Website port is not used for redirect #201

Hadatko · 2024-07-11T18:43:08Z

Describe the bug
A clear and concise description of what the bug is.

Hi, i am using custom https port and keycloack for sso. When i used standard https port 443 everything worked well. Now i moved to 8443 so my website is https://foo.bar.eu:8443

But redirect_uri is still using https://foo.bar.eu.

To Reproduce
Steps to reproduce the behavior:

Go to '...'
Click on '....'
Scroll down to '....'
See error

Expected behavior
A clear and concise description of what you expected to happen.
redirect_uri=https://foo.bar.eu:8443

Screenshots
If applicable, add screenshots to help explain your problem.

Configuration
Add your plugin configuration XML file here formatted as code (with three backticks surrounding the text), or as an upload to a pastebin service.

Versions (please complete the following information):

OS: [e.g. Linux]
Browser: [e.g. chrome, safari]
Jellyfin Version: [e.g. 10.8 Alpha 4] 10.9.7
Plugin Version: [e.g. 2.0.1.0 or a Git tag] 3.5.2.0

Additional context
Add any other context about the problem here. Was the plugin built from source?

jellyfin is running in docker and i am using Nginx Proxy Manager.

Hadatko · 2024-07-11T20:01:34Z

This issue is same for newer version

9p4 · 2024-07-17T13:57:04Z

Is your reverse proxy sending x-forwarded-port? Please send me your reverse proxy configuration.

Hadatko · 2024-07-21T07:20:26Z

# ------------------------------------------------------------
# foo.bar.eu
# ------------------------------------------------------------

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  set $forward_scheme http;
  set $server         "192.168.1.120";
  set $port           8096;

  listen 80;
  listen [::]:80;

  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name foo.bar.eu;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-39/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-39/privkey.pem;

  # Block Exploits
  include conf.d/include/block-exploits.conf;

  # Force SSL
  include conf.d/include/force-ssl.conf;

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;

  access_log /data/logs/proxy-host-16_access.log proxy;
  error_log /data/logs/proxy-host-16_error.log warn;

  location / {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy.conf;
}

9p4 · 2024-07-21T18:53:03Z

I also will need to see the contents of those includes.

Elivis-AI · 2024-07-27T14:36:05Z

Identical problem. My Jellyfin server is behind a reverse proxy (npm). npm configuration is set as default.
And 'redirect_uri' lacked port.
Additional: error exists only if jellyfin server is behind a reverse proxy. I believe the problem is in the configuration of proxy.

Elivis-AI · 2024-07-28T02:24:01Z

Update: add an additional item to make manual set redirect uri available in plugin should fix the bug.
I ran jellyfin and npm at the same docker network, and in nmp configuration the proxy_pass was docker alias name http://jellyfin-docker:port, while redirect uri changed to https://jellyfin-docker/sso/OID/redirect/...

Solved: manually set proxy_set_header Host <your_public_domain>:<public_port>; in nginx configuration, and everything works well.

9p4 · 2024-07-28T17:45:13Z

Again, are any of your reverse proxies sending x-forwarded-port?

Elivis-AI · 2024-07-28T22:53:04Z

Yes, but I don't think it's handled correctly.
Part of my nginx configuration (works well):

    location / {
        proxy_pass      http://jellyfin-docker:8086/;
        proxy_set_header Host <my_public_domain>:<public_port>; # you will get an error with this commented

        proxy_set_header X-Forwarded-Host <my_public_domain>; 
        proxy_set_header X-Forwarded-Port  <public_port>;  # doesn't work
        proxy_set_header X-Forwarded-Proto $forward_scheme;
        proxy_set_header X-Forwarded-Scheme $forward_scheme;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $remote_addr;

        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_http_version 1.1;
    }

redirect_uri will be https://<my_public_domain>:<public_port>/sso/OID/redirect/authentik (correct).

Controlled Experiment:
Remain x-forwarded settings only.

        proxy_pass      http://jellyfin-docker:8086/;
        # proxy_set_header Host <my_public_domain>:<public_port>; # you will get an error with this commented

        proxy_set_header X-Forwarded-Host <my_public_domain>; 
        proxy_set_header X-Forwarded-Port  <public_port>;  # doesn't work
        proxy_set_header X-Forwarded-Proto $forward_scheme;
        proxy_set_header X-Forwarded-Scheme $forward_scheme;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $remote_addr;

        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_http_version 1.1;
    }

redirect_uriwill be https://jellyfin-docker:8096/sso/OID/redirect/authentik (error).

