mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
URL returned after login may be wrong (rev. proxy and alias used) #1129
Closed
opened 2026-02-04 23:53:27 +03:00 by OVERLORD
·
19 comments
No Branch/Tag Specified
development
l10n_development
further_theme_development
release
llm_only
vectors
v25-11
docker_env
drawio_rendering
user_permissions
ldap_host_failover
svg_image
prosemirror
captcha_example
fix/video-export
v25.12.3
v25.12.2
v25.12.1
v25.12
v25.11.6
v25.11.5
v25.11.4
v24.11.4
v25.11.3
v25.11.2
v25.11.1
v25.11
v25.07.3
v25.07.2
v25.07.1
v25.07
v25.05.2
v25.05.1
v25.05
v25.02.5
v25.02.4
v25.02.3
v25.02.2
v25.02.1
v25.02
v24.12.1
v24.12
v24.10.3
v24.10.2
v24.10.1
v24.10
v24.05.4
v24.05.3
v24.05.2
v24.05.1
v24.05
v24.02.3
v24.02.2
v24.02.1
v24.02
v23.12.3
v23.12.2
v23.12.1
v23.12
v23.10.4
v23.10.3
v23.10.2
v23.10.1
v23.10
v23.08.3
v23.08.2
v23.08.1
v23.08
v23.06.2
v23.06.1
v23.06
v23.05.2
v23.05.1
v23.05
v23.02.3
v23.02.2
v23.02.1
v23.02
v23.01.1
v23.01
v22.11.1
v22.11
v22.10.2
v22.10.1
v22.10
v22.09.1
v22.09
v22.07.3
v22.07.2
v22.07.1
v22.07
v22.06.2
v22.06.1
v22.06
v22.04.2
v22.04.1
v22.04
v22.03.1
v22.03
v22.02.3
v22.02.2
v22.02.1
v22.02
v21.12.5
v21.12.4
v21.12.3
v21.12.2
v21.12.1
v21.12
v21.11.3
v21.11.2
v21.11.1
v21.11
v21.10.3
v21.10.2
v21.10.1
v21.10
v21.08.6
v21.08.5
v21.08.4
v21.08.3
v21.08.2
v21.08.1
v21.08
v21.05.4
v21.05.3
v21.05.2
v21.05.1
v21.05
v21.04.6
v21.04.5
v21.04.4
v21.04.3
v21.04.2
v21.04.1
v21.04
v0.31.8
v0.31.7
v0.31.6
v0.31.5
v0.31.4
v0.31.3
v0.31.2
v0.31.1
v0.31.0
v0.30.7
v0.30.6
v0.30.5
v0.30.4
v0.30.3
v0.30.2
v0.30.1
v0.30.0
v0.29.3
v0.29.2
v0.29.1
v0.29.0
v0.28.3
v0.28.2
v0.28.1
v0.28.0
v0.27.5
v0.27.4
v0.27.3
v0.27.2
v0.27.1
v0.27
v0.26.4
v0.26.3
v0.26.2
v0.26.1
v0.26.0
v0.25.5
v0.25.4
v0.25.3
v0.25.2
v0.25.1
v0.25.0
v0.24.3
v0.24.2
v0.24.1
v0.24.0
v0.23.2
v0.23.1
v0.23.0
v0.22.0
v0.21.0
v0.20.3
v0.20.2
v0.20.1
v0.20.0
v0.19.0
v0.18.5
v0.18.4
v0.18.3
v0.18.2
v0.18.1
v0.18.0
v0.17.4
v0.17.3
v0.17.2
v0.17.1
v0.17.0
v0.16.3
v0.16.2
v0.16.1
v0.16.0
v0.15.3
v0.15.2
v0.15.1
v0.15.0
v0.14.3
v0.14.2
v0.14.1
v0.14.0
v0.13.1
v0.13.0
v0.12.2
v0.12.1
v0.12.0
v0.11.2
v0.11.1
v0.11.0
v0.10.0
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.2
v0.8.1
v0.8.0
v0.7.6
v0.7.5
v0.7.4
v0.7.3
0.7.2
v.0.7.1
v0.7.0
v0.6.3
v0.6.2
v0.6.1
v0.6.0
v0.5.0
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/BookStack#1129
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @MatthieuParis on GitHub (Apr 9, 2019).
Describe the bug
When both using a reverse proxy and hosting BookStack in a subdirectory, the URL that is computed after login may be wrong (and then lead to a non existent page).
The path used after login comes from session()->pull('url.intended', '/'); (in app/Http/Controllers/Auth/LoginController.php). This function returns the URL in the hosting server form, with is usually hidden and not explicitly set in the .env file.
Then the URL to redirect the user to is composed by this absolute path value and the base URL, in the function baseUrl (in app/helper.php). As it is not possible to guess the relative part in the path variable because the hidden base URL is not known, there are cases where this leads to errors.
