Enabling resource rules makes authentication ineffective #769

New Issue

MrUnknownDE · 2026-04-05T17:39:37+02:00

MrUnknownDE commented

2026-04-05 17:39:37 +02:00

Originally created by @hussainalhaddad on 10/17/2025

Describe the Bug

Description:
When resource rules are enabled in Pangolin v1.11.0, authentication appears to be bypassed, rendering it ineffective. Users who should be restricted based on authentication credentials are able to access resources and services without any authentication checks being enforced.

Actual Behavior:
Authentication is bypassed when resource rules are enabled, and users can access restricted resources without the proper authentication.

Impact:
This bug significantly impacts the security of the system by allowing unauthorized users to access protected resources, potentially leading to data leaks or unauthorized actions.

Additional Information:

This issue only occurs when resource rules are enabled.

Disabling resource rules restores proper authentication behavior.

Environment

OS Type & Version: Ubuntu 24.04
Pangolin Version: 1.11.0
Gerbil Version:
Traefik Version: 3.5.3
Newt Version: 1.5.2

To Reproduce

1- Enable resource rules for access control, (e.g, Country)

2- Configure authentication for users (e.g., Platform SSO).

3- Attempt to access a resource that should require authentication in incognito mode

4- Observe that users are able to access the resource without being prompted for authentication or authorization.

Expected Behavior

Authentication should still be enforced even when resource rules are enabled, ensuring that only authorized users can access protected resources.

*Originally created by @hussainalhaddad on 10/17/2025* ### Describe the Bug Description: When resource rules are enabled in Pangolin v1.11.0, authentication appears to be bypassed, rendering it ineffective. Users who should be restricted based on authentication credentials are able to access resources and services without any authentication checks being enforced. Actual Behavior: Authentication is bypassed when resource rules are enabled, and users can access restricted resources without the proper authentication. Impact: This bug significantly impacts the security of the system by allowing unauthorized users to access protected resources, potentially leading to data leaks or unauthorized actions. Additional Information: This issue only occurs when resource rules are enabled. Disabling resource rules restores proper authentication behavior. ### Environment - OS Type & Version: Ubuntu 24.04 - Pangolin Version: 1.11.0 - Gerbil Version: - Traefik Version: 3.5.3 - Newt Version: 1.5.2 ### To Reproduce 1- Enable resource rules for access control, (e.g, Country) 2- Configure authentication for users (e.g., Platform SSO). 3- Attempt to access a resource that should require authentication in incognito mode 4- Observe that users are able to access the resource without being prompted for authentication or authorization. ### Expected Behavior Authentication should still be enforced even when resource rules are enabled, ensuring that only authorized users can access protected resources.

MrUnknownDE closed this issue

2026-04-05 17:39:37 +02:00

MrUnknownDE added the help wanted enhancement authentication enhancement enhancement enhancement enhancement enhancement help wanted authentication labels 2026-04-05 17:39:37 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label authentication authentication enhancement enhancement enhancement enhancement enhancement enhancement help wanted help wanted

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#769