Redirect does not work

[riwich]

Great piece of software and exactly what I've been looking for! Thanks for that!

But, I'm doing something totally wrong.
I have installed Tinyauth and am using the NGINX Proxy Manager.
My Docker Compose for Tinyauth looks like this:

  tinyauth:
    container_name: tinyauth
    restart: unless-stopped
    networks:
      - mynet
    environment:
      - PORT=3000
      - ADDRESS=0.0.0.0
      - SECRET=my-very-secret-string
      - APP_URL=https://auth.mydomain.com
      - USERS_FILE=users_file
      - DISABLE_CONTINUE=false
      - SESSION_EXPIRY=86400 # 24h
      - APP_TITLE=══╣ Login ╠══
      - LOGIN_MAX_RETRIES=5
      - LOGIN_TIMEOUT=300
      - COOKIE_SECURE=false
    volumes:
      - ./tinyauth/users_file:/tinyauth/users_file
    image: ghcr.io/steveiliop56/tinyauth

I have set up Tinyauth in the NGINX Proxy Manager according to the instructions (yes, ‘block common exploits’ is switched off) and Tinyauth itself is running perfectly. The "redirect_uri" is correct and point to my application.

If I now integrate an application as described in the NGINX Proxy Manager under ‘Advanced’, I can't get Tinyauth to redirect to my application, I always end up on the ‘Logout page’.

The configuration in the NGINX Proxy Manager for my application under ‘Advanced’ looks like this:

# Root location
location / {
  # Pass the request to the app
  proxy_pass          $forward_scheme://$server:$port;

  # Add other app specific config here

  # Tinyauth auth request
  auth_request /tinyauth;
  error_page 401 = @tinyauth_login;
}

# Tinyauth auth request
location /tinyauth {
  # Pass request to tinyauth
  proxy_pass http://tinyauth:3000/api/auth/nginx;

  # Pass the request headers
  proxy_set_header x-forwarded-proto $scheme;
  proxy_set_header x-forwarded-host $http_host;
  proxy_set_header x-forwarded-uri $request_uri;
}

# Tinyauth login redirect
location @tinyauth_login {
  return 302 https://auth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri; # Make sure to replace the http://tinyauth.example.com with your own app URL
}

Where is my error?
Thanks for any help!
Thomas

[steveiliop56]

Hello!

When you open an app that has the advanced tinyauth config you are redirected to tinyauth right? Then in tinyauth your URL bar should have the parameter redirect_uri pointing to your original application. So if you tried to go to https://app.example.com your tinyauth URL should be https://tinyauth.example.com/?redirect_uri=https://app.example.com (assuming everything is working right). What redirect uri do you get?

[ivanlinares]

Hi Steve! I get as you mention the correct redirection to tinyauth login page, and when I authenticate I get redirected to the internal IP of my app, not the actual https://app.example.com domain, what I'm doing wrong? Thank You!

[steveiliop56]

Hello! Not sure if this is an issue with Tinyauth or your app. If the redirect URI is correct then Tinyauth should redirect to it. Some apps have some sort of APP_URL variable (like Tinyauth) that they use as the base domain so, also make sure that your app is configured correctly.

[riwich]

It works exactly as you describe, I call up the URL of my app and it first comes up with Tinyauth for login. In the address bar is always exactly the right ‘redirect_uri’ to my app.
What I have to say, Tinyauth and my app have different domains, does that have an effect?

[steveiliop56]

What do you mean by different domains? Tinyauth should be under the same "parent" domain as your apps. For example if your app is in app.example.con tinyauth should be under tinyauth.example.com. You cannot have tinyauth in tinyauth.domain1.com and your app in app.domain2.com since with this setup tinyauth cannot set the cookie so you won't be able to login.

[riwich]

Please excuse my late reply, I had some social interactions and my computer was down.

What you write about different domains and cookie is probably the cause of my problem! I'll reconfigure it tonight so that the app and Tinyauth run on the identical domain.
I'll then report on the success or ‘non-success’.

Thank you very much!

[riwich]

Ahh, I couldn't wait until the evening and checked it out! SUCCESS!
Yes, the domain of the Tinyauth instance and that of the app must be the same, then it works perfectly!
Problem solved, my mistake, I should have read the documentation better...

Thank you very much for the tip, and of course for the great software!

[steveiliop56]

Happy it worked!

