gets saved, it would never match.I can work on this, can somebody assign it to me please?