starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #2189] [CLOSED] Try #2 at Forward Proxy Auth #3672

New Issue
Closed
opened 2026-04-25 00:16:35 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:16:35 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/2189
Author: @igor47
Created: 10/7/2023
Status: ❌ Closed

Base: master ← Head: igor/proxy-auth

📝 Commits (9)

  • eae72ed ui for proxy auth settings
  • 49c1b8f enable log in via either token or through proxy auth
  • 3f7ba82 fix client-side logout
  • a85ae74 allow login without token
  • 20356a1 proxy auth users don't get a token
  • 096b549 clarify password changes for local auth users
  • 63f1df4 don't save proxy user's tokens in localstorage
  • 74e3560 allow proxy login on the socket
  • b39b66a don't set Bearer header for proxyAuth users

📊 Changes

13 files changed (+257 additions, -79 deletions)

View changed files

📝 client/components/ui/TextInput.vue (+1 -1)
📝 client/layouts/default.vue (+2 -2)
📝 client/pages/account.vue (+23 -9)
📝 client/pages/config/index.vue (+48 -0)
📝 client/pages/login.vue (+15 -12)
📝 client/plugins/axios.js (+5 -4)
📝 client/store/user.js (+14 -9)
📝 client/strings/en-us.json (+8 -0)
📝 server/Auth.js (+99 -10)
📝 server/SocketAuthority.js (+5 -5)
📝 server/controllers/UserController.js (+9 -19)
📝 server/objects/settings/ServerSettings.js (+13 -0)
📝 server/objects/user/User.js (+15 -8)

📄 Description

This is a somewhat-different take on #1109

Instead of using environment variables, I've modified the UI to allow you to dynamically configure the forward auth. Screenshot:

image

image

A lot of the concerns in the previous PR had to do with the question, "how do you do forward proxy auth in the mobile app". my answer to that question: you don't. we keep both the current authorization-token based auth, as well as the forward proxy auth. if forward proxy auth is disabled, there is no change to current behavior. to log into the mobile app when using forward proxy auth, do the following:

  1. log into the web app using forward proxy auth
  2. set your password. the UI makes it clear that this password is only used for the mobile app login
  3. use the password to log into the mobile app

in this case, the in-app passwords are more like access tokens. i had an idea for a future improvement where we display a QR code with a per-device auth token, and you can log into the app by scanning the QR code, this is not in scope right now but i think would be a pretty nice UX.

to make this work, we need support in the reverse proxy layer. in particular, we need conditional logic:

  1. if there is an Authorization header in the request, allow it through to audiobookshelf
  2. if there is not, forward the request to the authentication mechanism first

i am using traefik and authentik. i still have to test this setup, but my idea:

  1. in authentik, pass through /login and /ping requests with no auth needed (this enables the app to log in and set an Authorization header)
  2. in traefik, i need two routes and two services. one route has a rule for just the audiobookshelf domain, and includes the authentik middleware. the second route has a rule for the audiobookshelf domain, and also checks that the authorization header is not null. this service does not include the authentik middleware.

the mobile app would use the second service. i'll include config samples once i test it.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/2189 **Author:** [@igor47](https://github.com/igor47) **Created:** 10/7/2023 **Status:** ❌ Closed **Base:** `master` ← **Head:** `igor/proxy-auth` --- ### 📝 Commits (9) - [`eae72ed`](https://github.com/advplyr/audiobookshelf/commit/eae72ed29a2c1bb873ae59b15d9a159ddae913ca) ui for proxy auth settings - [`49c1b8f`](https://github.com/advplyr/audiobookshelf/commit/49c1b8f106bb9c6f4c1347062b5d8e61c43445bb) enable log in via either token or through proxy auth - [`3f7ba82`](https://github.com/advplyr/audiobookshelf/commit/3f7ba82e6a8fd757524aef6d40f45bf033a5e6bf) fix client-side logout - [`a85ae74`](https://github.com/advplyr/audiobookshelf/commit/a85ae7467cbb4006355e2fb1ce264abe922587d0) allow login without token - [`20356a1`](https://github.com/advplyr/audiobookshelf/commit/20356a17d81b30d65b1ce0874d53f17535a599ec) proxy auth users don't get a token - [`096b549`](https://github.com/advplyr/audiobookshelf/commit/096b5496b3c2bf1cf9d6a645bd50ce040c3f80b6) clarify password changes for local auth users - [`63f1df4`](https://github.com/advplyr/audiobookshelf/commit/63f1df4015fbfa0a7f70f914f016708e27def9a6) don't save proxy user's tokens in localstorage - [`74e3560`](https://github.com/advplyr/audiobookshelf/commit/74e356015385bd90b47e237b3d98611ac4a3a6c3) allow proxy login on the socket - [`b39b66a`](https://github.com/advplyr/audiobookshelf/commit/b39b66a746bc8845d89176e08650151f61932aaf) don't set `Bearer` header for proxyAuth users ### 📊 Changes **13 files changed** (+257 additions, -79 deletions) <details> <summary>View changed files</summary> 📝 `client/components/ui/TextInput.vue` (+1 -1) 📝 `client/layouts/default.vue` (+2 -2) 📝 `client/pages/account.vue` (+23 -9) 📝 `client/pages/config/index.vue` (+48 -0) 📝 `client/pages/login.vue` (+15 -12) 📝 `client/plugins/axios.js` (+5 -4) 📝 `client/store/user.js` (+14 -9) 📝 `client/strings/en-us.json` (+8 -0) 📝 `server/Auth.js` (+99 -10) 📝 `server/SocketAuthority.js` (+5 -5) 📝 `server/controllers/UserController.js` (+9 -19) 📝 `server/objects/settings/ServerSettings.js` (+13 -0) 📝 `server/objects/user/User.js` (+15 -8) </details> ### 📄 Description This is a somewhat-different take on #1109 Instead of using environment variables, I've modified the UI to allow you to dynamically configure the forward auth. Screenshot: ![image](https://github.com/advplyr/audiobookshelf/assets/200575/87b05a0c-daa9-4079-9b99-6b69f9cb6a56) ![image](https://github.com/advplyr/audiobookshelf/assets/200575/51f44859-8368-4ee4-a210-8c6c04591fa0) A lot of the concerns in the previous PR had to do with the question, "how do you do forward proxy auth in the mobile app". my answer to that question: you don't. we keep both the current authorization-token based auth, as well as the forward proxy auth. if forward proxy auth is disabled, there is no change to current behavior. to log into the mobile app when using forward proxy auth, do the following: 1. log into the web app using forward proxy auth 2. set your password. the UI makes it clear that this password is only used for the mobile app login 3. use the password to log into the mobile app in this case, the in-app passwords are more like access tokens. i had an idea for a future improvement where we display a QR code with a per-device auth token, and you can log into the app by scanning the QR code, this is not in scope right now but i think would be a pretty nice UX. to make this work, we need support in the reverse proxy layer. in particular, we need conditional logic: 1. if there is an `Authorization` header in the request, allow it through to audiobookshelf 2. if there is not, forward the request to the authentication mechanism first i am using traefik and authentik. i still have to test this setup, but my idea: 1. in authentik, pass through `/login` and `/ping` requests with no auth needed (this enables the app to log in and set an `Authorization` header) 2. in traefik, i need two routes and two services. one route has a rule for just the `audiobookshelf` domain, and includes the authentik middleware. the second route has a rule for the `audiobookshelf` domain, and also checks that the `authorization` header is not null. this service does *not* include the authentik middleware. the mobile app would use the second service. i'll include config samples once i test it. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:16:35 +02:00
adam closed this issue 2026-04-25 00:16:35 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3672
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?