cloudflare / cloudflare/cloudflared
cloudflared access problem with headers: CF_Authorization/cf-access-token
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I've configured my gitlab server to use cloudflared to generate https and ssh tunnels. The ssh tunnel is working fine when cloning, however, the https endpoint doesn't work.
**Describe the bug**
Whenever I try to clone using https, I'm redirected to Cloudflare Access portal when I send the following cookie:
cookie.txt, obtained from `cloudflared access token -app=https://gitlab.myhost.es`
```
CF_Authorization=eyJhbGciOiJSUzI1;
```
Git clone
```
❯ ck=$(cat cookie.txt)
❯ git clone -c http.extraHeader="Cookie: $ck" https://gitlab.myhost.es/internal/internalresources.git
Cloning into 'internalresources'...
fatal: unable to update url base from redirection:
asked for: https://gitlab.myhost.es/internal/internalresources.git/info/refs?service=git-upload-pack
redirect: https://cfuser.cloudflareaccess.com/cdn-cgi/access/login/gitlab.myhost.es?kid=2f07f99436fc1049d833c3c40626b9ff2&redirect_url=%2Finternal%2Finternalresources.git%2Fi
nfo%2Frefs%3Fservice%3Dgit-upload-pack&meta=eyJraWQiOiJlZjAyNjZj
❯
```
However, sending the cookies used by the browser skips the access portal:
cookie2.txt, obtained inspecting browser request
```
CF_Authorization=eyJhbGciOiJSUzI1; CF_Binding=eyJhbGciOiJSUzI1NiIsImtpZCI;
```
Git clone
```
❯ ck2=$(cat cookie2.txt)
❯ git clone -c http.extraHeader="Cookie: $ck2" https://gitlab.myhost.es/internal/internalresources.git
Cloning into 'internalresources'...
Username for 'https://gitlab.myhost.es': ^C
❯
```
Cloudflared configuration:
- Tunnel ID : b065ebdd-7ce0-4ffc-90e3-0ef16bb96a54
```
tunnel: b065ebdd-7ce0-4ffc-90e3-0ef16bb96a54
credentials-file: /home/S/.cloudflared/b065ebdd-7ce0-4ffc-90e3-0ef16bb96a54.json
ingress:
- hostname: gitlab.myhost.es
service: http://localhost:8000
- hostname: gitlab-ssh.myhost.es
service: ssh://localhost:2222
- service: http_status:404
```
**Expected behavior**
Clone the repository
**Environment and versions**
- OS: Ubuntu 20.04
- Architecture: amd64
- Version: cloudflared version 2023.6.1 (built 2023-06-20-0927 UTC)
**Additional context**
I've tried pre-login with cloudflared, but it exits with "Could not verify token" error after accepting the two banners.
```
❯ cloudflared access login gitlab.gicp.es
A browser window should have opened at the following URL:
https://gitlab.myhost.es/cdn-cgi/access/cli?aud=2f07f99436fc1049d833c3c40626b9ff&edge_token_transfer=true&redirect_url=https%3A%2F%2Fgitlab.myhost.es%3Faud%3D2f07f99436fc1049d833c3c40626b9%26token%3DmSdi6fRtlULLjeSIU&send_org_token=true&token=mSdi6fRtlULLjeSIUqDC61
If the browser failed to open, please visit the URL above directly in your browser.
A browser window should have opened at the following URL:
https://gitlab.myhost.es/cdn-cgi/access/cli?aud=2f07f99436fc1049d833c3c40626b9ff29cb2&edge_token_transfer=true&redirect_url=https%3A%2F%2Fgitlab.myhost.es%3Faud%3D2f07f99436fc1049d833c3c40626b9f%26token%3DbaO_u_3uakF_C-AN&send_org_token=true&token=baO_u_3uakF_C-AN8ie
If the browser failed to open, please visit the URL above directly in your browser.
2023-06-26T13:56:03Z ERR Could not verify token error="failed to verify token"
failed to verify token
```
Contributor guide
Assessment
This issue has not been assessed yet.