From a239cece10bbeca5e0a0b9daaad677dfd122026c Mon Sep 17 00:00:00 2001 From: dtoro Date: Sat, 4 Jul 2026 13:30:33 +0200 Subject: [PATCH] fix(sidecar): stop blocking Authentik OIDC login on the scoped proxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scoped /api/v1 proxy let unauthenticated traffic through for a guessed "oauth/" path prefix, but PhotoPrism's actual OIDC routes are /api/v1/oidc/login and /api/v1/oidc/redirect. The Authentik callback (oidc/redirect) has no session token yet — it IS what establishes one — so it fell through to the authenticated branch and got rejected with 401 "invalid session" before the session existed. Since the sidecar registers /api/v1/*rest as the catch-all for all PhotoPrism API traffic, this broke SSO login entirely. Co-Authored-By: Claude Sonnet 5 --- sidecar/handlers_ppproxy.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sidecar/handlers_ppproxy.go b/sidecar/handlers_ppproxy.go index 22377de..93cfe13 100644 --- a/sidecar/handlers_ppproxy.go +++ b/sidecar/handlers_ppproxy.go @@ -260,10 +260,15 @@ func handlePPProxy(cfg *Config, ppDb *gorm.DB) gin.HandlerFunc { c.Request.URL.RawPath = "" method := c.Request.Method - // Unauthenticated / token-in-URL surface: login+logout, client - // config, hash-addressed media, websocket. + // Unauthenticated / token-in-URL surface: login+logout, OIDC + // login+callback (PhotoPrism's actual routes are /api/v1/oidc/login + // and /api/v1/oidc/redirect — "oauth/" was never a real PhotoPrism + // path and left the Authentik callback with no valid token yet + // falling through to the authenticated branch below, producing a + // 401 "invalid session" before the session was even established), + // client config, hash-addressed media, websocket. passUnscoped := rest == "session" || strings.HasPrefix(rest, "session/") || - strings.HasPrefix(rest, "oauth/") || + strings.HasPrefix(rest, "oidc/") || rest == "config" || rest == "ws" || strings.HasPrefix(rest, "t/") || strings.HasPrefix(rest, "dl/") ||