Steps To Reproduce
Steps to reproduce the behavior:
Expected behavior
I understand that it is usefull to redirect, after login, to the initially requested page. But the method session()->pull('url.intended', '/') reflects the context of the hosting server, which can be quite different from the APP_URL that is declared in the .env file.
I don't know the Laravel framework but it may be possible to extract from the session() object the relative part of the path instead of the absolute path. With just the relative part, the helper function baseUrl should give the expected result.
Screenshots
Your Configuration (please complete the following information):
nginx-hosting.conf.txt
nginx-rev-proxy.conf.txt
Additional context
I would be glad to help in testing a patch. Thanks for your great work.
@ssddanbrown commented on GitHub (May 27, 2019):
Hi @MatthieuParis,
I've just deployed a new update, v0.26.2, that fixes some issues found in the URL redirect logic. It's worth updating to that and seeing if this remains an issue.
Let me know either way.
@MatthieuParis commented on GitHub (May 28, 2019):
Hi @ssddanbrown,
Firstly, thank you again for your great job. I'm enjoying version 0.26 very much.
I just installed a new instance with v.0.26.2 and tried the proxy nginx configuration again. I still encounter the same problem : everything works fine except the redirection to the root of the wiki after the login.
The first nginx server is used to listen on HTTPS and to redirect every "wiki/something" URL to a secundary nginx server, listening on http://localhost:10001, with just the "something" part of the URL. Upon login into bookstack, my browser is redirected to https://fqdn/wiki/something/something which does not exist.
I would like to use such a configuration to host several services on the same host (bookstack, nextcloud...), and several instances of each service identified by their alias (wiki/mine, wiki/theirs, wiki/other, cloud/one, cloud/two...).
I'll try to look into the PHP code but that means reading a few pages of the Laravel framework documentation at first. I'll keep this page updated.
@MatthieuParis commented on GitHub (May 30, 2019):
Hi @ssddanbrown!
I may have found a way to get the correct URL.
When a user is not authenticated, he gets redirected to the login form with the redirect()->guest(...) function. This core Laravel function stores the URL the user was requesting in the session as an absolute URL. But this absolute URL may be quite different from the application URL when BookStack is hosted behind a proxy. In such a case, the function baseUrl(...) may return a wrong URL as it doesn't know the absolute part of the URL used by the service hosting BookStack.
Instead of using the core redirect()->guest(...) function, it is possible to force the intended URL to be recorded in the session as a relative URL and to use the redirect()->to(...) function instead of redirect()->guest(...). With a relative URL, the baseUrl(...) function returns the right URL, based on the application URL declared in the .env file.
The code implied is located in the file app/Http/Middleware/Authenticate.php, in the function handle($request, Closure $next). Here is the code that could be used:
Hope this helps other BookStack users and doesn't generate other problems.
@MatthieuParis commented on GitHub (Jun 2, 2019):
Hi!
The above code doesn't handle URL parameters such as a searched string. The version below should be better:
@ssddanbrown, would you consider this to be worth a pull request?
@MatthieuParis commented on GitHub (Sep 14, 2019):
Hi!
Just tested this behaviour with the 0.27.4 release and I can still reproduce the problem.
The code has changed a little so here are the new lines I use to patch the code of my instances of BookStack :
Hope this helps.
Again, @ssddanbrown, please tell me if this is not the right way to send you code. Thanks you for your work: I enjoy every new release a lot.
@ssddanbrown commented on GitHub (Sep 15, 2019):
Thanks for the update on this @MatthieuParis.
To be honest, I can't quite work out why this is not working for you. The redirect works okay for me on my development machine when reverse proxying from nginx to PHP's built-in server, on a sub-path.
For v0.27 BookStack now uses it's own
Requestclass, extending the default one, to essentially fake the source of a request, forcing theAPP_URLvalue to be used. Theurl.intendedvalue is generated from the request.Would you be able to share your nginx reverse proxy config at all?
@MatthieuParis commented on GitHub (Sep 16, 2019):
Hi @ssddanbrown !
This just happens when the user tries to access a BookStack URL while not identified. The user is then redirected temporarily to the login page and afterwards to a wrong URL, with the subpath appearing twice.
In the 0.26.x version of BookStack, the
url.intendedvalue was set without taking theAPP_URLinto account before the redirection to the login page. That's why I changed the code.I did not look into the code of the 0.27.x version, but I reproduce the bug if I do not patch it.
Here is the configuration of the first nginx reverse proxy:
And the configuration of the second reverse proxy (the one serving BookStack):
And finally, here is an extract of the
.envconfiguration file for the "one" wiki:And for the "two" wiki:
Just to be really clear about all that: BookStark works like a charm and this is certainly not a severe bug. I would be pleased to help for a BookStack version with relative URL all over, as suggested in #1342
Thanks again.
