No basic auth for web frontend?

[rucksman]

I am new to Gotify and try to set it up in a docker container behind a reverse proxy (combination of https://hub.docker.com/r/jwilder/nginx-proxy and https://hub.docker.com/r/jrcs/letsencrypt-nginx-proxy-companion). I want to protect the web frontend with basic auth.

The Gotify container comes up fine, the proxy asks for username and password as expected. After entering both I am greeted by the Gotify login screen. When using Web Dev tools in the browser, I can already see the first problem:
GET https://gotify.mydomain.com/manifest.json 401

More obvious problems occur after entering gotify credentials: I cannot log in because the basic auth window is constantly asking for username and password, and no matter how often I enter username and password, the basic auth windows does not go away.

What am I missing here?

Looking into the proxy logs I can see this:
user "admin" was not found in "/etc/nginx/htpasswd/gotify.mydomain.com"

"admin" is of course the username of the gotify user and not the username for basic auth. So why are both usernames mixed up?

[najtin]

Gotify itself uses BasicAuth.

server/auth/authentication.go

Line 100 in 9abe803

if name, pass, ok := ctx.Request.BasicAuth(); ok {

Since you already set a basic auth user and password when you first visit the proxy and you are on the same domain, the same basic-auth credentials of your proxy will be used by gotify. When you then try to log into gotify, you overwrite the basic auth credentials for the proxy, and the proxy wont let your request through and instead asks for your username and password. Thus, you must not use basic auth on your proxy (or have the same credentials as in gotify).

[rucksman]

I see. Additional question: Out of curiosity I already tried to use the same credentials which worked fine for the web frontend. But how would I enter the url into the Android client? I tried https://username:password@gotify.mydomain.com, but this did not work (there was an error message but it was too long to read on my smartphone).

[najtin]

The error message would be very helpful. I recommend to rename the issue to additional layer of basic auth on reverse proxy or something alike.

[rucksman]

Error message is:
Request to 'https://username:password@gotify.mydomain.com/version' failed with status code 401

[jmattheis]

Seems like the http client the android app uses doesn't support defining basic auth with https://username:password@gotify.mydomain.com

I'm closing this as gotify already uses basic auth itself, adding another service before gotify that also handles basic auth probably always leads to some weird errors :P.

[winny-]

Ran into this surprise - I read in the docs gotify sets up the default username and password, therefore should not be exposed to the web. So I decided to set up nginx with basic auth in front. Nginx happily authenticated my basic auth credential, but gotify always kicked me back to the login view.

This took maybe an hour longer than it should have to figure out oh yeah, gotify does something kind of surprising out of the box... uses basic auth... as an application server.

[jmattheis]

Gotify exposes an HTTP API, and I'd say it's common for such APIs to use basic auth.

[winny-]

Maybe the outcome could be to document how web ui authentication happens? I did a quick search, didn't find discussion of using basic auth besides as an "alternative way to authenticate api clients". It is not universal to use basic auth for application servers, so I'm unsure if it's reasonable to assume the user is aware that some use basic auth.

[winny-]

Just curious, how do you all run the initial (passwordless) set up for gotify when using a public internet connection (I'd use basic auth but that conflicts with gotify).

[rucksman]

Just for setup? Well, chances are very slim that somebody else will meet the small moment between starting the gotify container and yourself logging in. So I do not consider this as a problem. And you would certainly notice that.

For productive operation either live with it and take other precautions (fail2ban etc.) or try to put Authelia in front of it. I personally did not test the Authelia option. I have to say that I do not have any problem until now with exposing the Gotify frontend to the internet. Of course fail2ban is banning the bad guys for a lifetime. but surprisingly enough these are not too many.

[SweBarre]

You can also create a random password to be used for the default admin user on database creation.
https://gotify.net/docs/config

[winny-]

You can also create a random password to be used for the default admin user on database creation. https://gotify.net/docs/config

That makes sense, thank you for helping me understand the docs better.

I do not think security through obscurity is a good approach @rucksman but thanks.

Now the next person who google's this will have a solution :).

[evlewt]

Hi. First of all thanks for this great application!

I would really like the Android application to support an additional basic authentication of a reverse proxy.
Most people may not see this as a requirement, but without this possibility you have to rely on the implementation of Gotify. I am not saying this is bad but a lot of CVEs have not been coded intentionally. As Gotify outputs the Version number in the "unsecured" login page it would be very easy to identify vulnerable instances.
Yes, keep your applications up to date. But using an additional authentication layer can prevent even the shortest time of vulnerability.