After upgrading to 4.37, when application redirects to authelia it gives 401

[niwla23]

Version

v4.37.5

Deployment Method

Docker

Reverse Proxy

Traefik

Reverse Proxy Version

2.8.5

Description

I upgraded authelia from 4.36 to 4.37.5

I can go to the authelia portal directly and login there, once I have done this I am logged in to other apps as well.

When I am not logged in and go to an app, it just shows 401 Unauthorized.

These are the logs produced when I go to any app I am not logged in to:

Reproduction

1. Run authelia with traefik
2. Make sure you are not logged in
3. Go to an app
4. You should see a 401 error

Expectations

It should redirect to the portal to login

Configuration (Authelia)

jwt_secret: a_very_important_secret
default_redirection_url: https://smartdashboard.sweet
theme: dark

server:
  host: 0.0.0.0
  port: 9091

log:
  level: debug

totp:
  issuer: authelia.com

authentication_backend:
  file:
    path: /config/users_database.yml
    password:
      algorithm: argon2id
      iterations: 3
      key_length: 32
      salt_length: 16
      parallelism: 4
      memory: 64

access_control:
  default_policy: deny
  rules:
    - domain: public.example.com
      policy: bypass

      # fbtickets administrator
    - domain: fbtickets.b49.cloudserver.click
      policy: one_factor
      resources:
        - "^/admin.*"

    # other paths of fbtickets are public
    - domain: fbtickets.b49.cloudserver.click
      policy: bypass

    - domain: pihole.b49.cloudserver.click
      policy: one_factor

    - domain: traefik.b49.cloudserver.click
      policy: one_factor

    - domain: rezepte.b49.cloudserver.click
      policy: one_factor

    - domain: finanzen.b49.cloudserver.click
      policy: one_factor

    - domain: photos.b49.cloudserver.click
      policy: one_factor
      subject:
        - "group:photos"

    - domain: octoprint.b49.cloudserver.click
      policy: one_factor
      subject:
        - "group:3dprinter"

identity_providers:
  oidc:
    hmac_secret: {{ authelia_hmac_secret }}
    clients:
      - id: grafana
        secret: {{ grafana_client_secret }}
        public: false
        authorization_policy: one_factor
        scopes:
          - openid
          - profile
          - groups
          - email
        redirect_uris:
          - https://monitoring.b49.cloudserver.click/login/generic_oauth
        userinfo_signing_algorithm: none

      - id: portainer
        secret: {{ portainer_client_secret }}
        public: false
        authorization_policy: one_factor
        scopes:
          - openid
          - profile
          - groups
          - email
        redirect_uris:
          - https://portainer.b49.cloudserver.click/
        userinfo_signing_algorithm: none


session:
  name: authelia_session
  secret: unsecure_session_secret
  expiration: 3600 # 1 hour
  inactivity: 300 # 5 minutes
  domain: b49.cloudserver.click # Should match whatever your root protected domain is

regulation:
  max_retries: 3
  find_time: 120
  ban_time: 300

storage:
  encryption_key: secret
  local:
    path: /config/db.sqlite3

notifier:
  filesystem:
    filename: /config/notification.txt

Logs (Authelia)

