starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: missing crossorigin="use-credentials" property #1671

New Issue
Open
opened 2026-04-24 23:54:10 +02:00 by adam · 5 comments
adam commented 2026-04-24 23:54:10 +02:00
Owner
Copy Link
Copy Source

Originally created by @prof729 on GitHub (Jan 18, 2024).

Describe the issue

When using ADB that is behind traefik + authelia (that is used as identity provider) in the console there is error regarding fetching manifest file.
image

This is caused as manifest was expected to be json file but was returned as HTML and can't be parsed. And it's returned as HTML as authelia that is checking the requests didn't see any cookies in the request fetching manifest.json file. And this is cased as currently manifest link is missing crossorigin="use-credentials" property (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link#crossorigin). Without this property browser does not send a cookies with request for manifest file and then authelia can not see if user is logged.

As far as I've check it should be added probably somewhere here https://github.com/advplyr/audiobookshelf/blob/v2.7.2/client/nuxt.config.js#L103 in the config file:

manifest: {
    crossorigin: 'use-credentials'
}

After edditing manually compiled js file and adding this attribute it works correctly.
Thanks

Steps to reproduce the issue

  1. Install audiobookshelf
  2. Put it behind traefik with authelia as identity provider
  3. Login to audiobookshelf via authelia
  4. Check console in dev tools

Audiobookshelf version

v2.7.2

How are you running audiobookshelf?

Docker

Originally created by @prof729 on GitHub (Jan 18, 2024). ### Describe the issue When using ADB that is behind traefik + authelia (that is used as identity provider) in the console there is error regarding fetching manifest file. ![image](https://github.com/advplyr/audiobookshelf/assets/148390720/fd6b220c-bbd5-4e7d-bcd8-251143b1bacc) This is caused as manifest was expected to be json file but was returned as HTML and can't be parsed. And it's returned as HTML as authelia that is checking the requests didn't see any cookies in the request fetching manifest.json file. And this is cased as currently manifest link is missing `crossorigin="use-credentials"` property (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link#crossorigin). Without this property browser does not send a cookies with request for manifest file and then authelia can not see if user is logged. As far as I've check it should be added probably somewhere here https://github.com/advplyr/audiobookshelf/blob/v2.7.2/client/nuxt.config.js#L103 in the config file: ``` manifest: { crossorigin: 'use-credentials' } ``` After edditing manually compiled js file and adding this attribute it works correctly. Thanks ### Steps to reproduce the issue 1. Install audiobookshelf 2. Put it behind traefik with authelia as identity provider 3. Login to audiobookshelf via authelia 4. Check console in dev tools ### Audiobookshelf version v2.7.2 ### How are you running audiobookshelf? Docker
adam added the bug label 2026-04-24 23:54:10 +02:00
adam commented 2026-04-24 23:54:11 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Feb 16, 2024):

Have you tested adding that crossorigin without going through traefik? Some users may not be using Abs that way

@advplyr commented on GitHub (Feb 16, 2024): Have you tested adding that crossorigin without going through traefik? Some users may not be using Abs that way
adam commented 2026-04-24 23:54:13 +02:00
Author
Owner
Copy Link
Copy Source

@prof729 commented on GitHub (Feb 16, 2024):

Yes, thats exactlly what I've done :)

So I've found in which js file there is this manifest defined (currently in 1c1d57b.js for version 2.7.2):
Zrzut ekranu 2024-02-16 213755

Modified it manually to have also "crossorigin":"use-credentials":
2

and the error is gone in the browser and it's working corrently.

I just don't want to do it every time ABS updates 😄 (find the file and correct it 😉).

Here is how it looks like in more details on browser side:

Without this property when the browser sends a request for manifest it does not include Cookie header (as per specification):
3

but the cookie have the information to authenticate a request that I'm logged in for Authelia. And when it's missing then the Authelia can not confirm that I'm logged in. And it will issue 302 redirect to login page triggering the error about "Manifest syntax error" as the manifest is expected by the browser to be a json file not HTML document with login page.

