BUG report - PASSWORD PROTECTED FILES NOT WORKING

[infokonto-cmd]

netcup vserver 8GB RAM, 250 GB ssd, 4 cores
debian 13
Kernel Version: 6.12.57+deb13-amd64
static public ipv4+ipv6
NPM nginx-reverse-proxy v2.13.5
docker Version: 29.1.1
FQDN for NPM
FQDN for palmr
FQDN for storage
Storage is outside of the container (i.a. /mnt/vda1/pl)

Last running full functional version in above mentioned environment for palmr is v3.2.4-beta. Uploads, downloads, sharing - all full functional.

Any version later breaks sharing (downloading) and preview for files.

From the logs what I can tell is that aws complaining about a man-in-the-middle... IMVHO this is between the traffic of two FQDN, the host and the docker networks.

To solve this is beyond my knowledge. Maybe it helps anyway.

General question: why moving to a dependency with/for a privat cloud envolving amazon?

[infokonto-cmd]

Tried the newest update.

Protected sharing of files is still not working behind a npm (nginx reverse-proxy). Upload and preview seems to be o.k.

Here's my 3.2.4 docker-compose.yml, full working with file sharing:

services:
palmr:
image: kyantech/palmr:v3.2.4-beta
container_name: palmr
environment:
# Optional: Uncomment and configure as needed (if you don`t use, you can remove)
# - ENABLE_S3=true # Set to true to enable S3-compatible storage (OPTIONAL - default is false)
# - S3_REJECT_UNAUTHORIZED=false # Set to false to allow self-signed certificates (OPTIONAL - default is true)
- DISABLE_FILESYSTEM_ENCRYPTION=false # Set to false to enable file encryption (ENCRYPTION_KEY becomes required) | (OPTIONAL - default is true)
- ENCRYPTION_KEY=ABCDEFG..... # CHANGE THIS KEY FOR SECURITY (REQUIRED if DISABLE_FILESYSTEM_ENCRYPTION is false)
# - PALMR_UID=1000 # UID for the container processes (OPTIONAL - default is 1000) | See our UID/GID Documentation for more information
# - PALMR_GID=1000 # GID for the container processes (OPTIONAL - default is 1000) | See our UID/GID Documentation for more information
- DEFAULT_LANGUAGE=de-DE # Default language for the application (optional, defaults to en-US) | See the docs for see all supported languages
- PRESIGNED_URL_EXPIRATION=3600 # Duration in seconds for presigned URL expiration (OPTIONAL - default is 3600 seconds / 1 hour)
- SECURE_SITE=true # Set to true if you are using a reverse proxy (OPTIONAL - default is false)
# Download Memory Management Configuration (OPTIONAL - See documentation for details)
# - DOWNLOAD_MAX_CONCURRENT=10 # Maximum number of simultaneous downloads (OPTIONAL - auto-scales based on system memory if not set)
# - DOWNLOAD_MEMORY_THRESHOLD_MB=2048 # Memory threshold in MB before throttling (OPTIONAL - auto-scales based on system memory if not set)
# - DOWNLOAD_QUEUE_SIZE=5 # Maximum queue size for pending downloads (OPTIONAL - auto-scales based on system memory if not set)
- DOWNLOAD_MIN_FILE_SIZE_GB=1.0 # Minimum file size in GB to activate memory management (OPTIONAL - default is 3.0)
- DOWNLOAD_AUTO_SCALE=true # Enable auto-scaling based on system memory (OPTIONAL - default is true)
- NODE_OPTIONS=--expose-gc # Enable garbage collection for large file downloads (RECOMMENDED for production)
# - NEXT_PUBLIC_UPLOAD_CHUNK_SIZE_MB=50 # Chunk size in MB for large file uploads (OPTIONAL - auto-calculates if not set)
ports:
- "5487:5487" # Web port
# - "3333:3333" # API port (OPTIONAL EXPOSED - ONLY IF YOU WANT TO ACCESS THE API DIRECTLY)
volumes:
# Bind mount for persistent data (uploads, database, temp files)
- /mnt/vda5/palmr:/app/server # Volume for the application data
restart: unless-stopped # Restart the container unless it is stopped

