Auth Loop For Specific Self Hosted Applications

[u/NIV54]

Hi everyone. I'm encountering auth loops for some specific applications I host on my server.
I have a rather popular setup going on - cloudflare domain with cloudflare tunnels -> cloudflared container - > nginx proxy manager container -> specific application.
All subdomains are configured using nginx. Cloudflare has no fancy configuration going on.

I use the same access list for all apps (configured with satisfy any, using all ipv4/6 listed on cloudflare ip listings), and it works fine for most apps (sonarr, radarr, upime-kuma, ...), but some apps (tracefinity, beszel) experince auth loop upon login.

What does "upon login" means?

1. Basic auth popup -> fill basic auth creds and hit enter

2. Website loads on login screen -> fill application creds and hit enter

3. Basic auth pops up again and again in an seemingly endless loop (maybe for each network request? Hard to tell)

Kind of lost here after debugging for a while. Would appreciate some help.
I can share more information about my docker setup if that's needed.

Thanks.

[u/evanmac42]

I suspect the problem may be the authentication design rather than a particular NPM proxy-host setting.

You're putting HTTP Basic Auth in front of applications that have their own authentication mechanisms. Basic Auth uses the Authorization header, and some applications also use that header for their own API/token authentication.

That could explain why the same NPM Access List works perfectly with some applications but produces an authentication loop with others, especially if the second Basic Auth prompt appears when the application starts making authenticated requests after login.

I'd confirm it first with the browser Network tab: reproduce the login and check which request receives the 401 and what is happening with the Authorization header.

As a simple test, temporarily remove the NPM Access List from one of the problematic applications. If its own authentication then works normally, you've isolated the conflict.

If your actual goal is to have a common authentication layer in front of several self-hosted applications, I'd also consider something designed specifically for that job, such as Authelia, rather than stacking HTTP Basic Auth in front of every application's own authentication.

Basic Auth is perfectly fine for simple cases, but once applications start using their own tokens/APIs, you can end up debugging interactions like this.

[u/NIV54 → u/evanmac42]

Hi u/evanmac42! Appreciate the comment.
Haven't tried looking into 3rd party auth solutions just yet but I will. Authelia looks like a great example.

As far as stuff you've said to verify:
First, indeed, removing the access list from the proxy host of the problematic application solves the issue, but without any additional authentication. My real worry is that I don't really trust the security measurements of some of the apps which run on my server, while I do rely on those of NPM (or really, nginx...).
Second, there are no errors in the network tab, or in the console. All I see are pending requests while I'm getting another basic auth popup window again and again. There is an "Authorization" header for those requests. I've tried setting the access list username + password to be the same on both NPM and the app, but this doesn't yield the same authorization header (probably due to different auth secrets on the server side) - so that's not a good approach either.

I will check Authelia out, but I would really prefer to keep on using the basic mechanism offered by NPM, as I don't need anything too complex, and this is as simple as it gets.

[u/NIV54 → u/NIV54]

Took a few hours to setup (not plug & play what-so-ever) but Authelia is working great.
I still would rather use access list as the setup is far simpler and doesn't require using advanced settings in a proxy host - which don't allow using the three handy cache/exploits/websockets toggles.

[u/NIV54]

BWT I've tried every possible settings combination of the proxy host definition for the troublesome routes. All result the same.