Here is how it looks like after adding "crossorigin":"use-credentials" (Cookie header is present):
4

Hope it explains it better.
Thanks

@prof729 commented on GitHub (Feb 16, 2024): Yes, thats exactlly what I've done :) So I've found in which js file there is this manifest defined (currently in `1c1d57b.js` for version 2.7.2): ![Zrzut ekranu 2024-02-16 213755](https://github.com/advplyr/audiobookshelf/assets/148390720/613ee1d0-d114-460b-ac54-2aaf9bc43980) Modified it manually to have also `"crossorigin":"use-credentials"`: ![2](https://github.com/advplyr/audiobookshelf/assets/148390720/a728f9c4-49d2-4be1-a6a3-3eb6f41cb37d) and the error is gone in the browser and it's working corrently. I just don't want to do it every time ABS updates 😄 (find the file and correct it 😉). ### Here is how it looks like in more details on browser side: Without this property when the browser sends a request for manifest it does not include `Cookie` header (as per specification): ![3](https://github.com/advplyr/audiobookshelf/assets/148390720/a41a41bd-4bd8-43e7-bf23-0c2fa971debb) but the cookie have the information to authenticate a request that I'm logged in for Authelia. And when it's missing then the Authelia can not confirm that I'm logged in. And it will issue 302 redirect to login page triggering the error about "Manifest syntax error" as the manifest is expected by the browser to be a json file not HTML document with login page. Here is how it looks like after adding `"crossorigin":"use-credentials"` (`Cookie` header is present): ![4](https://github.com/advplyr/audiobookshelf/assets/148390720/8e6baaf3-73bd-40e9-843f-a51bcb1892c7) Hope it explains it better. Thanks
adam commented 2026-04-24 23:54:15 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Feb 16, 2024):

Thanks, I understood that part. What I'm wondering about is the users that are not using traefik. How will they be impacted by this update?

See:

If the server does not give credentials to the origin site (through Access-Control-Allow-Credentials HTTP header), the resource will be tainted and its usage restricted.

@advplyr commented on GitHub (Feb 16, 2024): Thanks, I understood that part. What I'm wondering about is the users that are not using traefik. How will they be impacted by this update? See: > If the server does not give credentials to the origin site (through [Access-Control-Allow-Credentials](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials) HTTP header), the resource will be tainted and its usage restricted.
adam commented 2026-04-24 23:54:15 +02:00
Author
Owner
Copy Link
Copy Source

@prof729 commented on GitHub (Feb 16, 2024):

No idea how to understand that part in regard to manifest file. Maybe it's just general statement for all link elements that can potentially direct outside your domain/application?

On another page https://developer.mozilla.org/en-US/docs/Web/Manifest#deploying_a_manifest I've found only this statement:

If the manifest requires credentials to fetch, the crossorigin attribute must be set to use-credentials, even if the manifest file is in the same origin as the current page.

There is also this old discussion https://github.com/w3c/manifest/issues/535 with this comment https://github.com/w3c/manifest/issues/535#issuecomment-435739223 that tries to explain it a bit more.

So for more streight forward setup of running ABS I think this will just add this header Cookie that will be send to ABS node and it will just be ignored there. As there is no logic to check if js/img/style etc files can be served to not logged in users, right?

@prof729 commented on GitHub (Feb 16, 2024): No idea how to understand that part in regard to manifest file. Maybe it's just general statement for all link elements that can potentially direct outside your domain/application? On another page https://developer.mozilla.org/en-US/docs/Web/Manifest#deploying_a_manifest I've found only this statement: > If the manifest requires credentials to fetch, the [crossorigin](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin) attribute must be set to use-credentials, even if the manifest file is in the same origin as the current page. There is also this old discussion https://github.com/w3c/manifest/issues/535 with this comment https://github.com/w3c/manifest/issues/535#issuecomment-435739223 that tries to explain it a bit more. So for more streight forward setup of running ABS I think this will just add this header `Cookie` that will be send to ABS node and it will just be ignored there. As there is no logic to check if js/img/style etc files can be served to not logged in users, right?
adam commented 2026-04-24 23:54:16 +02:00
Author
Owner
Copy Link
Copy Source

@dfunkt commented on GitHub (Jul 7, 2025):

This is still an issue when using something like Cloudflare Access for authentication.
As an example, Home Assistant includes use-credentials for their manifest.json:
https://github.com/home-assistant/frontend/blob/2e8203f666f6363e5d49bcf385eea1e31a46bd9b/src/html/_header.html.template#L2

@dfunkt commented on GitHub (Jul 7, 2025): This is still an issue when using something like Cloudflare Access for authentication. As an example, Home Assistant includes `use-credentials` for their `manifest.json`: https://github.com/home-assistant/frontend/blob/2e8203f666f6363e5d49bcf385eea1e31a46bd9b/src/html/_header.html.template#L2
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#1671
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?