CSS and Javascript MIME Errors #6106

Junto026 · 2023-10-09T13:26:36Z

Junto026
Oct 9, 2023

I'm having an issue accessing another app (Plex) through NGINX when Authelia is being used to protect Plex. If I remove Authelia, the issue goes away. I don't understand the error, and I'm sure there's a configuration change I can make to resolve it, but am not sure where to start.

Screenshot of the error. It happens after I authenticate with Authelia and it then tries to re-direct me to Plex.

Often, if I refresh a few times, the error goes away and Plex loads.

Should I remove the X-Content-Type-Options: no sniff or is that a terrible idea? If I should remove it, where? (I can't find where that is being added). Other possible causes / suggestions I should research?

configuration.yaml

###############################################################################
#                           Authelia Configuration                            #
###############################################################################

## Note: the container by default expects to find this file at authelia:/config/configuration.yml

## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/

theme: dark
jwt_secret: <redacted>
default_redirection_url: https://authelia.mydomain.com
default_2fa_method: "webauthn" ## Options are totp, webauthn, mobile_push.

server:
  host: 0.0.0.0
  port: 9091
  path: ""
  # asset_path: /config/assets/
  enable_pprof: false
  enable_expvars: false
  disable_healthcheck: false

  tls:
  ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
    key: "/config/certificates/privkey.pem" ## The path to the DER base64/PEM format private key.
    certificate: "/config/certificates/fullchain.pem" ## The path to the DER base64/PEM format public certificate.
    client_certificates: [] ## The list of certificates for client authentication.

  headers:
  ## Server headers configuration/customization.
    csp_template: "" ## The CSP Template. Read the docs.

  # buffers:
  ## Server Buffers configuration.
    # read: 4096 ## Read buffer.
    # write: 4096 ## Write buffer.

  # timeouts:
  ## Server Timeouts configuration.
    # read: 6s ## Read timeout.
    # write: 6s ## Write timeout.
    # idle: 30s ## Idle timeout.

log:
  level: trace ## Level of verbosity for logs: error, warn, info, debug, trace.
#  format: json ## Format the logs are written as: json, text.
#  file_path: /config/authelia.log ## File path where the logs will be written. If not set logs are written to stdout.
#  keep_stdout: true ## Whether to also log to stdout when a log_file_path is defined.

totp:
  disable: true ## Disable TOTP.
  issuer: my domain.com ## The issuer name displayed in the Authenticator application of your choice.
  algorithm: sha1 ## The TOTP algorithm to use.
  digits: 6 ## The number of digits a user has to input. Must either be 6 or 8.
  period: 300   ## The period in seconds a one-time password is valid for.
  skew: 1 ## The skew controls number of one-time passwords either side of the current one that are valid.
  secret_size: 32 ## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.

webauthn:
  disable: false  
  timeout: 60s ## Adjust the interaction timeout for Webauthn dialogues.
  display_name: Authelia ## The display name the browser should show the user for when using Webauthn to login/register.  
  attestation_conveyance_preference: none  ## Options are none, indirect, direct.  Controls if attestation statement including the AAGUID is collected
  user_verification: preferred  ## Options are required, preferred, discouraged.  Controls if hte user must make a gesture or action to confirm they are present.

duo_api:
  disable: true
  # hostname: api-123456789.example.com
  # integration_key: ABCDEF
  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
  # secret_key: 1234567890abcdefghifjkl
  # enable_self_enrollment: false

ntp:
  address: "time.cloudflare.com:123" ## NTP server address.
  version: 4 ## NTP version.
  max_desync: 3s ## Maximum allowed time offset between the host and the NTP server.
  disable_startup_check: false ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
  disable_failure: false   ## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync

authentication_backend:
## The available providers are: `file`, `ldap`. You must use only one of these providers.
  password_reset:
    disable: false ## Disable both the HTML element and the API for reset password functionality.
    custom_url: "" ## External reset password url that redirects the user to an external reset portal. This disables the internal reset functionality.

  refresh_interval: 5m ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.

#  file: 
#  ## File (Authentication Provider)
#    path: /config/users_database.yml
#    watch: false
#    search:
#      email: false
#      case_insensitive: false
#    password:
#      algorithm: argon2id
#      iterations: 3
#      memory: 64
#      parallelism: 4
#      key_length: 32
#      salt_length: 16

  ldap:
    implementation: custom
    url: ldaps://openldap.mydomain.com
#    url: ldap://192.168.32.105
    timeout: 5s ## The dial timeout for LDAP.
    start_tls: false ## Use StartTLS with the LDAP connection.
    tls:
      server_name: openldap.mydomain.com
      skip_verify: true ## Skip verifying the server certificate entirely. 
      minimum_version: TLS1.2
      maximum_version: TLS1.3

