gotify / gotify/server

403 when passing Origin header with Environment config

Open
#633 7 comments 0 reactions 0 assignees View on GitHub
a:feature in:server
Dominant language
Go
Stars
15.9k
Forks
873
Avg merge
2d 22h
Merged PRs (30d)
6

Description

**Have you read the documentation?**
- [ ] Yes, but it does not include related information regarding my question.
- [x] Yes, but the steps described in the documentation do not work on my machine.
- [x] Yes, but I am having difficulty understanding it and wants clarification.

**You are setting up gotify in**
- [x] Docker
- [ ] Linux native platform
- [ ] Windows native platform

**Describe your problem**
I have Gotify 2.4.0 running in Docker (using Caprover), with nginx proxy. Web UI runs fine (same origin). Using Postman from Windows also submits messages just fine. The problem is the cors allow origin seems to not be validating the Origin header and logging 403.

I have the following environment variables set (square brackets represent the UI textboxes of Caprover):

```
[GOTIFY_SERVER_CORS_ALLOWORIGINS] [- \".*\"]
[GOTIFY_SERVER_RESPONSEHEADERS] [X-Custom-Header: test only]
```

The Server is running from `hosting.my-server.com`, and Brave is running from `localhost:3000'. Brave passes Origin as `http://localhost:3000/` as it should as its cross-origin. A postman request with NO Origin results in 200 status, but if i add the same Origin header it fails with 403.

I have tried a bunch of different origin header values but none of them seem to work. Im guessing nginx proxy is not sending Origin but rather X-Forwarded-For which Gotify isn't reading. Or my regex is wrong. Surely .* will match anything?

Adding 'Access-Control-Allow-Origin' '*' to nginx only replies to the client with accepted, Gotify still logs 403.

What can i do here?

**Any errors, logs, or other information that might help us identify your problem**

Gotify logs for successful and failed requests:

```
2024-02-07T00:29:49.945130827Z 2024-02-07T00:29:49Z | 200 | 2.456346ms | 1.146.13.223 | POST "/message"
2024-02-07T00:29:50.127354894Z 2024-02-07T00:29:50Z | 200 | 230.165µs | 1.146.13.223 | GET "/static/defaultapp.png"
2024-02-07T00:29:56.480660944Z 2024-02-07T00:29:56Z | 403 | 36.116µs | 1.146.13.223 | POST "/message"
```

Proxy settings for nginx:

```
proxy_pass $upstream;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.