Here's the docker-compose for the latest update:

services:
palmr:
image: kyantech/palmr:latest
container_name: palmr
environment:
# Optional: Uncomment and configure as needed (if you don`t use, you can remove)
# - ENABLE_S3=true # Set to true to enable S3-compatible storage (OPTIONAL - default is false)
# - S3_REJECT_UNAUTHORIZED=false # Set to false to allow self-signed certificates (OPTIONAL - default is true)
- DISABLE_FILESYSTEM_ENCRYPTION=false # Set to false to enable file encryption (ENCRYPTION_KEY becomes required) | (OPTIONAL - default is true)
- ENCRYPTION_KEY=ABCDEFGH..... # CHANGE THIS KEY FOR SECURITY (REQUIRED if DISABLE_FILESYSTEM_ENCRYPTION is false)
# - PALMR_UID=1000 # UID for the container processes (OPTIONAL - default is 1000) | See our UID/GID Documentation for more information
# - PALMR_GID=1000 # GID for the container processes (OPTIONAL - default is 1000) | See our UID/GID Documentation for more information
- DEFAULT_LANGUAGE=de-DE # Default language for the application (optional, defaults to en-US) | See the docs for see all supported languages
- PRESIGNED_URL_EXPIRATION=3600 # Duration in seconds for presigned URL expiration (OPTIONAL - default is 3600 seconds / 1 hour)
- SECURE_SITE=true # Set to true if you are using a reverse proxy (OPTIONAL - default is false)
- STORAGE_URL=https://my.storage.url # Extremely important
- PALMR_UID=1000
- PALMR_GID=1000
# Download Memory Management Configuration (OPTIONAL - See documentation for details)
# - DOWNLOAD_MAX_CONCURRENT=10 # Maximum number of simultaneous downloads (OPTIONAL - auto-scales based on system memory if not set)
# - DOWNLOAD_MEMORY_THRESHOLD_MB=2048 # Memory threshold in MB before throttling (OPTIONAL - auto-scales based on system memory if not set)
# - DOWNLOAD_QUEUE_SIZE=5 # Maximum queue size for pending downloads (OPTIONAL - auto-scales based on system memory if not set)
# - DOWNLOAD_MIN_FILE_SIZE_GB=1.0 # Minimum file size in GB to activate memory management (OPTIONAL - default is 3.0)
# - DOWNLOAD_AUTO_SCALE=true # Enable auto-scaling based on system memory (OPTIONAL - default is true)
# - NODE_OPTIONS=--expose-gc # Enable garbage collection for large file downloads (RECOMMENDED for production)
# - NEXT_PUBLIC_UPLOAD_CHUNK_SIZE_MB=50 # Chunk size in MB for large file uploads (OPTIONAL - auto-calculates if not set)
ports:
- "5487:5487" # Web port
- "9379:9379" # Internal storage (S3-compatible, REQUIRED for file uploads when using internal storage)
# - "3333:3333" # API port (OPTIONAL EXPOSED - ONLY IF YOU WANT TO ACCESS THE API DIRECTLY)
volumes:
# Bind mount for persistent data (uploads, database, temp files)
- /mnt/vda5/palmr:/app/server # Volume for the application data
restart: unless-stopped # Restart the container unless it is stopped

volumes:
palmr_data:

The storage URL is handled by npm as FQHN to port 9379, SSL forced.

In the end while sharing the file link the logs return a 401 error.

Please advice.

[infokonto-cmd]

Maybe I'm too stupid.

For clarification - could you, for a linux OS, please make clear what is ment with internal storage:

• inside the palmr container?
• on the host, same partition?
• on the host, different partition?
• ???

As it's not possible (to me) to bind to FQDN more than one port, there must be a second FQHN as a storage address, pointing to port 9379. Storage is on the same host, but on another partition. While using a public IP and therefore sitting behind a nginx-reverse-proxy, is this storage internal or external?

Does the port 9379 has to be exposed to the internet? Means - do I have to open the firewall for incoming traffic on this port? Why not using the internal palmr docker-bridge IP with the port 9379, in the case you store files on the same host, for this?

I don't get it...

Thank you for clarification.

[infokonto-cmd]

Little progress...

