Unable to Download Books from Calibre-Web OPDS in Readest 0.9.95 (iOS & macOS)

[Tom-Enns]

Bug Description

On both the latest iOS and macOS versions, I’m unable to download books from my Calibre-Web Automated OPDS server. Browsing the catalog works normally, but any attempt to download a title fails with the error shown in the screenshot below.

For comparison, downloads from Project Gutenberg work as expected, so the issue appears to be specific to Calibre-Web OPDS sources.

I noticed that this commit (75f6efe) seems intended to address this exact problem, and it was included in version 0.9.95 (the version I'm currently running on both devices.)

Steps to Reproduce

1. Add a Calibre-Web Automated OPDS server as a source.
2. Browse the catalog (works as expected).
3. Attempt to download any book.
4. Observe the error and failed download.

Expected Behavior

The book should download successfully from the OPDS server.

Actual Behavior

Downloads fail immediately with the error shown in the screenshot.

Additional Notes

• Other OPDS sources (e.g., Project Gutenberg) download correctly.
• Calibre-Web server works normally from other clients.
• Issue occurs identically on both iOS and macOS.

Technical Details

• Readest Version: 0.9.95
• Operating Systems: iOS 16.1 and macOS 26.0.1
• OPDS Server: Calibre-Web Automated OPDS

[chrox]

I’ve confirmed it works on Readest 0.9.95 (macOS and iOS) with Calibre 8.10 and Calibre Web 0.6.25. I haven’t tested it with Calibre Web Automated, which may have its own quirks. I’ll look into that later.

[chrox]

I set up the latest Calibre-Web-Automated on Ubuntu 25.04 using the steps from the Quick Install section of the README. I kept all the default settings. Browsing, searching, and downloading all work correctly with Readest 0.9.95 on iOS, Android, and macOS.

For reference, I simply ran the CWA instance with docker compose up -d and accessed the OPDS feed at http://192.168.x.x:8083/opds, there’s no reverse proxy between the OPDS server and the Readest client.

@Tom-Enns Could you share your CWA configuration, especially if you’re running it behind a proxy? And the CWA log is also helpful to identify the problem.

[blowk]

I have the same issue.

• Readest v0.9.95 (WebView 142.0.7444.171)
• Calibre Web 0.6.25 with opds

The user is with normal authentication.

I only have this issue when I try to download cbz files. Pdfs and epubs are downloading normally.
I tried with the opds uri directly from Calibre Web and can verify that this works.

[Tom-Enns]

Thanks for digging into this. Here’s the environment info from my setup:

• Readest: 0.9.95
• • 
• Calibre-Web Automated: 3.1.4
• Platform: Linux 6.12.24 (container running on an Unraid host)
• No reverse proxy in front of the OPDS endpoint.

The OPDS feed works normally from other clients, for example, KOReader on my Kobo can browse and download books without any issues.

I enabled logging and captured what happens when Readest attempts a download. CWA is returning 401 Unauthorized for both the HEAD and GET download requests:

HEAD /opds/download/32/epub/ → 401
GET  /opds/download/32/epub/ → 401

So browsing the OPDS catalog authenticates correctly, but the actual download request isn’t being authenticated. At least that is what is seems like and I am confused as I thought that is what was solved in that earlier commit.

Let me know if you’d like me to capture anything else on the server side.

Thanks,

[chrox]

@Tom-Enns Interesting. Did you access your OPDS feed directly from the IP + port? Could you try to access it with Readest Web (https://web.readest.com) and share the response header for the HEAD and GET requests in the network inspect?

[chrox]

So browsing the OPDS catalog authenticates correctly, but the actual download request isn’t being authenticated. At least that is what is seems like and I am confused as I thought that is what was solved in that earlier commit.

The earlier patch fixed an issue where Calibre Web required a non-empty User-Agent header for file downloads.

For authentication, we first send a HEAD request to probe the OPDS server. It should return a WWW-Authenticate header indicating either basic or digest authentication. Based on that response, we include the appropriate authentication header in the subsequent GET request.

To move forward, we need a reliable way to reproduce this authentication failure.

[naveg]

This is also not working for me on 0.9.95 (I reported #2589).

I see the same symptoms - 401s in the access logs, which suggests the download requests are not authenticated.

If I enable anonymous downloads in Calibre Web, it works fine.

I will try to dig more into what the requests look like for successful and unsuccessful downloads.

[naveg]

For one thing, the HEAD request is also getting a 401, so the problem is before we even try the GET

[chrox]

For one thing, the HEAD request is also getting a 401, so the problem is before we even try the GET

The 401 of the HEAD request is expected as we will get a response header of WWW-Authenticate which will indicate which auth method the server will use, for Calibre Web it will be either basic or digest.

[chrox]

@naveg Could you help to verify this issue with a default clean setup of Calibre Web with the default username and password? We probably need a reliable way to reproduce this first.

[chrox]

I can reproduce this now. The default setup works fine with the default username / password (admin/admin123) but if the OPDS feed is accessed with a new username and password I cannot download file and it shows a failure of auth.

[naveg]

When I try a HEAD against my local server with no authentication, I get a 401 with no WWW-Authenticate header back.

❯ curl --head localhost:8083/opds/download/110/epub/
HTTP/1.1 401 UNAUTHORIZED
Content-Type: text/html; charset=utf-8
Content-Length: 1240
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:; object-src 'none';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000
Server: TornadoServer/6.5.2

When I include a basic auth header, it works:

❯ curl -u uname:pass --head localhost:8083/opds/download/110/epub/
HTTP/1.1 200 OK
Content-Disposition: attachment; ...
Content-Type: application/epub+zip
Content-Length: 679686
Last-Modified: Mon, 20 Oct 2025 04:22:50 GMT
Cache-Control: no-cache
Etag: "1760934170.3345687-679686-561193840"
Date: Wed, 10 Dec 2025 07:31:45 GMT
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:; object-src 'none';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000
X-Ratelimit-Limit: 3
X-Ratelimit-Remaining: 3
X-Ratelimit-Reset: 1765351906
Retry-After: 0
Server: TornadoServer/6.5.2

With digest auth, it does not work:

❯ curl --digest -u uname:pass --head localhost:8083/opds/download/110/epub/
HTTP/1.1 401 UNAUTHORIZED
Content-Type: text/html; charset=utf-8
Content-Length: 1240
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data:; object-src 'none';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000
Server: TornadoServer/6.5.2

[naveg]

It looks like calibre web is not sending WWW-Authenticate at all, but expects basic auth.

I can try to make a PR for calibre web, but in the meantime perhaps it makes sense to fall back to basic auth if we get a 401 with no WWW-Authenticate.

[chrox]

I can reproduce this now. The default setup works fine with the default username / password (admin/admin123) but if the OPDS feed is accessed with a new username and password I cannot download file and it shows a failure of auth.

I noticed that the default permission for newly added users does not include 'Download Books', if I add the 'Download Books' permission to that user, it downloads books without problem now.

[naveg]

My user has that permission