immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-16 05:34:30 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

[BETA] Beta Timeline not honoring basic auth URL Scheme (Android) #7072

New Issue
Closed
opened 2026-02-05 12:45:35 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 12:45:35 +03:00
Owner
Copy Link

Originally created by @poomwong on GitHub (Sep 2, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

Background

I am currently hosting Immich thru an NGINX Reverse Proxy with Basic Auth as a secondary security gate. However, since enabling the BETA Timeline, Immich on Android (1.140.1) the background upload and/or manual upload/download doesnt work thru the reverse proxy.

It seems that the endpoint POST|GET /api/assets is not honoring the Basic Authentication Scheme

https://USERNAME:PASSWORD@domainname.com

The scheme is set thru the application per usual and i can login and browse my images. However, the app cannot upload nor download any images. Application logs do not show any errors. However, setting the log to level to VeryFine, i got the following INFO log

TaskId 1000030128 failed, waiting 2 seconds before retrying. 2 retries remaining

The application is not even throwing a 401 error.

Below is the access log from my NGINX. As you can see, there are HTTP 401 errors. However, on the other API endpoint methods (GET), it is working fine. I can access the pictures and the application's functionality per normal.

Generating thumbnails using GET /api/assets is also working as intended.

This is the upload endpoint (POST) /api/assets
REDACTED - xxx [02/Sep/2025:18:39:58 +0700] "GET /api/server/ping HTTP/1.1" 200 14 "-" "Immich_Android_1.140.1"
REDACTED - xxx [02/Sep/2025:18:39:59 +0700] "POST /api/sync/stream HTTP/1.1" 200 5 "-" "Dart/3.8 (dart:io)"
REDACTED - - [02/Sep/2025:18:40:03 +0700] "POST /api/assets HTTP/1.1" 401 188 "-" "Dalvik/2.1.0 (Linux; U; Android 15; SM-A556 Build/AP3A.240905.015.A2)"

This is the picture download
REDACTED - - [02/Sep/2025:18:54:09 +0700] "GET /api/assets/fc47fbd8-0b7c-40e3-9795-f2e4bb9e7c75/original HTTP/1.1" 401 188 "-" "Dalvik/2.1.0 (Linux; U; Android 15; SM-A556 Build/AP3A.240905.015.A2)"

The app upload and download functionality works fine on the old timeline and/or when i disable my NGINX basic auth (i dont want to do this)

It seems that the application (BETA Timeline) is not honoring the basic auth scheme for those with basic auth

The OS that Immich Server is running on

Ubuntu 24.04.3 LTS

Version of Immich Server

v1.140.1

Version of Immich Mobile App

v1.140.1 build.3011

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

Samsung A-55 5G (SM-A556)

Your docker-compose.yml content

#
# WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the stackstack.env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - stack.env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - stack.env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.3.0-pgvectors0.2.0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the stack.env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data

    restart: always

volumes:
  model-cache:

Your .env content

UPLOAD_LOCATION=/mnt/hgfs/Immich
DB_DATA_LOCATION=/home/REDACTED/Documents/Immich
IMMICH_VERSION=release
DB_PASSWORD=REDACTED
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

Reproduction steps

  1. Host Immich behind a NGINX Reverse Proxy with Basic Auth
  2. Start the app, use the scheme https://USERNAME:PASSWORD@domainname.com
  3. With Beta Timeline enabled, take a picture or choose a picture to download.
  4. The image will fail to upload/download with no error logs. For upload, it will be stuck in the queue.

...