time="2023-02-25T19:13:38Z" level=info msg="Authelia v4.37.5 is starting"
time="2023-02-25T19:13:38Z" level=info msg="Log severity set to debug"
time="2023-02-25T19:13:38Z" level=debug msg="Registering client grafana with policy one_factor (one_factor)"
time="2023-02-25T19:13:38Z" level=debug msg="Registering client portainer with policy one_factor (one_factor)"
time="2023-02-25T19:13:38Z" level=info msg="Storage schema is being checked for updates"
time="2023-02-25T19:13:38Z" level=info msg="Storage schema migration from 5 to 7 is being attempted"
time="2023-02-25T19:13:38Z" level=debug msg="Storage schema migrated from version 5 to 6"
time="2023-02-25T19:13:38Z" level=debug msg="Storage schema migrated from version 6 to 7"
time="2023-02-25T19:13:38Z" level=info msg="Storage schema migration from 5 to 7 is complete"
time="2023-02-25T19:13:38Z" level=debug msg="The NTP startup check was skipped due to there being no configured 2FA access control rules"
time="2023-02-25T19:13:38Z" level=info msg="Initializing server for non-TLS connections on '[::]:9091' path '/'"
time="2023-02-25T19:14:14Z" level=debug msg="Check authorization of subject username= groups= ip=192.168.178.78 and object https://photos.b49.cloudserver.click/ (method GET)."
time="2023-02-25T19:14:14Z" level=error msg="Configured Portal URL 'http://auth.b49.cloudserver.click' does not appear to be able to write cookies for the 'b49.cloudserver.click' domain" method=GET path=/api/verify remote_ip=192.168.178.78 stack="github.com/authelia/authelia/v4/internal/handlers/handler_verify.go:215 handleUnauthorized\ngithub.com/authelia/authelia/v4/internal/handlers/handler_verify.go:490 VerifyGET.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54       (*BridgeBuilder).Build.func1.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:16      SecurityHeaders.func1\ngithub.com/fasthttp/router@v1.4.14/router.go:427                        (*Router).Handler\ngithub.com/valyala/fasthttp@v1.43.0/http.go:154                         (*Response).StatusCode\ngithub.com/valyala/fasthttp@v1.43.0/server.go:2338                      (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.43.0/workerpool.go:224                   (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.43.0/workerpool.go:196                   (*workerPool).getCh.func1\nruntime/asm_arm64.s:1172                                                goexit"
time="2023-02-25T19:14:15Z" level=debug msg="Check authorization of subject username= groups= ip=172.17.0.1 and object https://fbtickets.b49.cloudserver.click/ (method GET)."
time="2023-02-25T19:14:15Z" level=debug msg="Check authorization of subject username= groups= ip=172.17.0.1 and object https://fbtickets.b49.cloudserver.click/admin/add_tickets (method GET)."
time="2023-02-25T19:14:15Z" level=error msg="Configured Portal URL 'http://auth.b49.cloudserver.click' does not appear to be able to write cookies for the 'b49.cloudserver.click' domain" method=GET path=/api/verify remote_ip=172.17.0.1 stack="github.com/authelia/authelia/v4/internal/handlers/handler_verify.go:215 handleUnauthorized\ngithub.com/authelia/authelia/v4/internal/handlers/handler_verify.go:490 VerifyGET.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54       (*BridgeBuilder).Build.func1.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:16      SecurityHeaders.func1\ngithub.com/fasthttp/router@v1.4.14/router.go:427                        (*Router).Handler\ngithub.com/valyala/fasthttp@v1.43.0/http.go:154                         (*Response).StatusCode\ngithub.com/valyala/fasthttp@v1.43.0/server.go:2338                      (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.43.0/workerpool.go:224                   (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.43.0/workerpool.go:196                   (*workerPool).getCh.func1\nruntime/asm_arm64.s:1172                                                goexit"
time="2023-02-25T19:14:16Z" level=debug msg="Check authorization of subject username= groups= ip=192.168.178.78 and object https://photos.b49.cloudserver.click/sw.js (method GET)."
time="2023-02-25T19:14:16Z" level=error msg="Configured Portal URL 'http://auth.b49.cloudserver.click' does not appear to be able to write cookies for the 'b49.cloudserver.click' domain" method=GET path=/api/verify remote_ip=192.168.178.78 stack="github.com/authelia/authelia/v4/internal/handlers/handler_verify.go:215 handleUnauthorized\ngithub.com/authelia/authelia/v4/internal/handlers/handler_verify.go:490 VerifyGET.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54       (*BridgeBuilder).Build.func1.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:16      SecurityHeaders.func1\ngithub.com/fasthttp/router@v1.4.14/router.go:427                        (*Router).Handler\ngithub.com/valyala/fasthttp@v1.43.0/http.go:154                         (*Response).StatusCode\ngithub.com/valyala/fasthttp@v1.43.0/server.go:2338                      (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.43.0/workerpool.go:224                   (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.43.0/workerpool.go:196                   (*workerPool).getCh.func1\nruntime/asm_arm64.s:1172                                                goexit"

Logs (Proxy / Application)

