Redirect to login.html is incorrect when using a reverse proxy

sstallion commented 9 months ago

Prerequisites

[X] I have checked the Wiki and Discussions and found no answer
[X] I have searched other issues and found no duplicates
[X] I want to report a bug and not ask a question or ask for help
[X] I have set up AdGuard Home correctly and configured clients to use it. (Use the Discussions for help with installing and configuring clients.)

Platform (OS and CPU architecture)

FreeBSD, AMD64 (aka x86_64)

Installation

Custom package (OpenWrt, HomeAssistant, etc; please mention in the description)

Setup

On one machine

AdGuard Home version

0.107.36

Action

When using AdGuard Home behind a reverse proxy (Apache 2.4 in this case), unauthenticated users are redirected to /login.html, which causes issues when placed behind a subdirectory. The naive fix for this would be a relative redirect (eg. login.html.

My Apache configuration (which should be equivalent to the documented nginx configuration) is:

ProxyPreserveHost On
ProxyPass /adguard/ http://localhost:3000/
ProxyPassReverse /adguard/ http://localhost:3000/
ProxyPassReverseCookiePath /adguard/ /

Thanks in advance!

Expected result

Redirects work when using a reverse proxy from a subdirectory (eg. /adguard/login.html).

Actual result

An absolute redirect to /login.html is performed.

Additional information and/or screenshots

FreeBSD 13.2-RELEASE-p9; installed using the www/adguardhome port.

overwatch3560 commented 5 months ago

@sstallion are you still experiencing this issue ?

sstallion commented 5 months ago

@sstallion are you still experiencing this issue ?

I am.

EugeneOne1 commented 3 months ago

@sstallion, hello and apologies for the late response. Unfortunately, we can't reproduce it with nginx, following this guide. However, I think I've noticed a mistake in the shared Apache configuration – according to the documentation, the ProxyPassReverseCookiePath directive behaves just like proxy_cookie_path in nginx, looking for the first argument to rewrite it with the second, and not vice versa. Could you please try to run the proxy with the change?

sstallion commented 3 months ago

@sstallion, hello and apologies for the late response. Unfortunately, we can't reproduce it with nginx, following this guide. However, I think I've noticed a mistake in the shared Apache configuration – according to the documentation, the ProxyPassReverseCookiePath directive behaves just like proxy_cookie_path in nginx, looking for the first argument to rewrite it with the second, and not vice versa. Could you please try to run the proxy with the change?

Nice catch! I fixed the configuration, but unfortunately I'm still seeing the same behavior.

EugeneOne1 commented 3 months ago

@sstallion, hello and apologies for the late reply. We've been trying different configurations of the Apache HTTP server and haven't really come up with a reliable one. The thing is, we can't just use the relative URLs without leading slashes, because sometimes AdGuard Home redirects to the root (http://localhost:3000/) of the domain, which is not possible to perform relatively.

Changing the Location header is actually the work for the reverse HTTP proxy. The ProxyPassReverse directive seems to be intended for this, but we can't get it to work with relative redirections (it worked with an absolute URL in the header, but AdGuard Home doesn't know the hostname of the actual URL). AFAIK there might be some workarounds like using the RewriteRule directive, but in general the Apache reverse HTTP proxy is not recommended to be used behind AdGuard Home, please consider using the alternatives mentioned in the knowledge base.

naanlizard commented 2 months ago

Happens with nginx too

https://github.com/AdguardTeam/AdGuardHome/blob/bf1101b4603ced00e6333dd77c8a0f78a867f088/internal/home/authhttp.go#L279

This line always redirects to domain.tld/login.html

If your adguard install is in a subfolder (e.g. domain.tld/adguard/) it will redirect to the wrong place

location /adguard/ {

    include /config/nginx/proxy.conf; # from [docker-swag](https://github.com/linuxserver/docker-swag/blob/79f6dd4cb19ed2e186ddeb048350c6124e17219a/root/defaults/nginx/proxy.conf.sample)
    proxy_cookie_path / /adguard/;

    proxy_pass http://adguardIP:80/;

}

AdguardTeam / AdGuardHome