immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

Chrome Safe Browsing warning after reload since Immich 2.4.0 (false positive) #8087

New Issue
Closed
opened 2026-02-05 13:31:28 +03:00 by OVERLORD · 5 comments
OVERLORD commented 2026-02-05 13:31:28 +03:00
Owner
Copy Link

Originally created by @pr0xyzer on GitHub (Dec 19, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

Description

After updating to Immich 2.4.0, Chrome shows a “Dangerous Website / Social Engineering” warning only on page reload.

This did not happen before 2.4.0 and appears to be a Chrome Safe Browsing false positive.

Environment
• Immich version: 2.4.0
• Deployment: self-hosted, behind reverse proxy
• SSL: valid (Let’s Encrypt)
• Browser affected: Chrome
• Browser NOT affected: Safari
• Other services on same domain (e.g. Bitwarden): not affected

Behavior
• Initial page load works normally
• Reloading the page triggers the Chrome warning
• No warning appears in Safari
• No warning appears on other services using the same domain, SSL, and proxy

Google Safe Browsing Status

The domain is not flagged by Google:
• Google Transparency Report shows no harmful content
• Status last checked: green / safe

Suspected Cause

Based on the Immich 2.4.0 changelog and behavior:
• Changes to login/auth flow, redirects, or initial API requests
• More aggressive initial requests on reload (SPA behavior)
• Possibly new headers, WebSocket behavior, or auth token handling

This likely triggers Chrome’s heuristic detection for “possible social engineering”, despite the site being legitimate.

Notes
• This appears to be client-side heuristic behavior, not an actual security issue
• Reproducible only after updating to 2.4.0
• Only happens on reload, not first visit

Expected Behavior
• No Safe Browsing warning on reload
• Same behavior as before 2.4.0

The OS that Immich Server is running on

Debian 13

Version of Immich Server

2.4.0

Version of Immich Mobile App

2.4.0

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

No response

Your docker-compose.yml content

version: "3.9"

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:v2
    volumes:
      - /immich:/data
      - /etc/localtime:/etc/localtime:ro
    environment:
      - DB_PASSWORD=postgres
      - DB_USERNAME=postgres
      - DB_DATABASE_NAME=immich
    ports:
      - "2283:2283"
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:v2
    volumes:
      - model-cache:/cache
    environment:
      - DB_PASSWORD=postgres
      - DB_USERNAME=postgres
      - DB_DATABASE_NAME=immich
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_USER=postgres
      - POSTGRES_DB=immich
      - POSTGRES_INITDB_ARGS=--data-checksums
    volumes:
      - /srv/immich/postgres:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always

volumes:
  model-cache:

Your .env content

.

Reproduction steps

...

