Infinite Redirect Loop with Cloudflare caching

[Aboitier]

Hello,

Thanks for the awesome solution.

I get weird behavior when deploying the solution to my Kubernetes cluster : in /setup, right when clicking on "Next" at the end of setup, I get a NS_DOMAIN_SERVER (firefox) error and cannot access next page. Then I visit /admin and I get infinitely redirected from /admin to /login several times per second. It is when I open the network tab of my browser console that the error stops and I can access the app. Though I cannot disconnect because of this redirect.

Also, I observed that a call to uploadStatus is made every 3 seconds (see picture below).

I de-activated the SSL since it is taken care of by our certbot.

Would you have hints about this ? Or can I provide you with some more information maybe ?

[Forceu]

Thanks for your feedback! What authentication method are you using? And would you be able to post your configuration file (with censoring sensitive data)?

[Aboitier]

Hi thanks for the quick answer and sorry for my late one.

I am using the classical login/password authent.

Here is my conf with censored data :

{
  "Authentication": {
    "Method": 0,
    "SaltAdmin": "xxxxxx",
    "SaltFiles": "xxxxxx",
    "Username": "xxxxxxx",
    "Password": "xxxxxxx",
    "HeaderKey": "",
    "OauthProvider": "",
    "OAuthClientId": "",
    "OAuthClientSecret": "",
    "OauthUserScope": "",
    "OauthGroupScope": "",
    "OAuthRecheckInterval": 12,
    "HeaderUsers": null,
    "OAuthGroups": [],
    "OauthUsers": []
  },
  "Port": ":53842",
  "ServerUrl": "https://mysubdomain.mydomain.eu/",
  "RedirectUrl": "https://mysubdomain.mydomain.eu/admin",
  "PublicName": "xxxxxxxx's secure file transfer platform",
  "DataDir": "data",
  "DatabaseUrl": "redis://redis.xxxxxxx:6379?prefix=gokapi_",
  "ConfigVersion": 21,
  "LengthId": 15,
  "MaxFileSizeMB": 102400,
  "MaxMemory": 50,
  "ChunkSize": 45,
  "MaxParallelUploads": 4,
  "Encryption": {
    "Level": 0,
    "Cipher": null,
    "Salt": "",
    "Checksum": "",
    "ChecksumSalt": ""
  },
  "UseSsl": false,
  "PicturesAlwaysLocal": false,
  "SaveIp": false,
  "IncludeFilename": false
}

[Forceu]

@Aboitier: I have been unable to reproduce the problem - I assume you were not able to fix it?

[sophiethefox]

experiencing same issue after re-running --reconfigure multiple times. i am using docker compose, and restarting gokapi (docker compose down / docker compose up -d did not fix.
heading to /admin and signing in with set credentials goes to /admin then immediately redirects to /login despite correct credentials. nothing changed since it originally worked, was simply adjusting other configuration values

[Forceu]

Thanks for the feedback! Can you please post the docker compose file you are using?

[sophiethefox]

there are several other, unrelated services, however the service for gokapi is as such

  gokapi:
    image: f0rc3/gokapi:latest
    container_name: gokapi
    ports:
      - "53842:53842"
    environment:
      - TZ=UTC
    volumes:
      - ./gokapi/data:/app/data
      - ./gokapi/config:/app/config
    networks:
      - web
    restart: unless-stopped

gokapi/config/config.json

{
  "Authentication": {
    "Method": 0,
    "SaltAdmin": "[redacted]",
    "SaltFiles": "[redacted]",
    "Username": "sophie",
    "Password": "[redacted]",
    "HeaderKey": "",
    "OauthProvider": "",
    "OAuthClientId": "",
    "OAuthClientSecret": "",
    "OauthUserScope": "",
    "OauthGroupScope": "",
    "OAuthRecheckInterval": 12,
    "HeaderUsers": null,
    "OAuthGroups": [],
    "OauthUsers": []
  },
  "Port": ":53842",
  "ServerUrl": "https://files.[redacted].com/",
  "RedirectUrl": "https://files.[redacted].com/admin",
  "PublicName": "Gokapi",
  "DataDir": "data",
  "DatabaseUrl": "sqlite://./data/gokapi.sqlite",
  "ConfigVersion": 21,
  "LengthId": 15,
  "MaxFileSizeMB": 102400,
  "MaxMemory": 50,
  "ChunkSize": 45,
  "MaxParallelUploads": 4,
  "Encryption": {
    "Level": 0,
    "Cipher": null,
    "Salt": "",
    "Checksum": "",
    "ChecksumSalt": ""
  },
  "UseSsl": false,
  "PicturesAlwaysLocal": false,
  "SaveIp": false,
  "IncludeFilename": true
}

running behind nginx reverse proxy with config:

    ... other domains
    server {
        listen 443 ssl;
        server_name files.[redacted].com;
        include /etc/nginx/allow-cloudflare-only.conf;
        ssl_certificate /etc/nginx/certs/origin.pem;
        ssl_certificate_key /etc/nginx/certs/private.key;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384";

        client_max_body_size 500M;
        client_body_buffer_size 2M;

        proxy_connect_timeout 1200;
        proxy_send_timeout 1200;
        proxy_read_timeout 1200;
        send_timeout 1200;

        location / {
            proxy_pass http://gokapi:53842;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_set_header Host $host;
            proxy_cache_bypass $http_upgrade;
            proxy_set_header X-Forwarded-Host $http_cf_connecting_ip;
        }
    }

[Forceu]

Thanks! Can you please try the image gokapi:latest-dev instead of gokapi:latest? There was a change in 53d27c2, which might be fixing the problem.

Edit: I just saw that this should be already included in the latest version. What browser are you using?

[sophiethefox]

For my scenario, it turns out was likely caused by cloudflare cache. I purged cloudflare's cache and adjusted my rules and the redirect loop stopped (though this was after swapping to latest to latest-dev)

I also cleared browser cache, though that had not worked prior to purging cloudflare's cache.
Thank you for your assistance and time

[Forceu]

Great! Although a cache control header was set, Cloudflare apparently does not always honour it. I added specific cache control headers for cloudflare in d080cfa to fix this issue. Again, thanks for the feedback!