[Bug] reverse proxy quic/http3 oidc fails
- Dominant language
- PHP
- Stars
- 16k
- Forks
- 1.3k
- Avg merge
- 13h 24m
- Merged PRs (30d)
- 40
Description
### Describe the bug
I just switched on http3/quic on my nginx reverse proxy. This failed on my former working oauth setup to FreshRSS with httpd/quic supporting browsers. Login worked via tor, via a corporate proxy which does not offer quic and browsers which do not support quic. (oauth backend: forgejo)
### To Reproduce
1. Have a working oauth setup
2. Reverse Proxy: enable HTTP/3 - Quic
3. Try to open FreshRSS
### Expected behavior
Expected:
- (login via the oauth host - in my case forgejo)
- Redirect into FreshRSS
Actual behaviour:
- (login via the oauth host - in my case forgejo)
- Redirect fails. There are different error messages depending on browser. But there are messages like "Redirect Failure", "unexpected oidc host", `freshrss.local` as target in the redirect url (!) though it is nowhere set...
### FreshRSS version
1.28.1
### System information
- Database version: SQLite
- PHP version: original Container version
- Installation type: official Container via `docker-compose`
- Web server type: Reverse: nginx
- Device: Asahi Laptop, Windows Laptop (Corporate - Works!), Android Device
- OS: Debian Testing (asahi), Windows 11, GrapheneOS
- Browser: Firefox 149 (fails), Firefox-ESR (Corporate behind zScaler proxy- Works!), Epiphany 49.2 (Works, probably no Quic-Support in Browser), Fennec 149.0.1 (fails).
### Additional context
I could fix it via a `proxy_http_version 1.1;` directive, so the settings are now:
```
location / {
proxy_http_version 1.1; # <---- the needed option
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_pass http://localhost:8080/;
add_header Alt-Svc 'h3=":443"; ma=86400';
break;
}
```
So it probably needed to be mentioned in the documentation.
Contributor guide
Assessment
This issue has not been assessed yet.