time="2023-02-25T19:15:21Z" level=info msg="Server stopped"
time="2023-02-25T19:15:21Z" level=info msg="Shutting down"
192.168.178.78 - - [25/Feb/2023:14:15:53 +0000] "GET /api/live/ws HTTP/1.1" 0 0 "-" "-" 15423 "monitoring@docker" "http://172.19.0.2:3000" 17967621ms
192.168.178.78 - - [25/Feb/2023:17:28:51 +0000] "GET /rest/events/states HTTP/2.0" 200 64686 "-" "-" 20074 "openhab@file" "http://192.168.178.33:8080/" 6389789ms
192.168.178.78 - - [25/Feb/2023:13:56:53 +0000] "GET /rest/events/states HTTP/2.0" 200 183583 "-" "-" 13738 "openhab@file" "http://192.168.178.33:8080/" 19107931ms
192.168.178.78 - - [25/Feb/2023:14:26:55 +0000] "GET /api/v1/ws HTTP/1.1" 0 0 "-" "-" 16007 "photoprism@docker" "http://172.24.0.12:2342" 17305577ms
time="2023-02-25T19:15:24Z" level=info msg="Configuration loaded from file: /etc/traefik/traefik.yml"
time="2023-02-25T19:15:24Z" level=info msg="Traefik version 2.8.5 built on 2022-09-13T15:19:09Z"
time="2023-02-25T19:15:24Z" level=info msg="\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://doc.traefik.io/traefik/contributing/data-collection/\n"
time="2023-02-25T19:15:24Z" level=warning msg="Traefik Pilot is deprecated and will be removed soon. Please check our Blog for migration instructions later this year."
time="2023-02-25T19:15:24Z" level=info msg="Starting provider aggregator aggregator.ProviderAggregator"
time="2023-02-25T19:15:24Z" level=info msg="Starting provider *file.Provider"
time="2023-02-25T19:15:24Z" level=info msg="Starting provider *traefik.Provider"
time="2023-02-25T19:15:24Z" level=info msg="Starting provider *acme.Provider"
time="2023-02-25T19:15:24Z" level=info msg="Testing certificate renew..." providerName=le_main.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2023-02-25T19:15:24Z" level=info msg="Starting provider *acme.ChallengeTLSALPN"
time="2023-02-25T19:15:24Z" level=info msg="Starting provider *docker.Provider"
time="2023-02-25T19:15:24Z" level=warning msg="Could not find network named 'traefik' for container '/monitoring_grafana_1'! Maybe you're missing the project's prefix in the label? Defaulting to first available network." container=grafana-monitoring-168b0fa2c98c9477da415817c75a42c6bf1c6d357156b0734fd357cc27840706 serviceName=grafana-monitoring providerName=docker
time="2023-02-25T19:15:27Z" level=error msg="middleware \"authelia@docker\" does not exist" entryPointName=websecure routerName=pihole_host@file
time="2023-02-25T19:15:27Z" level=error msg="middleware \"authelia@docker\" does not exist" entryPointName=web routerName=pihole_host@file
...
192.168.178.78 - - [25/Feb/2023:14:18:14 +0000] "GET /browse HTTP/2.0" 401 16 "-" "-" 15546 "photoprism@docker" "-" 2ms

Documentation

No response

Pre-Submission Checklist

• I agree to follow the Code of Conduct
• This is a bug report and not a support request
• I have read the security policy and this bug report is not a security issue or security related issue
• I have either included the complete configuration file or I am sure it's unrelated to the configuration
• I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the Troubleshooting Sanitization reference guide
• I have checked for related proxy or application logs and included them if available
• I have checked for related issues and checked the documentation

[niwla23]

I have tried downgrading to 4.36 and then back up to 4.37, In 4.36 everything works normally, it only happens in 4.37

[james-d-elliott]

I'm actually really done with people not completing the issue template. Do I really need to bold the part about showing the complete logs?

[niwla23]

I have added the traefik startup log and the complete authelia log. I have not included actually complete traefik logs because all the other lines are just very normal 200 OK requests that mostly don't even go through authelia.

Sorry for missing the part about the logs being complete.

[james-d-elliott]

I got overly frustrated by it, my apologies. Think I was frustrated with something else, and the fact I am having to ask for the full logs with multiple people is frustrating.

Those logs should suffice. What does your forwardauth middleware look like?

[james-d-elliott]

I suspect this is because you configured the forward auth address to something like http://authelia:9091/api/verify?rd=http://auth.b49.cloudserver.click which is not valid, you should instead configure it as http://authelia:9091/api/verify?rd=https://auth.b49.cloudserver.click for example.

[niwla23]

That actually fixed it, thanks! Should this be added to the release notes? I wouldn't expect a minor update to break something like this.

[james-d-elliott]

It will not be added to the release notes. While this "broke" your setup, your setup was a clear misconfiguration which disregarded our official Traefik guide. For these reasons I'd argue it clearly highlighted a misconfiguration, which was the intention of the adjustment which ensured that Authelia does not redirect users to incorrect URLs during the forward auth process.

This issue really should be reported to the authors of the guide which instructed use of a misconfiguration which could lead to all sorts of other problematic and confusing results.