immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 26 Packages Projects Releases 10 Wiki Activity

Immich expects a plain JSON object instead of a signed RS256 user info OAuth object #2548

New Issue
Closed
opened 2026-02-05 06:11:32 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 06:11:32 +03:00
Owner
Copy Link

Originally created by @ghost on GitHub (Mar 12, 2024).

Originally assigned to: @jrasm91 on GitHub.

Setup

Authelia. Immich. Both configured to use/expect signing algorithm RS256.

What's broken

Authelia redirects back to Immich after signing in with the user info object. Signed with RS256. Immich does not recognize it and fails with the error below. Basically expecting a plain JSON object.

Current workaround

Disable user info object signing in Authelia. Something interesting here is that even if I instruct Immich to expect RS256 signed info (Signing Algorithm setting in OAuth section) and send it a plain JSON object (through Authelia) it still recognizes it and allows me through. Would that be considered a security issue?

Error message from the docker container

[Nest] 8  - 03/11/2024, 11:30:28 PM   ERROR [SyntaxError: Unexpected token 'e', "eyJhbGciOi"... is not valid JSON
    at JSON.parse (<anonymous>)
    at Client.userinfo (/usr/src/app/node_modules/openid-client/lib/client.js:1291:23)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async AuthService.callback (/usr/src/app/dist/domain/auth/auth.service.js:160:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/immich/controllers/oauth.controller.js:37:38)] Failed to finish oauth

The OS that Immich Server is running on

Linux

Version of Immich Server

v1.98.1

Version of Immich Mobile App

n/a

Platform with the issue

  • Server
  • Web
  • Mobile

Reproduction steps

1. Set up an OAuth client for Immich in Authelia.
2. Set up Client secret, id, URL and other parameters in Immich OAuth settings.
3. Set up user info signing with RS256 in both Authelia and Immich.
4. Once logged in in Authelia and redirected back to Immich, UI error shows up that says "failed to finish oauth"

Additional information

No response

Originally created by @ghost on GitHub (Mar 12, 2024). Originally assigned to: @jrasm91 on GitHub. ## Setup Authelia. Immich. Both configured to use/expect signing algorithm RS256. ## What's broken Authelia redirects back to Immich after signing in with the user info object. Signed with RS256. Immich does not recognize it and fails with the error below. Basically expecting a plain JSON object. ## Current workaround Disable user info object signing in Authelia. Something interesting here is that even if I instruct Immich to expect RS256 signed info (Signing Algorithm setting in OAuth section) and send it a plain JSON object (through Authelia) it still recognizes it and allows me through. Would that be considered a security issue? ## Error message from the docker container ``` [Nest] 8 - 03/11/2024, 11:30:28 PM ERROR [SyntaxError: Unexpected token 'e', "eyJhbGciOi"... is not valid JSON at JSON.parse (<anonymous>) at Client.userinfo (/usr/src/app/node_modules/openid-client/lib/client.js:1291:23) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) at async AuthService.callback (/usr/src/app/dist/domain/auth/auth.service.js:160:25) at async OAuthController.finishOAuth (/usr/src/app/dist/immich/controllers/oauth.controller.js:37:38)] Failed to finish oauth ``` ### The OS that Immich Server is running on Linux ### Version of Immich Server v1.98.1 ### Version of Immich Mobile App n/a ### Platform with the issue - [ ] Server - [X] Web - [ ] Mobile ### Reproduction steps ```bash 1. Set up an OAuth client for Immich in Authelia. 2. Set up Client secret, id, URL and other parameters in Immich OAuth settings. 3. Set up user info signing with RS256 in both Authelia and Immich. 4. Once logged in in Authelia and redirected back to Immich, UI error shows up that says "failed to finish oauth" ``` ### Additional information _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#2548
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?