Relevant log output

Additional information

No response

Originally created by @poomwong on GitHub (Sep 2, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug # Background I am currently hosting Immich thru an NGINX Reverse Proxy with Basic Auth as a secondary security gate. However, since enabling the BETA Timeline, Immich on Android (1.140.1) the background upload and/or manual upload/download doesnt work thru the reverse proxy. It seems that the endpoint POST|GET /api/assets is not honoring the Basic Authentication Scheme `https://USERNAME:PASSWORD@domainname.com` The scheme is set thru the application per usual and i can login and browse my images. However, the app cannot upload nor download any images. Application logs do not show any errors. However, setting the log to level to VeryFine, i got the following INFO log `TaskId 1000030128 failed, waiting 2 seconds before retrying. 2 retries remaining` The application is not even throwing a 401 error. Below is the access log from my NGINX. As you can see, there are HTTP 401 errors. However, on the other API endpoint methods (GET), it is working fine. I can access the pictures and the application's functionality per normal. **Generating thumbnails using GET /api/assets is also working as intended.** **This is the upload endpoint (POST) /api/assets** `REDACTED - xxx [02/Sep/2025:18:39:58 +0700] "GET /api/server/ping HTTP/1.1" 200 14 "-" "Immich_Android_1.140.1"` `REDACTED - xxx [02/Sep/2025:18:39:59 +0700] "POST /api/sync/stream HTTP/1.1" 200 5 "-" "Dart/3.8 (dart:io)"` `REDACTED - - [02/Sep/2025:18:40:03 +0700] "POST /api/assets HTTP/1.1" 401 188 "-" "Dalvik/2.1.0 (Linux; U; Android 15; SM-A556 Build/AP3A.240905.015.A2)"` **This is the picture download** `REDACTED - - [02/Sep/2025:18:54:09 +0700] "GET /api/assets/fc47fbd8-0b7c-40e3-9795-f2e4bb9e7c75/original HTTP/1.1" 401 188 "-" "Dalvik/2.1.0 (Linux; U; Android 15; SM-A556 Build/AP3A.240905.015.A2)"` The app upload and download functionality works fine on the old timeline and/or when i disable my NGINX basic auth (i dont want to do this) It seems that the application (BETA Timeline) is not honoring the basic auth scheme for those with basic auth ### The OS that Immich Server is running on Ubuntu 24.04.3 LTS ### Version of Immich Server v1.140.1 ### Version of Immich Mobile App v1.140.1 build.3011 ### Platform with the issue - [ ] Server - [ ] Web - [x] Mobile ### Device make and model Samsung A-55 5G (SM-A556) ### Your docker-compose.yml content ```YAML # # WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose # # Make sure to use the docker-compose.yml of the current release: # # https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml # # The compose file on main may not be compatible with the latest release. name: immich services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} # extends: # file: hwaccel.transcoding.yml # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding volumes: # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the stackstack.env file - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro env_file: - stack.env ports: - '2283:2283' depends_on: - redis - database restart: always healthcheck: disable: false immich-machine-learning: container_name: immich_machine_learning # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag. # Example tag: ${IMMICH_VERSION:-release}-cuda image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration # file: hwaccel.ml.yml # service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable volumes: - model-cache:/cache env_file: - stack.env restart: always healthcheck: disable: false redis: container_name: immich_redis image: docker.io/redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8 healthcheck: test: redis-cli ping || exit 1 restart: always database: container_name: immich_postgres image: ghcr.io/immich-app/postgres:14-vectorchord0.3.0-pgvectors0.2.0 environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} POSTGRES_INITDB_ARGS: '--data-checksums' # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs DB_STORAGE_TYPE: 'HDD' volumes: # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the stack.env file - ${DB_DATA_LOCATION}:/var/lib/postgresql/data restart: always volumes: model-cache: ``` ### Your .env content ```Shell UPLOAD_LOCATION=/mnt/hgfs/Immich DB_DATA_LOCATION=/home/REDACTED/Documents/Immich IMMICH_VERSION=release DB_PASSWORD=REDACTED DB_USERNAME=postgres DB_DATABASE_NAME=immich ``` ### Reproduction steps 1. Host Immich behind a NGINX Reverse Proxy with Basic Auth 2. Start the app, use the scheme `https://USERNAME:PASSWORD@domainname.com` 3. With Beta Timeline enabled, take a picture or choose a picture to download. 4. The image will fail to upload/download with no error logs. For upload, it will be stuck in the queue. ... ### Relevant log output ```shell ``` ### Additional information _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#7072
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?