github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-07 03:58:09 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[GH-ISSUE #1201] Avatar not showing in the page due to authorization issue in API #6334

New Issue
Closed
opened 2026-04-20 16:55:02 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-20 16:55:02 -05:00
Owner
Copy Link

Originally created by @m-spitfire on GitHub (Jul 30, 2025).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/1201

Description

The avatar API call to https://tasks.000376.xyz/api/v1/avatar/spitf1re?size=50&=1753884009241 returns 401 status code with missing, malformed, expired or otherwise invalid token provided message. This is due to the fact that the request doesn't have proper Authorization header set:

GET /api/v1/avatar/spitf1re?size=50&=1753884009241 HTTP/1.1
Host: tasks.000376.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0
Accept: image/avif,image/jxl,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://tasks.000376.xyz/
Sec-GPC: 1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Connection: keep-alive
Cookie: authelia_session=<redacted>

However all the other calls that require auth have that header set to Authorization: Bearer <token>

Vikunja Version

Latest HEAD (c303344183aa3bd26eabbfc05dd05756a9b71a8e)

Browser and version

Zen browser 1.14.8b, Google Chrome 138.0.7204.169

Can you reproduce the bug on the Vikunja demo site?

No

Screenshots

Image
Originally created by @m-spitfire on GitHub (Jul 30, 2025). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/1201 ### Description The avatar API call to `https://tasks.000376.xyz/api/v1/avatar/spitf1re?size=50&=1753884009241` returns 401 status code with `missing, malformed, expired or otherwise invalid token provided` message. This is due to the fact that the request doesn't have proper `Authorization` header set: ``` GET /api/v1/avatar/spitf1re?size=50&=1753884009241 HTTP/1.1 Host: tasks.000376.xyz User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0 Accept: image/avif,image/jxl,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br, zstd Referer: https://tasks.000376.xyz/ Sec-GPC: 1 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Connection: keep-alive Cookie: authelia_session=<redacted> ``` However all the other calls that require auth have that header set to `Authorization: Bearer <token>` ### Vikunja Version Latest HEAD (`c303344183aa3bd26eabbfc05dd05756a9b71a8e`) ### Browser and version Zen browser 1.14.8b, Google Chrome 138.0.7204.169 ### Can you reproduce the bug on the Vikunja demo site? No ### Screenshots <img width="150" height="83" alt="Image" src="https://github.com/user-attachments/assets/1ec7346e-b4e0-4c04-8416-9e396da7b8fd" />
GiteaMirror added the waiting for reply label 2026-04-20 16:55:02 -05:00
GiteaMirror commented 2026-04-20 16:55:04 -05:00
Author
Owner
Copy Link

@kolaente commented on GitHub (Jul 30, 2025):

Are you using the bundled web frontend? Or a different client?

<!-- gh-comment-id:3136772196 --> @kolaente commented on GitHub (Jul 30, 2025): Are you using the bundled web frontend? Or a different client?
GiteaMirror commented 2026-04-20 16:55:04 -05:00
Author
Owner
Copy Link

@m-spitfire commented on GitHub (Jul 30, 2025):

Yes. The bundled web frontend. If you need access to it i can create an account for you in the instance.

<!-- gh-comment-id:3136787739 --> @m-spitfire commented on GitHub (Jul 30, 2025): Yes. The bundled web frontend. If you need access to it i can create an account for you in the instance.
GiteaMirror commented 2026-04-20 16:55:05 -05:00
Author
Owner
Copy Link

@kolaente commented on GitHub (Jul 30, 2025):

The web frontend makes requests with the required auth headers. You can see this is working correctly on the demo.

Can you verify that the frontend build you're using is up to date?

<!-- gh-comment-id:3136795320 --> @kolaente commented on GitHub (Jul 30, 2025): The web frontend makes requests with the required auth headers. You can see this is working correctly on the demo. Can you verify that the frontend build you're using is up to date?
GiteaMirror commented 2026-04-20 16:55:06 -05:00
Author
Owner
Copy Link

@m-spitfire commented on GitHub (Jul 30, 2025):

Yes. I can see working correctly on the demo. And I'm using latest version of the vikunja built from source on ref c303344.
I found that on the demo the avatar fetch requests are initiated by JS:

Image

But on my instance they are initiated by img attribute (i think?) and there's also &1753893211567 query param like thing in the end, which I have no idea what it is.

Image This is my instance config: 
auth:
  local:
    enabled: false
  openid:
    enabled: true
    providers:
      authelia:
        authurl: https://auth.000376.xyz
        clientid: vikunja
        name: Authelia
    redirecturl: https://tasks.000376.xyz/auth/openid/
cors:
  origins:
  - https://tasks.000376.xyz
database:
  database: vikunja
  host: /run/postgresql
  path: /var/lib/vikunja/vikunja.db
  type: postgres
  user: vikunja
files:
  basepath: /var/lib/vikunja/files
service:
  frontendurl: https://tasks.000376.xyz/
  interface: :3456
  jwtttl: 7889400
  publicurl: https://tasks.000376.xyz
  timezone: Asia/Baku
<!-- gh-comment-id:3137116867 --> @m-spitfire commented on GitHub (Jul 30, 2025): Yes. I can see working correctly on the demo. And I'm using latest version of the vikunja built from source on ref `c303344`. I found that on the demo the avatar fetch requests are initiated by JS: <img width="1003" height="123" alt="Image" src="https://github.com/user-attachments/assets/20cdc78b-da5f-42d5-96e8-4f987c4efc97" /> But on my instance they are initiated by `img` attribute (i think?) and there's also `&1753893211567` query param like thing in the end, which I have no idea what it is. <img width="734" height="113" alt="Image" src="https://github.com/user-attachments/assets/c54f38ec-7373-480e-82a5-76b6094cd15b" /> This is my instance config: ```yaml auth: local: enabled: false openid: enabled: true providers: authelia: authurl: https://auth.000376.xyz clientid: vikunja name: Authelia redirecturl: https://tasks.000376.xyz/auth/openid/ cors: origins: - https://tasks.000376.xyz database: database: vikunja host: /run/postgresql path: /var/lib/vikunja/vikunja.db type: postgres user: vikunja files: basepath: /var/lib/vikunja/files service: frontendurl: https://tasks.000376.xyz/ interface: :3456 jwtttl: 7889400 publicurl: https://tasks.000376.xyz timezone: Asia/Baku ```
GiteaMirror commented 2026-04-20 16:55:08 -05:00
Author
Owner
Copy Link

@kolaente commented on GitHub (Jul 30, 2025):

This sounds like you're using an old frontend with a new api. How are you building Vikunja? Are you using the official builds?

<!-- gh-comment-id:3137331654 --> @kolaente commented on GitHub (Jul 30, 2025): This sounds like you're using an old frontend with a new api. How are you building Vikunja? Are you using the official builds?
GiteaMirror commented 2026-04-20 16:55:09 -05:00
Author
Owner
Copy Link

@m-spitfire commented on GitHub (Aug 4, 2025):

Hello. Sorry for the late reply. I'm using Nix overlays to use master version of the build but apparently my overlay has only been for backend, it has been using stable version of the frontend. Should have read the package file better.

<!-- gh-comment-id:3152254436 --> @m-spitfire commented on GitHub (Aug 4, 2025): Hello. Sorry for the late reply. I'm using Nix overlays to use master version of the build but apparently my overlay has only been for backend, it has been using stable version of the frontend. Should have read [the package file](https://github.com/NixOS/nixpkgs/blob/nixos-25.05/pkgs/by-name/vi/vikunja/package.nix) better.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label waiting for reply
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6334
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?