I added to the docker-compose.yml

• UID=1000 # UID for container processes (optional)
• GID=1000 # GID for container processes (optional)

Last line now:

volumes:
`# Bind mount for persistent data (uploads, database, temp files)

• /mnt/vda5/palmr:/app/server # Volume for the application data
  restart: unless-stopped # Restart the container unless it is stopped
  (END)'

AFAIK all is working pretty well now - except password protected links.

After entering in the generated link, no matter what else I'm trying, this is the error:

message: "Request failed with status code 401"
​name: "AxiosError"

BTW in the developer tools for the generated links no cookie is set. Not when firstly calling the site, and not after typing the passphrase.

[infokonto-cmd]

Additional info:

XHR GET https://my.palmr.de/api/files/download-url?objectName=cmiwen33n0001nz09xwlbx13s/1765463727732-pei28v-VtQM9LhWN6os.mp3 [HTTP/2 401 89ms]

JSON

{"error":"Unauthorized access to file."}

Error downloading file:
Object { message: "Request failed with status code 401", name: "AxiosError", code: "ERR_BAD_REQUEST", config: {…}, request: XMLHttpRequest, response: {…}, status: 401, stack: "", … }
​
code: "ERR_BAD_REQUEST"
​
config: Object { timeout: 120000, xsrfCookieName: "XSRF-TOKEN", xsrfHeaderName: "X-XSRF-TOKEN", … }
​
message: "Request failed with status code 401"
​
name: "AxiosError"
​
request: XMLHttpRequest { readyState: 4, timeout: 120000, withCredentials: true, … }
​
response: Object { data: {…}, status: 401, statusText: "", … }
​
stack: "eL@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:16912\ng@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:21361\nEventHandlerNonNull*34252/eV</<@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:21616\n34252/eV<@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:20968\ne7@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:27964\n_request@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:31098\nrequest@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:29402\n34252/</to.prototype[e]@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:31412\n34252/u/<@https://my.palmr.de/_next/static/chunks/268-79625592b124beb8.js:1:524\nl@https://my.palmr.de/_next/static/chunks/8452-f97494c1e1dc4e0e.js:1:853\ngetCachedDownloadUrl@https://my.palmr.de/_next/static/chunks/7727-4237f47c4fc1ac7e.js:1:1781\nO@https://my.palmr.de/_next/static/chunks/app/(shares)/s/%5Balias%5D/page-9b9cca3003e40f26.js:1:10506\nonClick@https://my.palmr.de/_next/static/chunks/5396-83e980bbe68fe8d7.js:1:15665\niX@https://my.palmr.de/_next/static/chunks/fb8bf863-d60538aaa1d9fbe5.js:1:132400\n38583/i2/<@https://my.palmr.de/_next/static/chunks/fb8bf863-d60538aaa1d9fbe5.js:1:138479\nnS@https://my.palmr.de/_next/static/chunks/fb8bf863-d60538aaa1d9fbe5.js:1:18817\ni2@https://my.palmr.de/_next/static/chunks/fb8bf863-d60538aaa1d9fbe5.js:1:133634\ns7@https://my.palmr.de/_next/static/chunks/fb8bf863-d60538aaa1d9fbe5.js:1:159684\ns5@https://my.palmr.de/_next/static/chunks/fb8bf863-d60538aaa1d9fbe5.js:1:159504\n"
​
status: 401
​
: Object { constructor: z(e, t, r, n, i), toJSON: toJSON()
, stack: "", … }
4123-dde464ceffc887a5.js:1:29734
NextJS 9

[infokonto-cmd]

Additional information:

When uploading a file and creating a password protected link to share, it does work as long as you leave the original login window open. While opening in the same browser a new tab with the password protected link to the shared file, you'll see the same cookie as in the original login/upload tab. With both tabs opened, password protection does work.

If the login/upload tab session is closed, the original cookie will be deleted. Starting over again in a new tab the password protected link will allow to login (entering the password of course), but preview and download are not working. No cookie is beeing created in this session.

[infokonto-cmd]

Follow up:

Checking my proxy-logs while accessing a shared password protected link, the password is transmittet in clear text?

Uhmm, does it have to be in this way?

