Kareadita / Kavita

Kavita is a fast, feature rich, cross platform reading server. Built with the goal of being a full solution for all your reading needs. Setup your own server and share your reading collection with your friends and family.
http://www.kavitareader.com
GNU General Public License v3.0
6.15k stars 320 forks source link

/api endpoint authorization method breaks the basic authorizatioin on reverse proxy #2992

Open sulisu opened 4 months ago

sulisu commented 4 months ago

What happened?

1) Config a reverse proxy for Kavita and enable base authentication for the reverse proxy. 2) There is no problem to access the login page,. 3) After enter the credential, browser pop up basic authentiction dialogue. In the following requests after login, such as "https://site/api/device", the authorization header content is replaced by api credential in form of "bearer xxxxxxx", not basic credential used by reverse proxy. So the request can not be authenticated by the reverse proxy.

What did you expect?

Accordint to this two discussion on stackoverflow, Kavita shoud put api authentication message in cookies not in standard HTTP header, or use a non standard http header for its api authentication.

https://stackoverflow.com/questions/64527584/how-to-send-basic-auth-for-nginx-and-bearer-token-for-api-auth https://stackoverflow.com/questions/8463809/customize-the-authorization-http-header

Kavita Version Number - If you don not see your version number listed, please update Kavita and see if your issue still persists.

0.8.1 - Stable

What operating system is Kavita being hosted from?

Windows

If the issue is being seen on Desktop, what OS are you running where you see the issue?

Windows

If the issue is being seen in the UI, what browsers are you seeing the problem on?

Firefox, Chrome

If the issue is being seen on Mobile, what OS are you running where you see the issue?

Android

If the issue is being seen on the Mobile UI, what browsers are you seeing the problem on?

Firefox, Chrome

Relevant log output

No response

Additional Notes

No response

majora2007 commented 4 months ago

This is probably something better suited for a Feature Request.