SSO auth not forwarding headers #824

New Issue

MrUnknownDE · 2026-04-05T17:48:18+02:00

MrUnknownDE commented

2026-04-05 17:48:18 +02:00

Originally created by @proofrock on 10/2/2025

Describe the Bug

Hello!
first of all, thanks for a great tool. I have Pangolin with a few SSO-protected services. The problem is that if I "sniff" the request after SSO login, it doesn't contain the headers stated in the docs.

traefik/whiami gives:

Hostname: 96fed3a0cb1e
IP: 127.0.0.1
IP: ::1
IP: 172.19.0.4
RemoteAddr: 172.19.0.2:49210
GET / HTTP/1.1
Host: echo.[...]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9,en-GB;q=0.8,it-IT;q=0.7,it;q=0.6
Cache-Control: max-age=0
Cookie: [...]
Dnt: 1
Priority: u=0, i
Referer: https://pan.[...]/
Sec-Ch-Ua: "Chromium";v="140", "Not=A?Brand";v="24", "Microsoft Edge";v="140"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 188.218.111.179
X-Forwarded-Host: echo.gercloud.cc
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: d298ac39a445
X-Real-Ip: 188.218.111.179

I am not using a bypass rule; only "Use platform SSO" is active. This happens both with the integrated auth (Badger?) and with PocketID; I know for sure that PocketID gives those information because (FWIW) until yesterday I used Cloudflare with the same pocketID, and it transmitted the headers (albeit different ones).

I have modified Traefik config to enable geoblock and rate limiting, but it shouldn't be related.

Thanks!

Environment

OS Type & Version: Ubuntu 24.04 + Docker
Pangolin Version: 1.10.3
Gerbil Version: 1.2.1
Traefik Version: v3.5.3
Newt Version: v1.5.1
Olm Version: --

To Reproduce

I just created a SSO-protected Resource that points to traefik/whoami and tested.

Expected Behavior

The one described here: https://docs.digpangolin.com/manage/access-control/forwarded-headers#supported-headers

*Originally created by @proofrock on 10/2/2025* ### Describe the Bug Hello! first of all, thanks for a great tool. I have Pangolin with a few SSO-protected services. The problem is that if I "sniff" the request after SSO login, it doesn't contain the headers stated in the docs. `traefik/whiami` gives: ``` Hostname: 96fed3a0cb1e IP: 127.0.0.1 IP: ::1 IP: 172.19.0.4 RemoteAddr: 172.19.0.2:49210 GET / HTTP/1.1 Host: echo.[...] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9,en-GB;q=0.8,it-IT;q=0.7,it;q=0.6 Cache-Control: max-age=0 Cookie: [...] Dnt: 1 Priority: u=0, i Referer: https://pan.[...]/ Sec-Ch-Ua: "Chromium";v="140", "Not=A?Brand";v="24", "Microsoft Edge";v="140" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-site Sec-Fetch-User: ?1 Upgrade-Insecure-Requests: 1 X-Forwarded-For: 188.218.111.179 X-Forwarded-Host: echo.gercloud.cc X-Forwarded-Port: 443 X-Forwarded-Proto: https X-Forwarded-Server: d298ac39a445 X-Real-Ip: 188.218.111.179 ``` I am not using a bypass rule; only "Use platform SSO" is active. This happens both with the integrated auth (Badger?) and with PocketID; I know for sure that PocketID gives those information because (FWIW) until yesterday I used Cloudflare with the same pocketID, and it transmitted the headers (albeit different ones). I have modified Traefik config to enable geoblock and rate limiting, but it shouldn't be related. Thanks! ### Environment - OS Type & Version: Ubuntu 24.04 + Docker - Pangolin Version: 1.10.3 - Gerbil Version: 1.2.1 - Traefik Version: v3.5.3 - Newt Version: v1.5.1 - Olm Version: -- ### To Reproduce I just created a SSO-protected Resource that points to `traefik/whoami` and tested. ### Expected Behavior The one described here: https://docs.digpangolin.com/manage/access-control/forwarded-headers#supported-headers

MrUnknownDE closed this issue

2026-04-05 17:48:18 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 17:48:21 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#824