Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Bug]: ProxyAuth crashes with "Invalid character" on Non-ASCII/Cyrillic Names (OIDC works fine) #262

@dimka511

Description

@dimka511

Describe the bug:

When using Cyrillic (or other non-ASCII) characters in the User Profile Name field, authentication via ProxyAuth fails, causing the application to crash with an Invalid character in header content error.

However, OIDC authentication works perfectly fine with the same Cyrillic name. The issue seems isolated to ProxyAuth, likely because it attempts to inject the raw Name string into the Remote-Name HTTP header, which Node.js rejects if it contains non-ASCII characters.

To Reproduce:

  1. Go to Settings -> Profile.
  2. Change the Name field to a string containing Cyrillic characters (e.g., Дима or Администратор).
  3. Save the profile.
  4. Attempt to access a service configured to use ProxyAuth (Forward Auth).
  5. Observe the "Internal Server Error" in the browser and the crash in the container logs.

Expected behavior:

The application should handle non-ASCII characters in ProxyAuth headers correctly. The value for the Remote-Name header should be encoded (e.g., URL-encoded/percent-encoded) or sanitized before being set, as the Node.js HTTP implementation strictly prohibits non-ASCII characters in headers.

Database Driver:

postgres:16-alpine

Screenshots:

Image

Additional context:

Logs:

voidauth-1     | Connected to postgres database.
voidauth-1     | Listening on port: 3000
voidauth-1     | (node:1) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
voidauth-1     | (Use `node --trace-deprecation ...` to show where the warning was created)
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingready-for-releaseFinished, but waiting for release

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions