github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-21 18:53:07 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[GH-ISSUE #2657] Token refresh fails when hosting in a subdirectory #6724

New Issue
Closed
opened 2026-04-20 17:18:14 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-20 17:18:14 -05:00
Owner
Copy Link

Originally created by @ceroma on GitHub (Apr 19, 2026).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2657

Pre-submission checklist

  • I have searched for existing open or closed issue reports with the same problem.

Description

The refresh token cookie is hard-coded to the /api/v1/user/token/refresh path:
56aef03697/pkg/modules/auth/auth.go (L51)

When running Vikunja in a subdirectory (https://vikunja.io/docs/running-vikunja-in-a-subdirectory/), this makes the token refresh call always fail with "No refresh token provided.". The cookie is never sent to <sub-path>/api/v1/user/token/refresh because of the path mismatch.

I guess one possible fix is to build the cookie path dynamically based on the requests' path? Or, alternatively, use the same env var VIKUNJA_FRONTEND_BASE to build the path?

Vikunja Version

v2.3.0

Browser and version

No response

Can you reproduce the bug on the Vikunja demo site?

No

Screenshots

No response

Originally created by @ceroma on GitHub (Apr 19, 2026). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2657 ### Pre-submission checklist - [x] I have searched for existing open or closed issue reports with the same problem. ### Description The refresh token cookie is hard-coded to the `/api/v1/user/token/refresh` path: https://github.com/go-vikunja/vikunja/blob/56aef0369766268a6bf9a5c72f6e2b2ff0155c10/pkg/modules/auth/auth.go#L51 When running Vikunja in a subdirectory (https://vikunja.io/docs/running-vikunja-in-a-subdirectory/), this makes the token refresh call always fail with "No refresh token provided.". The cookie is never sent to `<sub-path>/api/v1/user/token/refresh` because of the path mismatch. I guess one possible fix is to build the cookie path dynamically based on the requests' path? Or, alternatively, use the same env var `VIKUNJA_FRONTEND_BASE` to build the path? ### Vikunja Version v2.3.0 ### Browser and version _No response_ ### Can you reproduce the bug on the Vikunja demo site? No ### Screenshots _No response_
GiteaMirror added the area/auth label 2026-04-20 17:18:14 -05:00
GiteaMirror commented 2026-04-20 17:18:18 -05:00
Author
Owner
Copy Link

@ceroma commented on GitHub (Apr 19, 2026):

I just figured out that I can rewrite the cookie's path with Nginx's proxy_cookie_path, but I'll leave the issue open in case you might want to update the subdirectory docs to mention this cookie.

<!-- gh-comment-id:4276715974 --> @ceroma commented on GitHub (Apr 19, 2026): I just figured out that I can rewrite the cookie's path with Nginx's `proxy_cookie_path`, but I'll leave the issue open in case you might want to update the subdirectory docs to mention this cookie.
GiteaMirror commented 2026-04-20 17:18:20 -05:00
Author
Owner
Copy Link

@kolaente commented on GitHub (Apr 20, 2026):

Will be fixed by https://github.com/go-vikunja/vikunja/pull/2588

<!-- gh-comment-id:4281614557 --> @kolaente commented on GitHub (Apr 20, 2026): Will be fixed by https://github.com/go-vikunja/vikunja/pull/2588
GiteaMirror commented 2026-04-20 17:18:21 -05:00
Author
Owner
Copy Link

@vikunja-bot-app[bot] commented on GitHub (Apr 20, 2026):

This issue has been fixed in #2588, please check with the next unstable build (should be ready for deployment in ~30min, also on the demo).

<!-- gh-comment-id:4281734095 --> @vikunja-bot-app[bot] commented on GitHub (Apr 20, 2026): This issue has been fixed in #2588, please check with the next unstable build (should be ready for deployment in ~30min, also on [the demo](https://try.vikunja.io)).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label area/auth
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6724
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?