Attempting to download PDF boots you back to login page

[zkhcohen]

Clicking on Download PDF in book details causes calibre-web to boot you back to the login screen.

This issue does not occur for other formats. Viewing PDFs works as expected, and they can be downloaded from the viewer (once fully cached).

---

Expected Behavior

The PDF should download.

Current Behavior

You get booted back to the login screen.

Steps to Reproduce

1. Navigate to a PDF.
2. Open book details by clicking on the cover.
3. Select the PDF download (blue) button.
4. You are redirected to /login?next=%2Fdownload%2F1150%2Fpdf%2F1150.pdf

Environment

OS: RancherOS via ProxMox with OMV CIFS share for Calibre Library and configuration.
CPU architecture: x86_64
How docker service was installed:

Command used to create docker container (run/create/compose/screenshot)

version: "3.5"
services:
calibre-web:
image: linuxserver/calibre-web
container_name: calibre-web
networks:
- containers
environment:
- PUID=1100
- PGID=1101
- UMASK_SET=022
- TZ=america/los_angeles
- DOCKER_MODS=linuxserver/calibre-web:calibre
volumes:
- ../share/calibre-web/config:/config
- ../../../calibre_storage/books:/books
restart: unless-stopped
networks:
containers:
external: true

Docker logs

`[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 01-envfile: executing...
[cont-init.d] 01-envfile: exited 0.
[cont-init.d] 10-adduser: executing...
usermod: no changes

      _         ()
     | |  ___   _    __
     | | / __| | |  /  \ 
     | | \__ \ | | | () |
     |_| |___/ |_|  \__/

Brought to you by linuxserver.io

To support LSIO projects visit:
https://www.linuxserver.io/donate/

GID/UID

User uid: 1100
User gid: 1101

[cont-init.d] 10-adduser: exited 0.
[cont-init.d] 30-config: executing...
[cont-init.d] 30-config: exited 0.
[cont-init.d] 60-calibre-config: executing...
[cont-init.d] 60-calibre-config: exited 0.
[cont-init.d] 99-custom-scripts: executing...
[custom-init] no custom files found exiting...
[cont-init.d] 99-custom-scripts: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.`

Web logs:

[2020-06-08 21:47:13,434] INFO {cps:98} Starting Calibre Web...
[2020-06-08 21:47:13,524] INFO {cps.server:156} Starting Tornado server on :8083

[zkhcohen]

Oddly enough, roughly 1:3 times I click on Advanced Search, I also get booted back to the login page... although after adding a new user, it seems to have stabilized. The PDF download issue was not fixed.

I have completely rebuilt the container, deleting all persistent data, and the issue persists.

[CHBMB]

I can't reproduce this, I don't use pdfs in my library but just added one and downloaded it multiple times uneventfully.

Is your calibre-web behind a reverse proxy (mine is using nginx), I'm guessing you are as there's no mapped ports in your docker-compose and fwiw I'm using a local folder for my /books mount, rather than a CIFS mount, so I think it's probably one of those causing the issue.

Can you try accessing calibre-web from http://$HOST_IP-ADDRESS:$MAPPED_HOST_PORT

[CHBMB]

My gut feeling is it's the CIFS mount tbh

[zkhcohen]

Is your calibre-web behind a reverse proxy (mine is using nginx), I'm guessing you are as there's no mapped ports in your docker-compose

Great guess -- I use Traefik.

Can you try accessing calibre-web from http://$HOST_IP-ADDRESS:$MAPPED_HOST_PORT

...annd it worked.

What in the world is different about PDF downloads specifically (and using a reverse proxy) that would cause this to occur?

EDIT:

Docker/Traefik config:

labels:
- "traefik.enable=true"
- "traefik.http.routers.calibre-secure.entrypoints=websecure"
- "traefik.http.routers.calibre-secure.rule=Host(<URL>)"
- "traefik.http.routers.calibre-secure.tls=true"
- "traefik.http.routers.calibre-secure.service=calibre"
- "traefik.http.services.calibre.loadbalancer.server.port=8083"
- "traefik.docker.network=containers"

Output from 'docker logs traefik':

2020-06-08T22:28:01.678387774Z time="2020-06-08T22:28:01Z" level=debug msg="vulcand/oxy/roundrobin/rr: completed ServeHttp on request" Request="{\"Method\":\"GET\",\"URL\":{\"Scheme\":\"\",\"Opaque\":\"\",\"User\":null,\"Host\":\"\",\"Path\":\"/login\",\"RawPath\":\"\",\"ForceQuery\":false,\"RawQuery\":\"next=%2Fdownload%2F1150%2Fpdf%2F1150.pdf\",\"Fragment\":\"\"},\"Proto\":\"HTTP/1.1\",\"ProtoMajor\":1,\"ProtoMinor\":1,\"Header\":{\"Accept\":[\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\"],\"Accept-Encoding\":[\"gzip\"],\"Accept-Language\":[\"en-US,en;q=0.9,en-GB;q=0.8\"],\"Cdn-Loop\":[\"cloudflare\"],\"Cf-Connecting-Ip\":[\"<MY_WAN_IP>\"],\"Cf-Ipcountry\":[\"US\"],\"Cf-Ray\":[\"<removed>-PDX\"],\"Cf-Request-Id\":[\"<removed>\"],\"Cf-Visitor\":[\"{\\\"scheme\\\":\\\"https\\\"}\"],\"Connection\":[\"Keep-Alive\"],\"Cookie\":[\"__cfduid=<removed>; session=<removed>\"],\"Dnt\":[\"1\"],\"Sec-Fetch-Dest\":[\"document\"],\"Sec-Fetch-Mode\":[\"navigate\"],\"Sec-Fetch-Site\":[\"cross-site\"],\"Sec-Fetch-User\":[\"?1\"],\"Upgrade-Insecure-Requests\":[\"1\"],\"User-Agent\":[\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36\"],\"X-Forwarded-Host\":[\"<CALIBRE_URL_FRONTEND>\"],\"X-Forwarded-Port\":[\"443\"],\"X-Forwarded-Proto\":[\"https\"],\"X-Forwarded-Server\":[\"a3fd680b73c8\"],\"X-Real-Ip\":[\"<MY_CLIENT_IP>\"]},\"ContentLength\":0,\"TransferEncoding\":null,\"Host\":\"<CALIBRE_URL_FRONTEND>\",\"Form\":null,\"PostForm\":null,\"MultipartForm\":null,\"Trailer\":null,\"RemoteAddr\":\"<MY_CLIENT_IP>:41478\",\"RequestURI\":\"/login?next=%2Fdownload%2F1150%2Fpdf%2F1150.pdf\",\"TLS\":null}"

[CHBMB]

No idea matey, never laid a hand on Traefik. But at least it gives some direction. I can't really help unfortunately as it's not an issue I can sort out from the docker image side.

If you do figure it out, would you mind posting a solution so any other Traefik users can see.

Hopefully someone might happen across this issue and lend a hand.

[zkhcohen]

Session security was hardened on calibre-web on May 9th, which appears to be causing the problem:

janeczku/calibre-web#1466 (comment)

I'm going to try this fix ASAP and report back before closing the issue.

---

Confirmed that the above fix does work. The docker build will need to be re-run after the owner produces a permanent fix for the issue in an upcoming release.

[CHBMB]

@zkhcohen Our image automatically rebuilds on any new releases and weekly to update any other packages in the image.