[itamar82]

hello, I have a similar issue but I seem to have everything configured on the same domain. I can't figure out what's going on.

assume my domain is local.example.com

I have another separate service at mail.local.example.com using tinyauth middleware and it redirects to tinyauth and I just get the logout screen.

when I try to add tinyauth middleware to the traefik dashboard route the same behavior occurs.

services:

  tinyauth:
    container_name: tinyauth
    image: ghcr.io/steveiliop56/tinyauth:v3.5.0
    restart: unless-stopped
    env_file:
      # Load the environment variables from the .env file
      - .env
    environment:
      - APP_URL=https://tinyauth.${DOMAIN?Variable not set}
      - OAUTH_AUTO_REDIRECT=google
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - traefik.enable=true
      - traefik.constraint-label=traefik-public
      - traefik.docker.network=traefik-public
      - traefik.http.routers.tinyauth.rule=Host(`tinyauth.${DOMAIN?Variable not set}`)
      - traefik.http.routers.tinyauth.entrypoints=https
      - traefik.http.routers.tinyauth.tls=true
      - traefik.http.routers.tinyauth.tls.certresolver=le
      - traefik.http.services.tinyauth.loadbalancer.server.port=3000
      - traefik.http.middlewares.tinyauth.forwardauth.address=http://tinyauth:3000/api/auth/traefik
      - traefik.http.middlewares.tinyauth.forwardauth.trustForwardHeader=true
  
    networks:
      - traefik-public
    

  traefik:
    image: traefik:3.0
    ports:
      # Listen on port 80, default for HTTP, necessary to redirect to HTTPS
      - 80:80
      # Listen on port 443, default for HTTPS
      - 443:443
    restart: always
    env_file:
      # Load the environment variables from the .env file
      - .env
    labels:
      # Enable Traefik for this service, to make it available in the public network
      - traefik.enable=true
      # Use the traefik-public network (declared below)
      - traefik.docker.network=traefik-public
      # Define the port inside of the Docker service to use
      - traefik.http.services.traefik-dashboard.loadbalancer.server.port=8080
      # Make Traefik use this domain (from an environment variable) in HTTP
      - traefik.http.routers.traefik-dashboard-http.entrypoints=http
      - traefik.http.routers.traefik-dashboard-http.rule=Host(`traefik.${DOMAIN?Variable not set}`)
      # traefik-https the actual router using HTTPS
      - traefik.http.routers.traefik-dashboard-https.entrypoints=https
      - traefik.http.routers.traefik-dashboard-https.rule=Host(`traefik.${DOMAIN?Variable not set}`)
      - traefik.http.routers.traefik-dashboard-https.tls=true
      # Use the "le" (Let's Encrypt) resolver created below
      - traefik.http.routers.traefik-dashboard-https.tls.certresolver=le
      # Use the special Traefik service api@internal with the web UI/Dashboard
      - traefik.http.routers.traefik-dashboard-https.service=api@internal
      # https-redirect middleware to redirect HTTP to HTTPS
      - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
      - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
      # traefik-http set up only to use the middleware to redirect to https
      - traefik.http.routers.traefik-dashboard-http.middlewares=https-redirect
      # Using the environment variables USERNAME and HASHED_PASSWORD
      - traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME?Variable not set}:${HASHED_PASSWORD?Variable not set}                  
      # Enable tinyauth, using the middleware created above
      - traefik.http.routers.traefik-dashboard-https.middlewares=admin-auth
    volumes:
      # Add Docker as a mounted volume, so that Traefik can read the labels of other services
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Mount the volume to store the certificates
      - traefik-public-certificates:/certificates
    command:
      # Enable Docker in Traefik, so that it reads labels from Docker services
      - --providers.docker
      # Do not expose all Docker services, only the ones explicitly exposed
      - --providers.docker.exposedbydefault=false
      # Create an entrypoint "http" listening on port 80
      - --entrypoints.http.address=:80
      # Create an entrypoint "https" listening on port 443
      - --entrypoints.https.address=:443
      # Create the certificate resolver "le" for Let's Encrypt, uses the environment variable EMAIL
      - --certificatesresolvers.le.acme.email=${EMAIL?Variable not set}
      # Store the Let's Encrypt certificates in the mounted volume
      - --certificatesresolvers.le.acme.storage=/certificates/acme.json
      # Use the TLS Challenge for Let's Encrypt
      - --certificatesresolvers.le.acme.tlschallenge=true
      # Enable the access log, with HTTP requests
      - --accesslog
      # Enable the Traefik log, for configurations and errors
      - --log
      # Enable the Dashboard and API
      - --api
      
    networks:
      # Use the public network created to be shared between Traefik and
      # any other service that needs to be publicly available with HTTPS
      - traefik-public

volumes:
  # Create a volume to store the certificates, even if the container is recreated
  traefik-public-certificates:

networks:
  # Use the previously created public network "traefik-public", shared with other
  # services that need to be publicly available via this Traefik
  traefik-public:
    external: true

[itamar82]

domain value is .local.example.com

[steveiliop56]

Alright so the setup is correct. I am thinking it may be cache so can you try logging in to Tinyauth and going to your application in a Private window/Incognito window?

[itamar82]

ahh that did it, opened in safari and worked like a charm! I should have tried that before!!! thanks

[steveiliop56]

Cool! By clearing your cache in your normal window for the last 24 hours you should be good to go.

[itamar82]

deleting the cookie fixed it too in my default chrome browser