actualbudget / actualbudget/actual
[Bug]: Server ignores that `ACTUAL_OPENID_ENFORCE` was set to `true` if its unable to communicate with OpenID server
- Dominant language
- TypeScript
- Stars
- 28.7k
- Forks
- 3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 65
Description
### Verified issue does not already exist?
- [x] I have searched and found no existing issue
### What happened?
I'm playing with setting up Authelia and Actual in my home lab and noticed that Actual comes up and displays the 'set password' page even if the `ACTUAL_OPENID_ENFORCE` environment variable was set to `true`.
### How can we reproduce the issue?
Start the server afresh so it requires bootstrapping, set the `ACTUAL_OPENID_DISCOVERY_URL` to be something that the server cannot/doesn't want to communicate with (such as an endpoint with a self-signed certificate), and set `ACTUAL_OPENID_ENFORCE` to be `true`. Note that the server is serving the same bootstrap page as if `ACTUAL_OPENID_ENFORCE` was `false`.
Here are the logs from my test server:
```
2025-12-08T17:03:48.394423565Z Checking if there are any migrations to run for direction "up"...
2025-12-08T17:03:48.534708992Z Migrations: DONE
2025-12-08T17:03:49.409182075Z Running in production mode - Serving static React app
2025-12-08T17:03:49.409439570Z OpenID configuration found. Preparing server to use it
2025-12-08T17:03:49.429230654Z configuration-error
2025-12-08T17:03:49.429251243Z Error setting up OpenID client: Error: unable to get local issuer certificate
2025-12-08T17:03:49.429262935Z at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
2025-12-08T17:03:49.429267855Z at TLSSocket.emit (node:events:519:28)
2025-12-08T17:03:49.429271611Z at TLSSocket._finishInit (node:_tls_wrap:1078:8)
2025-12-08T17:03:49.429275269Z at ssl.onhandshakedone (node:_tls_wrap:864:12) {
2025-12-08T17:03:49.429278765Z code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
2025-12-08T17:03:49.429282182Z }
2025-12-08T17:03:49.430817924Z Listening on :::5006...
2025-12-08T17:04:13.810061313Z 2025-12-08T17:04:13.809Z info: GET 200 /account/needs-bootstrap
2025-12-08T17:04:13.824868967Z 2025-12-08T17:04:13.824Z info: GET 304 /account/needs-bootstrap
```
### Where are you hosting Actual?
Docker
### What browsers are you seeing the problem on?
Firefox
### Operating System
Linux
Contributor guide
Assessment
This issue has not been assessed yet.