actualbudget / actualbudget/actual

[Bug]: Server ignores that `ACTUAL_OPENID_ENFORCE` was set to `true` if its unable to communicate with OpenID server

Open
#6,333 0 comments 0 reactions 0 assignees View on GitHub
openid
Dominant language
TypeScript
Stars
28.7k
Forks
3k
Avg merge
2d 11h
Merged PRs (30d)
65

Description

### Verified issue does not already exist?

- [x] I have searched and found no existing issue

### What happened?

I'm playing with setting up Authelia and Actual in my home lab and noticed that Actual comes up and displays the 'set password' page even if the `ACTUAL_OPENID_ENFORCE` environment variable was set to `true`.

### How can we reproduce the issue?

Start the server afresh so it requires bootstrapping, set the `ACTUAL_OPENID_DISCOVERY_URL` to be something that the server cannot/doesn't want to communicate with (such as an endpoint with a self-signed certificate), and set `ACTUAL_OPENID_ENFORCE` to be `true`. Note that the server is serving the same bootstrap page as if `ACTUAL_OPENID_ENFORCE` was `false`.

Here are the logs from my test server:

```
2025-12-08T17:03:48.394423565Z Checking if there are any migrations to run for direction "up"...
2025-12-08T17:03:48.534708992Z Migrations: DONE
2025-12-08T17:03:49.409182075Z Running in production mode - Serving static React app
2025-12-08T17:03:49.409439570Z OpenID configuration found. Preparing server to use it
2025-12-08T17:03:49.429230654Z configuration-error
2025-12-08T17:03:49.429251243Z Error setting up OpenID client: Error: unable to get local issuer certificate
2025-12-08T17:03:49.429262935Z at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
2025-12-08T17:03:49.429267855Z at TLSSocket.emit (node:events:519:28)
2025-12-08T17:03:49.429271611Z at TLSSocket._finishInit (node:_tls_wrap:1078:8)
2025-12-08T17:03:49.429275269Z at ssl.onhandshakedone (node:_tls_wrap:864:12) {
2025-12-08T17:03:49.429278765Z code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
2025-12-08T17:03:49.429282182Z }
2025-12-08T17:03:49.430817924Z Listening on :::5006...
2025-12-08T17:04:13.810061313Z 2025-12-08T17:04:13.809Z info: GET 200 /account/needs-bootstrap
2025-12-08T17:04:13.824868967Z 2025-12-08T17:04:13.824Z info: GET 304 /account/needs-bootstrap
```

### Where are you hosting Actual?

Docker

### What browsers are you seeing the problem on?

Firefox

### Operating System

Linux

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.