proxy auth broken again

gardiol commented 1 month ago

My website is broken again using proxy auth on subdomain.

All i get is a permanent page reload and no browser authentication popup from silberbullet

I have just upgraded from ad old, but working, build to latest release on github.

Its a regression, sorry ;)

Previously it was this ticket: https://github.com/silverbulletmd/silverbullet/issues/804

And it was fixed.

Some more context:

I host sb on "notes.mydomain.net"
I have a nginx reverse proxy that redirect and authenticate, to sb socket
sb runs on my server as its dedicated user for proper filesystem permissions
sb downloaded from github releases page
Firefox just reload the page indefinitely if not already authenticated
before, after issue 804 was fixed, it would popup a browser authentication dialog and then would work

Currently I am forced to stop using sb at least while outside home, where the proxy auth is not used.

zefhemel commented 1 month ago

Do you happen to remember what the mat version was that you ran? And now you're on 0.9? I don't think anything has changed here for a very long time.

gardiol commented 1 month ago

I am currently using 0.9.0, and i was previously on 0.7.6 (IIRC).

I have to say that the issue seems to be present only on mobile browsers (tested latest Firefox on Android). Both Chrome and Firefox on Linux instead do a single page reload and then the auth popup is displayed.

gorootde commented 1 month ago

Same issue on MacOS & iOS using Safari or in PWA. Also Firefox on MacOS shows the issue.

I was able to interrupt the endless reload loop and capture some information from the browser's console. Hope that helps.

Got error fetching, throwing offline "<url>/index.json" - TypeError: Load Failed - client.js:18:16709
Error: Offline - client.js:17
Booting SilverBullet client - "in Online Mode"
Service worker registered...
Rebuilding editor state
Failed to load resource: the server responded with a status of 401 - <url>/.ping
Failed to load resource: the server responded with a status of 503 - <url>/index.json
Could not reach remote server, we're offline or the server is down - Error: Not authenticated, got 403 - client.js:18:16563
Loading plugs
(Re)loading plugs
alreadyFetching is on, skipping even triggering for fetchFileList - client.js:18
Error: Offline - client.js:18
Failed to load resource: the server responded with a status of 503 - <url>/index.json
Error: Offline - client.js:18
...

I am running 0.9.0 as well.

zefhemel commented 3 weeks ago

Ok, pushed some tweaks to default, should be on edge soon. Could you check if this fixes or at least gives some more info?

gardiol commented 2 weeks ago

I have just tried build 0.9.2 and i can report that now not even Firefox on linux works, the page just keep reloading forever. what's annoying is that i can see the entire content of the page even before the authentication (but this might be cached in the browser).

I need to test edge but unclear how to do it

gardiol commented 2 weeks ago

The website now keeps popping up "You are not authenticated, going to reload and hope that that kicks off authentication" forever. Tried on Chrome and Firefox for Linux.

This is from firefox javascript console while stopped at popup:

Loading plugs [client.js:2528:21166](https://notes.mydomain.com/.client/client.js)
(Re)loading plugs [client.js:2528:21225](https://notes.mydomain.com/.client/client.js)
Activated plug editor [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug emoji [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug federation [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug index [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug markdown [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Booting up worker for markdown [client.js:2247:17012](https://notes.mydomain.com/.client/client.js)
Activated plug plug-manager [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug query [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug search [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug share [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug sync [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug tasks [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
Activated plug template [client.js:2247:22110](https://notes.mydomain.com/.client/client.js)
GET
https://notes.mydomain.com/_plug/markdown.plug.js
NS_ERROR_CORRUPTED_CONTENT

Booting SilverBullet client in Sync Mode [client.js:2547:1577](https://notes.mydomain.com/.client/client.js)
Service worker registered... [client.js:2547:1985](https://notes.mydomain.com/.client/client.js)
Index plug not loaded yet, falling back to default config [client.js:2544:366](https://notes.mydomain.com/.client/client.js)
Rebuilding editor state [client.js:2545:5610](https://notes.mydomain.com/.client/client.js)
XHRGET
https://notes.mydomain.com/.ping
[HTTP/1.1 401 Unauthorized 0ms]

Errore nella mappatura delle origini: Error: request failed with status 401
URL risorsa: https://notes.mydomain.com/.client/client.js
URL mappa delle origini: client.js.map

This is all i get in my NGINX logs (error log is empty) when i click on the popup button:

