Listening on specific port invalidate cookie domain attribute and cause loop

[Buco7854]

Hello,

When listening on a different port than the default ones, it seems the port is being set with the domain in cookie domain attribute and therefore gets invalidated
I suppose it is the cause of my infinite loop

logs:

WRN Session cookie invalid
tinyauth  | 2025-01-29T03:15:23.411795005Z 2025-01-29T03:15:23Z INF Request address=172.28.0.4:43804 latency="72.751µs" method=GET path=/api/status status=200
tinyauth  | 2025-01-29T03:15:23.452173703Z 2025-01-29T03:15:23Z INF Request address=172.28.0.4:43804 latency="99.537µs" method=GET path=/apple-touch-icon.png status=200
tinyauth  | 2025-01-29T03:15:23.452195074Z 2025-01-29T03:15:23Z INF Request address=172.28.0.4:43796 latency="10.385µs" method=GET path=/favicon-16x16.png status=200
tinyauth  | 2025-01-29T03:15:34.397948244Z 2025-01-29T03:15:34Z WRN Session cookie invalid
tinyauth  | 2025-01-29T03:15:34.397974889Z 2025-01-29T03:15:34Z WRN Request address=172.28.0.4:43550 latency="75.985µs" method=GET path=/api/auth status=307
tinyauth  | 2025-01-29T03:15:34.405320449Z 2025-01-29T03:15:34Z INF Request address=172.28.0.4:43796 latency="13.883µs" method=GET path=/ status=200
tinyauth  | 2025-01-29T03:15:34.483465902Z 2025-01-29T03:15:34Z INF Request address=172.28.0.4:43796 latency="472.665µs" method=GET path=/assets/index-C2BJVWq4.js status=200
tinyauth  | 2025-01-29T03:15:34.484242384Z 2025-01-29T03:15:34Z INF Request address=172.28.0.4:43796 latency="155.467µs" method=GET path=/assets/index-Dcj4c2oZ.css status=200
tinyauth  | 2025-01-29T03:15:34.551122282Z 2025-01-29T03:15:34Z WRN Session cookie invalid
tinyauth  | 2025-01-29T03:15:34.551138677Z 2025-01-29T03:15:34Z INF Request address=172.28.0.4:43796 latency="78.082µs" method=GET path=/api/status status=200
tinyauth  | 2025-01-29T03:15:34.575596063Z 2025-01-29T03:15:34Z INF Request address=172.28.0.4:43796 latency="77.034µs" method=GET path=/apple-touch-icon.png status=200
tinyauth  | 2025-01-29T03:15:34.575732250Z 2025-01-29T03:15:34Z INF Request address=172.28.0.4:43796 latency="18.091µs" method=GET path=/favicon-16x16.png status=200
tinyauth  | 2025-01-29T03:15:42.227783797Z 2025-01-29T03:15:42Z WRN Session cookie invalid
tinyauth  | 2025-01-29T03:15:42.227805651Z 2025-01-29T03:15:42Z INF Request address=172.28.0.4:43796 latency="120.189µs" method=GET path=/api/status status=200
tinyauth  | 2025-01-29T03:15:43.063127497Z 2025/01/29 03:15:43 net/http: invalid Cookie.Domain ".example.com:27015"; dropping domain attribute

[steveiliop56]

You don't need to specify a port in the domain. For example for app url just set it to http://tinyauth.example.com or https://tinyauth.example.com and the app will work with whatever port you use in your domain.

[Buco7854]

I'll check tonight thank you

[Buco7854]

You don't need to specify a port in the domain. For example for app url just set it to http://tinyauth.example.com or https://tinyauth.example.com and the app will work with whatever port you use in your domain.

The issue is tha the APP_URL seems to be used when the user is not authenticated to redirect him.

But if I dont set the port i'm not accessing the app obviously.
And it seems that if i do use the port then the cookie is invalid.

Here is my config in case there is a missunderstanding.
As stated above, If i set APP_URL to https://tinyauth.example.com i'm redirected to it and since i'm not listening on 443 it fails.

caddy:
    container_name: caddy
    image: lucaslorentz/caddy-docker-proxy:latest
    restart: unless-stopped
    ports:
      - 27015:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/ssl/domains:/etc/ssl/domains
      - caddy-data:/data
    labels:
      caddy: (tinyauth_forwarder)
      caddy.forward_auth: tinyauth:3000
      caddy.forward_auth.uri: /api/auth

  tinyauth:
    container_name: tinyauth
    image: ghcr.io/steveiliop56/tinyauth:latest
    environment:
      SECRET: secret
      APP_URL: https://tinyauth.example.com:27015
      USERS: me:hash
    labels:
      caddy.tls: /etc/ssl/domains/example.com/fullchain.pem /etc/ssl/domains/example.com/privkey.pem
      caddy: https://tinyauth.example.com
      caddy.reverse_proxy: "{{upstreams 3000}}"
      
  filebrowser:
    volumes:
      - nginx-config:/srv
      - filebrowser-db:/database
      - filebrowser-config:/config
    environment:
      PUID: 0
      PGID: 0
      FB_NOAUTH: true
    #ports:
    #  - 8081:80
    image: filebrowser/filebrowser:s6
    labels:
      caddy.tls: /etc/ssl/domains/example.com/fullchain.pem /etc/ssl/domains/example.com/privkey.pem
      caddy: https://nginx.example.com
      caddy.reverse_proxy: "{{upstreams 80}}"
      caddy.import: tinyauth_forwarder *

[steveiliop56]

Hmm yeah I get the issue now. Since tinyauth is meant for running with proxies on default 80/443 ports I never really thought about this. Maybe I could add an optional redirect uri in the environment variables.

[Buco7854]

Hmm yeah I get the issue now. Since tinyauth is meant for running with proxies on default 80/443 ports I never really thought about this. Maybe I could add an optional redirect uri in the environment variables.

I'm only making assumptions since I don't have the code to check right now but don't you already have what you need? isn't it the point of APP_URL?
To me it seems there is an issue with the port being set with the domain and it cause the cookie to be invalidated thus redirecting to login again and again.

Wouldn't just fixing the issue with the port in "domain" fix it?

[steveiliop56]

You are actually correct! Thank you for the idea! Fixed here 2385599