    base_dn: dc=mydomain,dc=com
    username_attribute: uid
    additional_users_dn: ou=users
    users_filter: (&({username_attribute}={input})(objectClass=inetOrgPerson))
    additional_groups_dn: ou=groups
    groups_filter: (&(member={dn})(objectClass=groupOfNames))
    group_name_attribute: cn
    mail_attribute: mail
    display_name_attribute: displayName
    permit_referrals: false ## Follow referrals returned by the server. This is especially useful for environments where read-only servers exist. Only implemented for write operations.
    user: cn=admin,dc=mydomain,dc=com
    password: <redacted> 

password_policy:
  standard:
    enabled: true
    min_length: 12 
    max_length: 0  
    require_uppercase: true 
    require_lowercase: true 
    require_number: true 
    require_special: true

access_control:
  default_policy: deny ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. 
  rules:
    - domain: 'authelia.mydomain.com'
      policy: bypass
    - domain: '*.mydomain.com'
      policy: two_factor
      subject:
      - 'group:autheliaadmins'

session:
  name: authelia_session ## The name of the session cookie.
  domain: my domain.com
  same_site: lax ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  secret: insecure_session_secret ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
  expiration: 1M ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
  inactivity: 1M
  remember_me_duration: -1 ## 1M default; Value of -1 disables remember me.

regulation:
  max_retries: 3 ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
  find_time: 2m ## The time range during which the user can attempt login before being banned. The user is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
  ban_time: 5m ## The length of time before a banned user can login again. Ban Time accepts duration notation.

storage:
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
  encryption_key: <redacted>
  local:
  ## Path to the SQLite3 Database.
    path: /config/db.sqlite3

notifier:
  disable_startup_check: true  ## You can disable the notifier startup check by setting this to true.

  smtp:
    host: smtp.mail.me.com
    port: 587
    timeout: 5s
    username: user@mydomain.com
    password: <redacted>
    sender: "Authelia <services@mydomain.com>"
    # identifier: localhost. ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
    subject: "{title}"
    startup_check_address: user@mydomain.com   
    # disable_require_tls: false  ## By default we require some form of TLS. This disables this check though is not advised.
    # disable_html_emails: false

    tls:
      skip_verify: false
      minimum_version: TLS1.2
...

nginx.conf Snippet

	# Authelia
	server {
		listen 443 ssl;
		listen [::]:443 ssl;
		http2 on;
		server_name authelia.mydomain.com;
		include /etc/nginx/conf.d/certificate_locations;

		location / {
			proxy_pass https://192.168.32.102:9091;
			include /etc/nginx/conf.d/authelia_nginx_config;
		}
	}

	# Plex Server
	server {
		listen 443 ssl;
		listen [::]:443 ssl;
		http2 on;
		server_name plex.mydomain.com;
		include /etc/nginx/conf.d/authelia_protectedapp_connection;

		location / {
			location = / {
 				return 301 /web;
			}			

			proxy_pass https://192.168.32.106:32400; 
			include /etc/nginx/conf.d/authelia_protectedapp_config;	
		}
	}

/etc/nginx/conf.d/authelia_nginx_config


## Headers
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Connection "";

## Basic Proxy Configuration
client_body_buffer_size 128k;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead.
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

## Trusted Proxies Configuration
## Please read the following documentation before configuring this:
##     https://www.authelia.com/integration/proxies/nginx/#trusted-proxies
set_real_ip_from 192.168.32.0/20;
set_real_ip_from 10.0.0.0/24;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

## Advanced Proxy Configuration
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

/etc/nginx/conf.d/authelia_protectedapp_connection

location /authelia {
	proxy_pass https://192.168.32.102:9091/api/verify;    
	internal;
	proxy_pass_request_body off;
	proxy_set_header Content-Length "";

	# Timeout if the real server is dead
	proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
	client_body_buffer_size 128k;
	proxy_set_header Host $host;
	proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $remote_addr; 
	proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header X-Forwarded-Host $http_host;
	proxy_set_header X-Forwarded-Uri $request_uri;
	proxy_set_header X-Forwarded-Ssl on;
	proxy_redirect  http://  $scheme://;
	proxy_http_version 1.1;
	proxy_set_header Connection "";
	proxy_cache_bypass $cookie_session;
	proxy_no_cache $cookie_session;
	proxy_buffers 4 32k;

	send_timeout 5m;
	proxy_read_timeout 240;
	proxy_send_timeout 240;
	proxy_connect_timeout 240;
}

/etc/nginx/conf.d/authelia_protectedapp_config


auth_request /authelia;
auth_request_set $target_url https://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $email $upstream_http_remote_email;
auth_request_set $groups $upstream_http_remote_groups;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Email $email;
proxy_set_header Remote-Groups $groups;

error_page 401 =302 https://authelia.mydomain.com/?rd=$target_url; #change this to match your authentication domain/subdomain

client_body_buffer_size 128k;

proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Accept-Encoding gzip;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 192.168.32.0/20;
set_real_ip_from 10.0.0.0/24;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

Answered by james-d-elliott

Oct 9, 2023

Looks like either the cookie is not being passed by plex when requesting those assets or the plex js is not following redirects (or both) which leads to the issue.You can try bypassing the js directory but as to what other issues that might result in I'm not sure.

