search

enchant97 / note-mark

Note Mark is a lighting fast and minimal; web-based Markdown notes app.
https://notemark.docs.enchantedcode.co.uk/
GNU Affero General Public License v3.0
313 stars 8 forks source link

(BUG) proxy forward auth/IDP and CORS #183

Closed wurst44 closed 8 months ago

wurst44 commented 8 months ago

Is there an existing issue for this?

Is This A Security Issue?

Describe The Problem

Hi, very nice, slim app 👍 I am using a nginx reverse proxy and everthing works fine. I also enabled CORS (tried both * and my TDLs) and using no cache...

image

When I enable my Authentik proxy forward auth/IDP the app tries to make an request to /api which is forwarede to my IDP auth.TLD.com:

noteMarkCors

Access to fetch at 'https://auth.TLD.com/application/o/authorize/?client_id=EuOyaHfRyXXXXe.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3DtrXXXXn8Q' (redirected from 'https://note.TLD.com/api/users/me') from origin 'https://note.TLD.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

This seems to fail because of missing CORS headers. Any Ideas on this?

Expected Behavior

No Error with a proxy forward auth setup.

Steps To Reproduce

No response

Environment

No response

Extra Context

No response

enchant97 commented 8 months ago

I do not offer support for integrating with other applications/reverse-proxies. I also have no experience with Authentik so cannot help with this.

Closing as this seem unlikely to be an issue of the core application.