Relevant log output

Additional information

No response

Originally created by @pr0xyzer on GitHub (Dec 19, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug Description After updating to Immich 2.4.0, Chrome shows a “Dangerous Website / Social Engineering” warning only on page reload. This did not happen before 2.4.0 and appears to be a Chrome Safe Browsing false positive. Environment • Immich version: 2.4.0 • Deployment: self-hosted, behind reverse proxy • SSL: valid (Let’s Encrypt) • Browser affected: Chrome • Browser NOT affected: Safari • Other services on same domain (e.g. Bitwarden): not affected Behavior • Initial page load works normally • Reloading the page triggers the Chrome warning • No warning appears in Safari • No warning appears on other services using the same domain, SSL, and proxy Google Safe Browsing Status The domain is not flagged by Google: • Google Transparency Report shows no harmful content • Status last checked: green / safe Suspected Cause Based on the Immich 2.4.0 changelog and behavior: • Changes to login/auth flow, redirects, or initial API requests • More aggressive initial requests on reload (SPA behavior) • Possibly new headers, WebSocket behavior, or auth token handling This likely triggers Chrome’s heuristic detection for “possible social engineering”, despite the site being legitimate. Notes • This appears to be client-side heuristic behavior, not an actual security issue • Reproducible only after updating to 2.4.0 • Only happens on reload, not first visit Expected Behavior • No Safe Browsing warning on reload • Same behavior as before 2.4.0 ### The OS that Immich Server is running on Debian 13 ### Version of Immich Server 2.4.0 ### Version of Immich Mobile App 2.4.0 ### Platform with the issue - [ ] Server - [x] Web - [ ] Mobile ### Device make and model _No response_ ### Your docker-compose.yml content ```YAML version: "3.9" services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:v2 volumes: - /immich:/data - /etc/localtime:/etc/localtime:ro environment: - DB_PASSWORD=postgres - DB_USERNAME=postgres - DB_DATABASE_NAME=immich ports: - "2283:2283" depends_on: - redis - database restart: always healthcheck: disable: false immich-machine-learning: container_name: immich_machine_learning image: ghcr.io/immich-app/immich-machine-learning:v2 volumes: - model-cache:/cache environment: - DB_PASSWORD=postgres - DB_USERNAME=postgres - DB_DATABASE_NAME=immich restart: always healthcheck: disable: false redis: container_name: immich_redis image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa healthcheck: test: ["CMD", "redis-cli", "ping"] restart: always database: container_name: immich_postgres image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 environment: - POSTGRES_PASSWORD=postgres - POSTGRES_USER=postgres - POSTGRES_DB=immich - POSTGRES_INITDB_ARGS=--data-checksums volumes: - /srv/immich/postgres:/var/lib/postgresql/data shm_size: 128mb restart: always volumes: model-cache: ``` ### Your .env content ```Shell . ``` ### Reproduction steps 1. 2. 3. ... ### Relevant log output ```shell ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 13:31:31 +03:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 19, 2025):

This issue has automatically been closed as it is likely a duplicate. We get a lot of duplicate threads each day, which is why we ask you in the template to confirm that you searched for duplicates before opening one. If you're sure this is not a duplicate, please leave a comment and we will reopen the thread if necessary.

@github-actions[bot] commented on GitHub (Dec 19, 2025): This issue has automatically been closed as it is likely a duplicate. We get a lot of duplicate threads each day, which is why we ask you in the template to confirm that you searched for duplicates before opening one. If you're sure this is not a duplicate, please leave a comment and we will reopen the thread if necessary.
OVERLORD commented 2026-02-05 13:31:33 +03:00
Author
Owner
Copy Link

@pr0xyzer commented on GitHub (Dec 19, 2025):

This is not a duplicate, as the issue is a regression introduced in Immich 2.4.0, only occurs on page reload, and the domain is confirmed clean by Google Safe Browsing.

@pr0xyzer commented on GitHub (Dec 19, 2025): This is not a duplicate, as the issue is a regression introduced in Immich 2.4.0, only occurs on page reload, and the domain is confirmed clean by Google Safe Browsing.
OVERLORD commented 2026-02-05 13:31:34 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Dec 19, 2025):

Do you also get this on https://demo.immich.app?

@bo0tzz commented on GitHub (Dec 19, 2025): Do you also get this on https://demo.immich.app?
OVERLORD commented 2026-02-05 13:31:35 +03:00
Author
Owner
Copy Link

@abhiiously commented on GitHub (Dec 23, 2025):

Just chiming in. I got hit with this too.

@abhiiously commented on GitHub (Dec 23, 2025): Just chiming in. I got hit with this too.
OVERLORD commented 2026-02-05 13:31:37 +03:00
Author
Owner
Copy Link

@roberto2lini commented on GitHub (Jan 22, 2026):

Adding here, just got hit with this too today, I have SSO as primary auth on the latest version - v2.4.1.

@roberto2lini commented on GitHub (Jan 22, 2026): Adding here, just got hit with this too today, I have SSO as primary auth on the latest version - v2.4.1.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#8087
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?