search

traccar / traccar-manager-ios

Traccar Manager for iOS
https://www.traccar.org/manager
Apache License 2.0
109 stars 193 forks source link

Can’t log in if another auth layer is used (Cloudflare Access) #49

Open jbschooley opened 11 months ago

jbschooley commented 11 months ago

Describe the bug If I enable Cloudflare Access as an additional layer of security on my instance, the app says it can’t connect to the server. Because the app just shows the web interface, I would expect it to show my cloudflare login screen and allow me to log in before displaying the Traccar interface.

To Reproduce Steps to reproduce the behavior:

  1. Make your instance publicly accessible using Cloudflare DNS
  2. In the cloudflare zero trust panel, set up your subdomain as a self hosted application and set up auth
  3. Open Traccar in a browser. You’ll see the cloudflare login screen first, after which the Traccar login screen will show.

Expected behavior The app should show the extra login screen, rather than complain that the site doesn’t look like Traccar and refuse to show anything

Smartphone (please complete the following information):

tananaev commented 11 months ago

Doesn't sound like a bug to me. More of a request to support whatever Cloudflare is doing.

jbschooley commented 11 months ago

What’s it doing to check that the url you put in is actually a Traccar instance?

tananaev commented 11 months ago

It checks the server API endpoint.

jbschooley commented 11 months ago

Would it be possible to still allow the page to be viewed if that check fails, and check again on the next page load?

tananaev commented 11 months ago

What do you mean by possible? It's not how it works now, but anything is possible to implement.

jbschooley commented 11 months ago

Possible as in doable without major refactoring or something else that would take far too much time. I don’t know jack about iOS development otherwise I’d take a look at it.

Also whether it’s worth it at all. I’m not sure how many other users are using Traccar with an added security layer like Cloudflare Access. Or would like to host it publicly, but are worried about incident response in case of another log4j style zero day and would rather leave that part up to cloudflare.

tananaev commented 11 months ago

You're the first person so for who has this issue, so we definitely won't implement it ourselves until there's enough interest.