View full answer

Junto026 · 2023-10-09T19:15:43Z

Junto026
Oct 9, 2023
Author

I found the below in the Authelia logs when the issue occurs...

2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=info msg="Access to https://plex.mydomain.com/web/js/3519-3519-35b03a3b034aaa63bb09-plex-4.108.0.32184-ffafb0d.js (method unknown) is not authorized to user , responding with status code 401" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="Checking if we need check the authentication backend for an updated profile for ." method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=debug msg="Check authorization of subject username= groups= ip=192.168.65.1 and object https://plex.mydomain.com/web/main-179-69d37121295f158388fa-plex-4.108.0.32184-ffafb0d.css (method )."
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="Replied (status=401)" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="ACL MISS Position 1 for subject username= groups= ip=192.168.65.1 and object https://plex.mydomain.com/web/main-179-69d37121295f158388fa-plex-4.108.0.32184-ffafb0d.css (method )"
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="ACL HIT Position 2 for subject username= groups= ip=192.168.65.1 and object https://plex.mydomain.com/web/main-179-69d37121295f158388fa-plex-4.108.0.32184-ffafb0d.css (method )"
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="ACL MISS Position 1 for subject username= groups= ip=192.168.65.1 and object https://plex.mydomain.com/web/js/main-179-69d37121295f158388fa-plex-4.108.0.32184-ffafb0d.js (method )"
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="ACL HIT Position 2 for subject username= groups= ip=192.168.65.1 and object https://plex.mydomain.com/web/js/main-179-69d37121295f158388fa-plex-4.108.0.32184-ffafb0d.js (method )"
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=info msg="Access to https://plex.mydomain.com/web/js/main-179-69d37121295f158388fa-plex-4.108.0.32184-ffafb0d.js (method unknown) is not authorized to user , responding with status code 401" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="Replied (status=401)" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=info msg="Access to https://plex.mydomain.com/web/main-179-69d37121295f158388fa-plex-4.108.0.32184-ffafb0d.css (method unknown) is not authorized to user , responding with status code 401" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="Replied (status=401)" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="ACL HIT Position 2 for subject username= groups= ip=192.168.65.1 and object https://plex.mydomain.com/web/3519-3519-35b03a3b034aaa63bb09-plex-4.108.0.32184-ffafb0d.css (method )"
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=info msg="Access to https://plex.mydomain.com/web/3519-3519-35b03a3b034aaa63bb09-plex-4.108.0.32184-ffafb0d.css (method unknown) is not authorized to user , responding with status code 401" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:40 authelia | time="2023-10-09T14:59:40-04:00" level=trace msg="Replied (status=401)" method=GET path=/api/verify remote_ip=192.168.65.1
2023-10-09 14:59:41 authelia | time="2023-10-09T14:59:41-04:00" level=trace msg="Request hit" method=GET path=/api/health remote_ip=127.0.0.1
2023-10-09 14:59:41 authelia | time="2023-10-09T14:59:41-04:00" level=trace msg="Replied (status=200)" method=GET path=/api/health remote_ip=127.0.0.1

21 replies

james-d-elliott Oct 9, 2023
Maintainer

Looks like either the cookie is not being passed by plex when requesting those assets or the plex js is not following redirects (or both) which leads to the issue.You can try bypassing the js directory but as to what other issues that might result in I'm not sure.

Answer selected by Junto026

Junto026 Oct 9, 2023
Author

Interestingly, bypassing the plex.mydomain.com/web/js directory did not fix it. But bypassing the entire plex.mydomain.com/web/ directory did.

I don't love the "fix", but the Plex app does have its own built-in authentication and 2FA, so I suppose it's OK.

The issue is funky since it only happens on Safari. And disabling all cookie/privacy features in Safari and MacOS didn't help.

james-d-elliott Oct 10, 2023
Maintainer

Very unusual. Can you verify in the requests in the browser that it's not sending the cookie header? I'm not sure we can do much if it's excluding it except ask them to include it. I suspect when it occurs the cookie is absent and when it doesn't it's present. Also does this only occur with Safari + Plex? If so maybe it's a Safari bug.

Junto026 Oct 10, 2023
Author

This is what I see in network transactions when the issue occurs. It looks to me no Cookies are being provided by Safari. Does this indicate the same to you? Yes I'm only seeing it with Safari+Plex... possibly it is a Safari bug.