127.0.0.1 - - [26/Aug/2024:14:25:37 +0200] "GET /.ping HTTP/1.1" 401 375 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" "-"
127.0.0.1 - - [26/Aug/2024:14:25:37 +0200] "GET /.client/client.js.map HTTP/1.1" 401 375 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" "-"
127.0.0.1 - - [26/Aug/2024:14:25:37 +0200] "GET /service_worker.js HTTP/1.1" 401 375 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" "-"

to complete the picture, here is my NGINX configuration for Silverbullet:

server {
        server_name notes.mydomain.com;
        listen 443 ssl;
        auth_pam "MyAuth";
        auth_pam_service_name "myPamServiceName";
        location / {
                client_max_body_size 512M;
                proxy_pass http://127.0.0.1:8001$uri;
        }
}

(only relevant parts, some lines omitted like Let's Encrypt lines and such)

(edit: edited to reflect new discoveries)

zefhemel commented 2 weeks ago

The question is: what should SilverBullet do when it starts to get 401s? The assumption is a redirect is in place to send the user to a login page, but if that's not there... what should it do?

gardiol commented 2 weeks ago

I have no idea, usually any web page i use that require a login does get the login, when using the Proxy Auth, the browser automatically pops up the login form before even showing anything. For some reason, which i don't know, when the web page contains Silverbuller there is no login popup., whatever SB is doing, is preventing the browser from showing that popup.

gardiol commented 2 weeks ago

Does Silverbullet support any kind of auth otherwise? I need auth because i host on a public subdomain, but i don't need to use Proxy Auth is there is another option.

zefhemel commented 2 weeks ago

https://silverbullet.md/Authentication

gardiol commented 2 weeks ago

Ok, better than being unable to use it, but still I hope the proxy auth can be fixed!

ruibinx commented 2 weeks ago

Does Silverbullet support any kind of auth otherwise? I need auth because i host on a public subdomain, but i don't need to use Proxy Auth is there is another option.

I'm setting up Silverbullet behind Cloudflare Access. It's easy to setup, and works as expected most of the time right now.

gardiol commented 2 weeks ago

Sorry, not using cloudflare at all, and there is no reason to. Proxy Auth works fine for all services, except SB at the moment.

Would be possible to totally disable any managing of auth or 401 errors within SB and see if that fix it? Maybe with a command line option?

gardiol commented 2 weeks ago

I think something is really broken with SB authentication. I have done some more experimenting trying to connect SB with my authelia instance.

If i login with authelia, then open the SB subdomain, SB will work just fine.

If i logout from authelia then try to open SB subdomain, the expected behaviour is that the browser opens the authelia login page ( login.mydomain.com) which, in turn, will redirect to SB subdomain (notes.mydomain.com). This is configured in the reverse proxy and just works for the other subdomains i am using it on.

Instead, the SB page will reload indefinitely saying it's offline and cannot access. This is an extract of the firefox console log:

error General sync error: Offline [client.js:18:6946](https://notes.mydomain.com/.client/client.js)
Sync error Offline [client.js:18:13480](https://notes.mydomain.com/.client/client.js)
Errore nella mappatura delle origini: Error: NetworkError when attempting to fetch resource.
URL risorsa: https://notes.mydomain.com/.client/client.js
URL mappa delle origini: client.js.map

Flushed widget cache to store [client.js:2547:1301](https://notes.mydomain.com/.client/client.js)
Syncing file index.md [client.js:18:13742](https://notes.mydomain.com/.client/client.js)
XHRGET
https://notes.mydomain.com/index.md
[HTTP/1.1 503  0ms]

Sync error Error: Offline
    authenticatedFetch https://notes.mydomain.com/.client/client.js:18
    getFileMeta https://notes.mydomain.com/.client/client.js:18
    getFileMeta https://notes.mydomain.com/.client/client.js:18
    syncFile https://notes.mydomain.com/.client/client.js:18
    init https://notes.mydomain.com/.client/client.js:2544
[client.js:18:14473](https://notes.mydomain.com/.client/client.js)
Syncing file index.md [client.js:18:13742](https://notes.mydomain.com/.client/client.js)
XHRGET
https://notes.mydomain.com/index.md
[HTTP/1.1 503  0ms]

There is also that CORS error (Errore nella mappatura delle origini), which baffles me because there is no reason for it at all to be there, everything is on the same domain.

And the last worrying bit is that i can see the content of the page even if i am not authenticated.

zefhemel commented 3 days ago

Just pushed some more changes to try to address this. If you could try this on edge again that'd be great.

zefhemel commented 1 day ago

Had to revert the change. Broke other stuff.

gardiol commented 1 day ago

For another stupid web page I have, I just added a JavaScript reload line on any ajax failed promise, and that works, but SB it's much more complex.

silverbulletmd / silverbullet

proxy auth broken again #1028