[infokonto-cmd]

After fiddling aorund for days, I'm not able to find a way to create password protected links - either for uploads, nor for downloads.

All other functions seem to work. Didn't test expiry. Will report.

Would be very helpful to get any idea, what's wrong. To summerize:

• vserver with a public IP
• npm nginx reverse-proxy pointing two FQHN (palmr. and storage) to the docker IP's with port 5487 and 9379
• palmr. configured for internal storage on a mounted partition

Any help or advice is greatly appreciated.

[Runecreed]

Im noticing the exact same behavior you described, it seems like these protected download links are still somewhere checking for a logged in user/auth of some kind, since if you're logged in and reach for the password protected link, the download works just fine.

on v3.3.2-beta that is.

my setup has an nginx reverse proxy pointing to the palmr container port 5487 from source'mysite.com'
The palmer container and the STORAGE_URL is pointing to a subdomain (s3.mysite.com) (same machine, reaching the reverse proxy which routes it to the palmr container port 9379)

if im logged with a cookie all is well, if i use an incognito window with password protected link, filling in the password then reaching the download button, when clicking the download button im met with a 401 unauthorized.

my docker compose

services:
  palmr:
    image: kyantech/palmr:latest
    container_name: palmr
    environment:
      SECURE_SITE: true
      STORAGE_URL: https://s3.mysite.com
      PALMR_UID: 1000
      PALMR_GID: 1000
      S3_FORCE_PATH_STYLE: true
    ports:
      - 9379:9379
      - 5487:5487
      - 3333:3333
    restart: unless-stopped
    networks:
      - nginx
    volumes:
      - ./data:/app/server
networks:
  nginx:
    external: true

I have a separate Let's Encrypt certificate for each (sub)domain, mysite.com and s3.mysite.com

Of note-- If i go to an incognito browser (so no session/cookies/etc) and use the password protected link, as mentioned- the download will fail with a 401 unauthorized. However, if I use the same link and instead go to the home page (clicking the palmr icon), then login- then go to the shared link again, i can get it to download.

Some kind of user session is getting checked here when it probably should not

[infokonto-cmd]

Thank's for hopping on and sharing.

Meanwhile I tried the same setup with caddy. Doesn't work either. Thought could be a nginx problem. Tried also both reverse-proxies - each installed native and as containers. Doesn't make any difference. Password protected links are not working in this setup.

Pretty much sure - it's a bug.

It's beyond my capabilites to solve this. If @kyantech needs additional information and needs a playground, I'd be happy to help.

[azert9]

Hello, I faced the same issue, /api/files/download-url returns a 401 on a password-protected public share.

It appears that the web client is sending the password in a header named x-share-password, but the server expects a query parameter named password. If I do the same request manually and I put the password in the query string instead of the headers I do get a 200.

Seems to have been introduced here : #254

[infokonto-cmd]

@azert9

Thank's for hopping on and pointing in this direction. Unfortunately I'm not a coder or a programmer. Means - I'm not able to fix this.

@kyantech, @danielalves96

Can this be fixed?

[StickieBE]

Hello, I faced the same issue, /api/files/download-url returns a 401 on a password-protected public share.

It appears that the web client is sending the password in a header named x-share-password, but the server expects a query parameter named password. If I do the same request manually and I put the password in the query string instead of the headers I do get a 200.

Seems to have been introduced here : #254

@azert9 seems to be correct.
We managed to work around this issue using custom options on the reverse proxy:

http-request set-var(txn.share_password) req.hdr(x-share-password)
acl has_share_password var(txn.share_password) -m found
acl is_download_url path_beg /api/files/download-url
acl no_password_in_query query -m sub password=
http-request set-query %[query]&password=%[var(txn.share_password)] if has_share_password is_download_url !no_password_in_query

[infokonto-cmd]

@StickieBE

Thx for sharing your solution.

May I ask which reverse proxy you are using? Meanwhile I switched from nginx docker npm to native caddy.

[StickieBE]

@StickieBE

Thx for sharing your solution.

May I ask which reverse proxy you are using? Meanwhile I switched from nginx docker npm to native caddy.

In this case we are using HAproxy, the settings were set on custom acl options in the backend configuration.