Fix: Extend Basic Auth compatibility with browsers #1698 #578

New Issue

MrUnknownDE · 2026-04-05T17:22:45+02:00

MrUnknownDE commented

2026-04-05 17:22:45 +02:00

Originally created by @jln-brtn on 12/1/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

This PR is related to the issue #1698
TL;DR : The current implementation only works with clients that include the Authorization header in the first request (like curl or Postman). Web Browser and Jellyfin don't, redirecting users to the pangolin login page.

I added an extended compatibility switch. Activating this feature will force a challenge during the verification process by sending a 401 response.

How to test?

Navigate to the management UI and edit a resource.
Enable the new "Header Authentication" option.
Enter a desired username, password, enable extended compatibility and save the configuration.
Send a request to the resource's URL using cURL with the correct credentials: curl -u "username:password" https://play.example.com. The request should be successful (e.g., HTTP 200 OK) and the resource content should be returned.
Send a request with incorrect credentials: curl -u "username:wrongpassword" https://play.example.com. The request should be redirected to the standard pangolin login page.
Send a request without credentials from a new browser session. The request should be redirected to the traditional pangolin login.
Send a request with credentials from a new browser session (http://user:password@my.example.com). The request should be successful (e.g., HTTP 200 OK) and the resource content should be returned.
Remove the "Header Authentication" option and send a request with the correct credentials. The request should be redirected to the traditional Pangolin login.

Note

This code requires a modification to Badger. It was submitted as pull request #16.

*Originally created by @jln-brtn on 12/1/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description This PR is related to the issue #1698 TL;DR : The current implementation only works with clients that include the Authorization header in the first request (like curl or Postman). Web Browser and Jellyfin don't, redirecting users to the pangolin login page. <img width="1899" height="1333" alt="image" src="https://github.com/user-attachments/assets/b0b11ff1-c9d5-4ab2-80dc-89a30199f82f" /> I added an extended compatibility switch. Activating this feature will force a challenge during the verification process by sending a 401 response. ## How to test? 1. Navigate to the management UI and edit a resource. 2. Enable the new "Header Authentication" option. 3. Enter a desired username, password, enable extended compatibility and save the configuration. 4. Send a request to the resource's URL using cURL with the correct credentials: curl -u "username:password" https://play.example.com. The request should be successful (e.g., HTTP 200 OK) and the resource content should be returned. 5. Send a request with incorrect credentials: curl -u "username:wrongpassword" https://play.example.com. The request should be redirected to the standard pangolin login page. 6. Send a request without credentials from a new browser session. The request should be redirected to the traditional pangolin login. 7. Send a request with credentials from a new browser session (http://user:password@my.example.com). The request should be successful (e.g., HTTP 200 OK) and the resource content should be returned. 8. Remove the "Header Authentication" option and send a request with the correct credentials. The request should be redirected to the traditional Pangolin login. ## Note This code requires a modification to Badger. It was submitted as [pull request #16](https://github.com/fosrl/badger/pull/16).

MrUnknownDE closed this issue

2026-04-05 17:22:46 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#578