"path" matcher fails when method is PROPFIND #420

New Issue

MrUnknownDE · 2026-04-05T17:09:38+02:00

MrUnknownDE commented

2026-04-05 17:09:38 +02:00

Originally created by @thutex on 12/29/2025

Describe the Bug

When using PATH in the rules to bypass authentication, but using a method that is not the most common, such as is the case with webdav (PROPFIND for example - but likely with other methods as well), the bypass will still fail.

i assume somewhere in the path matching there's going to be a check for the method, even though this would not be expected when matching on path ?

workaround: setting a bypass auth on ip instead of path works, but this ofcourse assumes the connection will always be made from the same ip (which in the case of webdav is very unlikely as it's used on the go)

Environment

OS Type & Version: ubuntu 24.04
Pangolin Version: 1.14.1
Gerbil Version: 1.3.0
Traefik Version: 3.6.5

To Reproduce

have a resource serving webdav (in my case using davis)
set up rules
set up a rule which has bypass authentication for the /dav/calendars path for example
try to reach it using a client (such as thunderbird) and see it fail (logs show "no valid auth" with method PROPFIND)

Expected Behavior

to not fail on certain methods, if we're just checking for a path

*Originally created by @thutex on 12/29/2025* ### Describe the Bug When using PATH in the rules to bypass authentication, but using a method that is not the most common, such as is the case with webdav (PROPFIND for example - but likely with other methods as well), the bypass will still fail. i assume somewhere in the path matching there's going to be a check for the method, even though this would not be expected when matching on path ? workaround: setting a bypass auth on ip instead of path works, but this ofcourse assumes the connection will always be made from the same ip (which in the case of webdav is very unlikely as it's used on the go) ### Environment - OS Type & Version: ubuntu 24.04 - Pangolin Version: 1.14.1 - Gerbil Version: 1.3.0 - Traefik Version: 3.6.5 ### To Reproduce - have a resource serving webdav (in my case using davis) - set up rules - set up a rule which has bypass authentication for the /dav/calendars path for example - try to reach it using a client (such as thunderbird) and see it fail (logs show "no valid auth" with method PROPFIND) ### Expected Behavior to not fail on certain methods, if we're just checking for a path

MrUnknownDE closed this issue

2026-04-05 17:09:38 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#420