Getting 401 Unauthorized access

[antoniomerlin]

What happened:
Getting 401 Unauthorized access in grafana-image-renderer logs

{"collectDefaultMetrics":true,"level":"info","message":"Metrics enabled","requestDurationBuckets":"1,5,7,9,11,13,15,20,30"}
{"level":"info","maxConcurrency":5,"message":"using clustered browser","mode":"context","timeout":300}
{"config":{"acceptLanguage":null,"args":["--no-sandbox","--disable-gpu","--disable-dev-shm-usage","--disable-accelerated-2d-canvas","--window-size=1280x758"],"chromeBin":"/usr/bin/chromium-browser","clustering":{"maxConcurrency":5,"mode":"context","monitor":false,"timeout":300},"deviceScaleFactor":1,"dumpio":false,"emulateNetworkConditions":false,"headed":false,"height":500,"ignoresHttpsErrors":true,"maxDeviceScaleFactor":4,"maxHeight":500,"maxWidth":1000,"mode":"clustered","timezone":"xxxxxx","timingMetrics":false,"verboseLogging":true,"width":1000},"level":"debug","message":"Browser initialized"}
{"level":"info","message":"HTTP Server started, listening at http://localhost:8081"}
{"level":"debug","message":"Launching Browser cluster with puppeteer-cluster"}
{"level":"error","message":"Request failed","stack":"Error: Unauthorized request\n    at /usr/src/app/build/service/middlewares.js:27:30\n    at Layer.handle [as handle_request] (/usr/src/app/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/src/app/node_modules/express/lib/router/index.js:328:13)\n    at /usr/src/app/node_modules/express/lib/router/index.js:286:9\n    at Function.process_params (/usr/src/app/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/src/app/node_modules/express/lib/router/index.js:280:10)\n    at /usr/src/app/build/service/metrics.js:48:9\n    at Layer.handle [as handle_request] (/usr/src/app/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/src/app/node_modules/express/lib/router/index.js:328:13)\n    at /usr/src/app/node_modules/express/lib/router/index.js:286:9","url":"/render?deviceScaleFactor=1.000000&domain=xxxxxxxx.com&encoding=&height=500&renderKey=zmvZ4ahJz4R4BGQysMyl89d8Zl4MvG5n&timeout=60&timezone=xxxxx%2Fxxxx&url=http%3A%2F%2Fxxxxxx.com%2Fd-solo%2F-FyZRtuGz%2Fdevhawkstudio-alert%3ForgId%3D1%26tab%3Dalert%26from%3D1662795578286%26to%3D1662817178286%26panelId%3D2%26width%3D1000%26height%3D500%26tz%3Dxxx%252Fxxxxx%26render%3D1&width=1000"}
{"level":"error","message":"::ffff:xxx.xxxxx.x.x - - [10/Sep/2022:13:39:44 +0000] \"GET /render?deviceScaleFactor=1.000000&domain=xxxxxxxxx.com&encoding=&height=500&renderKey=zmvZ4ahJz4R4BGQysMyl89d8Zl4MvG5n&timeout=60&timezone=xxxxx%2Fxxxxx&url=http%3A%2F%2Fxxxxxxx.com%2Fd-solo%2F-FyZRtuGz%2Fxxxxx-alert%3ForgId%3D1%26tab%3Dalert%26from%3D1662795578286%26to%3D1662817178286%26panelId%3D2%26width%3D1000%26height%3D500%26tz%3Dxxxxx%252Fxxxxxx%26render%3D1&width=1000 HTTP/1.1\" 401 74 \"-\" \"Grafana/7.4.0-9781pre\"\n"

What you expected to happen:
Generated Image

How to reproduce it (as minimally and precisely as possible):
generate direct link from panel

Anything else we need to know?:

Environment:

• Grafana Image Renderer version: v3.6.1
• Grafana version: Grafana v7.4.0-9781pre (1c1a800bc0)
• Installed plugin or remote renderer service: Using docker
• OS Grafana Image Renderer is installed on: Docker
• User OS & Browser:
• Others:

[nonamef]

Need to upgrade Grafana to a newer version due to CVE-2022-31176.
Reference: https://grafana.com/blog/2022/08/30/security-release-new-versions-of-grafana-and-grafana-image-renderer-with-a-high-severity-security-fix-for-cve-2022-31176/ .

[antoniomerlin]

using grafana/grafana-oss:9.1.4 but still facing same 401 error while renderering.

[joanlopez]

using grafana/grafana-oss:9.1.4 but still facing same 401 error while renderering.

Hi @antoniomerlin,

Have you tried to set up a custom Auth Token in both services according to what's described under the "Solutions and mitigations" section within the aforementioned Grafana Labs blog post?

If so, could you share which settings have you exactly set up (section and key, of course no need to share the credential)? And how're you doing it for both services (settings file, env, flags...)?

Anyway, it definitely looks like there's a mismatch between authorization expected from the Image Renderer and requests sent from Grafana, so in case you want to debug it I'd look for the requests and try to identify the origin of the mismatch.

Thanks!

[jgournet]

for what it's worth: we were running 8.5.6 and "latest" for renderer => 401 started happening.
Just upgrading to 8.5.11 fixed it for us
Note: installation is based on kube-prometheus-stack

[antoniomerlin]

that 401 error is not triggering when i am sending security token in X-Auth-Token inside header as you can see but now the issue i am getting is at grafana side i've added renderer_token in rendering section of grafana.ini but every request is generated from grafana is triggering 401 error.
And another thing i've used different image for grafana still my version remain this Grafana v7.4.0-9781pre (1c1a800bc0)

• grafana:main
• grafana:latest
• grafana-oss:main
• grafana:9.1.5

[joanlopez]

that 401 error is not triggering when i am sending security token in X-Auth-Token inside header as you can see but now the issue i am getting is at grafana side i've added renderer_token in rendering section of grafana.ini but every request is generated from grafana is triggering 401 error. And another thing i've used different image for grafana still my version remain this Grafana v7.4.0-9781pre (1c1a800bc0)

• grafana:main
• grafana:latest
• grafana-oss:main
• grafana:9.1.5

This sounds weird!

Would you be able to share a reproducible example (Docker & Compose or similar, with config files, etc) of your set up to help us reproduce the issue, please?

For the secrets, like the renderer token, just replace them for random words/tokens.

Thanks!

[antoniomerlin]

Fixed sorry it was my mistake in docker-compose.yaml i am explicitly mounting a volume to grafana container which having that version(Grafana v7.4.0-9781pre (1c1a800bc0)) in /usr/share/grafana location, now everthing working fine able to render and everything working.

[joanlopez]

Fixed sorry it was my mistake in docker-compose.yaml i am explicitly mounting a volume to grafana container which having that version(Grafana v7.4.0-9781pre (1c1a800bc0)) in /usr/share/grafana location, now everthing working fine able to render and everything working.

Great, glad to read that, thanks for letting us know! Don't hesitate to reach us back in case you have any other issue!