immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 08:41:28 +03:00
Code Issues 27 Packages Projects Releases 10 Wiki Activity

[BUG] Accessing Shared Albums triggers 401 Unauthorized Requests #1131

New Issue
Closed
opened 2026-02-05 00:34:21 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-05 00:34:21 +03:00
Owner
Copy Link

Originally created by @mjasny on GitHub (Jul 21, 2023).

The bug

Hi,

I run a public instance of immich behind a swag nginx reverse proxy that also contains fail2ban. I noticed that the nginx-unauthorized rule of fail2ban is hit frequently when a user that is not logged in accesses a shared album. The fail2ban daemon is scanning the nginx logs and bans the IP for 10 minutes after 5 401 Unauthorized requests.

These 401 requests are also triggered when I access the immich instance directly without swag.
For me this is problematic because each of my users IP is directly banned after viewing 2-4 images and I don't think the webapp should request the following URLs when nobody is logged in.

http://immich-host/api/user/me -> 401 Unauthorized
http://immich-host/api/album?assetId=3effbaa-4fb5-40aa-84f8-ef3b546546428 -> 401 Unauthorized
http://immich-host/api/asset/assetById/626fff34-5a41-4cb4-8875-1ec68745948a5 -> 401 Unauthorized

Thank you :)

The OS that Immich Server is running on

Debian

Version of Immich Server

v1.68.0

Version of Immich Mobile App

v1.68.0

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

unaltered from default setup

Your .env content

unaltered from default setup

Reproduction steps

1. Create a shared album
2. Open its link in an incognito browser window
3. Go to developer tools and inspect network requests, for Firefox you can use this filter: `status-code:401`
4. see 401 Unauthorized requests popping up, that ultimately lead fail2ban to ban the requesting IP

Additional information

No response

Originally created by @mjasny on GitHub (Jul 21, 2023). ### The bug Hi, I run a public instance of immich behind a swag nginx reverse proxy that also contains fail2ban. I noticed that the nginx-unauthorized rule of fail2ban is hit frequently when a user that is not logged in accesses a shared album. The fail2ban daemon is scanning the nginx logs and bans the IP for 10 minutes after 5 401 Unauthorized requests. These 401 requests are also triggered when I access the immich instance directly without swag. For me this is problematic because each of my users IP is directly banned after viewing 2-4 images and I don't think the webapp should request the following URLs when nobody is logged in. ``` http://immich-host/api/user/me -> 401 Unauthorized http://immich-host/api/album?assetId=3effbaa-4fb5-40aa-84f8-ef3b546546428 -> 401 Unauthorized http://immich-host/api/asset/assetById/626fff34-5a41-4cb4-8875-1ec68745948a5 -> 401 Unauthorized ``` Thank you :) ### The OS that Immich Server is running on Debian ### Version of Immich Server v1.68.0 ### Version of Immich Mobile App v1.68.0 ### Platform with the issue - [X] Server - [X] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML unaltered from default setup ``` ### Your .env content ```Shell unaltered from default setup ``` ### Reproduction steps ```bash 1. Create a shared album 2. Open its link in an incognito browser window 3. Go to developer tools and inspect network requests, for Firefox you can use this filter: `status-code:401` 4. see 401 Unauthorized requests popping up, that ultimately lead fail2ban to ban the requesting IP ``` ### Additional information _No response_
OVERLORD added the 🗄️server🖥️web labels 2026-02-05 00:34:22 +03:00
OVERLORD commented 2026-02-05 00:34:27 +03:00
Author
Owner
Copy Link

@LasseThostrup commented on GitHub (Jul 21, 2023):

I experience the same behavior for shared albums and fail2ban.

@LasseThostrup commented on GitHub (Jul 21, 2023): I experience the same behavior for shared albums and fail2ban.
OVERLORD commented 2026-02-05 00:34:33 +03:00
Author
Owner
Copy Link

@toekel commented on GitHub (Nov 24, 2025):

I started to see this problem (again)

Reproducing:

  1. Create a shared album
  2. Open its link in an incognito browser window
  3. Go to developer tools and inspect network requests, for Firefox you can use this filter: status-code:401
  4. see 401 Unauthorized requests popping up, that ultimately lead fail2ban to ban the requesting IP

GET https://immich.domain/api/assets/98a06fd5-6301-43ca-8ed0-ab682e233857/ocr -> 401 Unauthorized

@toekel commented on GitHub (Nov 24, 2025): I started to see this problem (again) Reproducing: 1. Create a shared album 2. Open its link in an incognito browser window 3. Go to developer tools and inspect network requests, for Firefox you can use this filter: `status-code:401` 4. see 401 Unauthorized requests popping up, that ultimately lead fail2ban to ban the requesting IP `GET https://immich.domain/api/assets/98a06fd5-6301-43ca-8ed0-ab682e233857/ocr` -> 401 Unauthorized
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label 🖥️web 🗄️server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1131
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?