@MatthieuParis commented on GitHub (Sep 29, 2019):
Hi AlphaJack!
Thanks for your help on this bug. I’ve been quite busy the past week and I answer a bit late. Sorry for that.
I’ve just installed a new BookStack instance and set APP_URL=.
Firstly, this does not change the fact that a wrong URL is set after login (the subdirectory part appears twice, such as https://www.example.net/wiki/test/wiki/test https://www.example.net/wiki/test/wiki/test).
Furthermore, with this setting, the CSS files are not always fetched by the browser. For example, it is OK on the homepage but not after a shelf or a book creation.
As a matter of fact, when I look at the source code, I can see that the dot is used in the URLs. I’m not sure ‘./toto’ is strictly the same as ’toto’ for every browser. And the base URL is wrong as it does not contain the subdirectory part ().
Feel free to ask me to test other settings. Thank you again.
Matthieu
@AlphaJack commented on GitHub (Sep 30, 2019):
Unfortunately I discovered that it wasn't working in some locations only after I had asked you to try, as you can see from the edit of my comment here
@philjak commented on GitHub (Oct 25, 2019):
I'm facing the same problem. Bookstack is running here:
http://localhost/BookStack/public
After posting to http://localhost/BookStack/public/login
I get redirected to
http://localhost/BookStack/public/BookStack/public
APP_URL is set to http://localhost/BookStack/public
@MatthieuParis commented on GitHub (Mar 28, 2020):
Hi @philjak and @ssddanbrown!
I finally take time to test the 0.28 version of BookStack (version 0.28.3 to be exact). I'm afraid the URL returned after login is still wrong.
The patch I posted upwards is still needed for me:
Hope that helps!
@ssddanbrown commented on GitHub (Apr 26, 2020):
Hi @MatthieuParis,
Thank you very much for confirming the status and enduring this issue.
Thanks also for offering a pull request. Unfortunately I'm not going to merge it since I'd prefer to fix this at a lower-level, to handle other cases where the system URL is generated from the request.
I would be very grateful if you could try patch described in my comment here, with all other fixes reverted:
https://github.com/BookStackApp/BookStack/issues/2058#issuecomment-619601995
@MatthieuParis commented on GitHub (Apr 29, 2020):
Hi @ssddanbrown,
I just tried the patch you wrote in #2058 with version 0.29.1 and it successfully corrects the bug that is mentioned here :
Thank you very much for both the support you offer to BookStack users and the new features you add to it (permissions, API, usability...). That's really great!
@MatthieuParis commented on GitHub (May 28, 2020):
Just tested the #2058 patch with version 0.29.3: it's still successful. Nice!
@MatthieuParis commented on GitHub (Jan 12, 2021):
Patch #2058 is still needed in 0.31.3 and works as expected.
Let's try new API pages actions! Thanks @ssddanbrown
@ssddanbrown commented on GitHub (Jan 12, 2021):
Thanks for confirming @MatthieuParis.
I've assigned this and #2058 to the next feature release milestone so that I remember to work in the changes to core.
@ssddanbrown commented on GitHub (Mar 27, 2021):
Hi @MatthieuParis, Coming back to this, While looking to include the changes into the next release, I'm worried about including any added complexity as it's not a scenario that'll be easy to test nor maintain.
Reading back through the above, The provided example setups look very complicated in terms of URL handling. There's inferred URL re-writing at both the proxy level and direct hosting side, with manual aliases and rewrites included aswell.
From my testing, Running the BookStack webserver on the root path, then proxying to that instance, works quite well with only a single rewrite needing to be considered (At the proxy level). Could the above setup be simplified greatly by hosting the two instances at the root level, on two different ports, then proxy at the top-level to those two ports based on path? Would mean a lot less URL modification for the request on the way down.
@MatthieuParis commented on GitHub (Mar 28, 2021):
Hi @ssddanbrown!
You're totally right. I've just tested several URL - with 1, 2 or 3 subdirectories after the hostname - that are rewritten on the first proxy to BookStack instances running on the root path, each one on a dedicated port. The configuration of Nginx (and especially PHP) is simpler. Of course, no patch on the code is needed anymore.
I guess this bug should be closed.
If somebody else wants to deploy several BookStack instances on the same host, here are the Nginx configuration files I use, thanks to Dan's advice.
BookStack hosting:
Reverse proxy conf:
Thank you a lot, Dan.
@ssddanbrown commented on GitHub (Mar 28, 2021):
Thanks for giving that a try @MatthieuParis and thanks for sharing the setup for others. Should hopefully result in a more stable setup overall, at least in terms of URL handling.
Will therefore close this off.