-
-
Notifications
You must be signed in to change notification settings - Fork 53
Description
Describe the bug:
When using Cyrillic (or other non-ASCII) characters in the User Profile Name field, authentication via ProxyAuth fails, causing the application to crash with an Invalid character in header content error.
However, OIDC authentication works perfectly fine with the same Cyrillic name. The issue seems isolated to ProxyAuth, likely because it attempts to inject the raw Name string into the Remote-Name HTTP header, which Node.js rejects if it contains non-ASCII characters.
To Reproduce:
- Go to Settings -> Profile.
- Change the Name field to a string containing Cyrillic characters (e.g., Дима or Администратор).
- Save the profile.
- Attempt to access a service configured to use ProxyAuth (Forward Auth).
- Observe the "Internal Server Error" in the browser and the crash in the container logs.
Expected behavior:
The application should handle non-ASCII characters in ProxyAuth headers correctly. The value for the Remote-Name header should be encoded (e.g., URL-encoded/percent-encoded) or sanitized before being set, as the Node.js HTTP implementation strictly prohibits non-ASCII characters in headers.
Database Driver:
postgres:16-alpine
Screenshots:
Additional context:
Logs:
voidauth-1 | Connected to postgres database.
voidauth-1 | Listening on port: 3000
voidauth-1 | (node:1) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
voidauth-1 | (Use `node --trace-deprecation ...` to show where the warning was created)
voidauth-1 | Invalid character in header content ["Remote-Name"]
voidauth-1 | Invalid character in header content ["Remote-Name"]
voidauth-1 | Invalid character in header content ["Remote-Name"]
voidauth-1 | Invalid character in header content ["Remote-Name"]
voidauth-1 | Invalid character in header content ["Remote-Name"]