Hadatko · 2024-08-15T19:49:57Z

@Elivis-AI sounds good but if i set HOST manually my site is not reachable ;/

9p4 · 2024-08-18T14:37:58Z

May be an issue somewhere around here

jellyfin-plugin-sso/SSO-Auth/Api/SSOController.cs

Line 1074 in b8e56ce

    
           if ((requestPort == 80 && string.Equals(Request.Scheme, "http", StringComparison.OrdinalIgnoreCase)) || (requestPort == 443 && string.Equals(Request.Scheme, "https", StringComparison.OrdinalIgnoreCase)))

laozhoubuluo · 2025-01-27T10:59:29Z

This issue is same for version 3.5.2.4 .

My NGINX configuration is below.

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  set $forward_scheme http;
  set $server         "10.10.10.10"; #security mask
  set $port           8096;

  listen 80;
listen [::]:80;

listen 443 ssl;
listen [::]:443 ssl;

  server_name jellyfin.example.com; #security mask

  http2 on;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-4/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-4/privkey.pem;

    # Force SSL
    include conf.d/include/force-ssl.conf;

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

  access_log /data/logs/proxy-host-4_access.log proxy;
  error_log /data/logs/proxy-host-4_error.log warn;

listen 9999 ssl http2; #security mask
listen [::]:9999 ssl http2; #security mask
proxy_buffering off;
client_max_body_size 20M;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";

  location /sso/ {
    proxy_set_header X-Forwarded-Port 9999; #security mask

    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_set_header X-Real-IP          $remote_addr;

    proxy_pass       http://10.10.10.10:8096; #security mask

    # Force SSL
    include conf.d/include/force-ssl.conf;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
  }

  location / {

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
    
    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

partizanna · 2025-02-05T12:44:20Z

May be an issue somewhere around here

jellyfin-plugin-sso/SSO-Auth/Api/SSOController.cs

Line 1074 in b8e56ce
if ((requestPort == 80 && string.Equals(Request.Scheme, "http", StringComparison.OrdinalIgnoreCase)) || (requestPort == 443 && string.Equals(Request.Scheme, "https", StringComparison.OrdinalIgnoreCase)))

Instead of this decoding of http/https stuff, could you add a field to the plugin config, where we can simply manually configure what the redirect_uri suppose to be ?

Because it seems to be clearly broken right now - it falls back to http, even when I set x-forwarded-port to 443 manually in the proxy...

Never mind, find the field Scheme Override, and putting https in it fixed the issue

Hadatko added the bug Something isn't working label Jul 11, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Website port is not used for redirect #201

Website port is not used for redirect #201

Hadatko commented Jul 11, 2024 •

edited

Loading

Hadatko commented Jul 11, 2024

9p4 commented Jul 17, 2024

Hadatko commented Jul 21, 2024 •

edited by 9p4

Loading

9p4 commented Jul 21, 2024

Elivis-AI commented Jul 27, 2024 •

edited

Loading

Elivis-AI commented Jul 28, 2024 •

edited

Loading

9p4 commented Jul 28, 2024

Elivis-AI commented Jul 28, 2024 •

edited

Loading

Hadatko commented Aug 15, 2024

9p4 commented Aug 18, 2024

laozhoubuluo commented Jan 27, 2025

partizanna commented Feb 5, 2025 •

edited

Loading

Website port is not used for redirect #201

Website port is not used for redirect #201

Comments

Hadatko commented Jul 11, 2024 • edited Loading

Hadatko commented Jul 11, 2024

9p4 commented Jul 17, 2024

Hadatko commented Jul 21, 2024 • edited by 9p4 Loading

9p4 commented Jul 21, 2024

Elivis-AI commented Jul 27, 2024 • edited Loading

Elivis-AI commented Jul 28, 2024 • edited Loading

9p4 commented Jul 28, 2024

Elivis-AI commented Jul 28, 2024 • edited Loading

Hadatko commented Aug 15, 2024

9p4 commented Aug 18, 2024

laozhoubuluo commented Jan 27, 2025

partizanna commented Feb 5, 2025 • edited Loading

Hadatko commented Jul 11, 2024 •

edited

Loading

Hadatko commented Jul 21, 2024 •

edited by 9p4

Loading

Elivis-AI commented Jul 27, 2024 •

edited

Loading

Elivis-AI commented Jul 28, 2024 •

edited

Loading

Elivis-AI commented Jul 28, 2024 •

edited

Loading

partizanna commented Feb 5, 2025 •

edited

Loading