🐛 Bug Report: OIDC not working with Cloudflare Access #491

New Issue

OVERLORD · 2025-10-08T00:10:54+03:00

OVERLORD commented

2025-10-08 00:10:54 +03:00

Originally created by @Rxyanlaw on GitHub.

Reproduction steps

Make a Cloudflare Access application
Add Pocket ID as custom OIDC provider
Test the OIDC provider
Cloudflare Access throws "OIDC ERROR: Failed to exchange code for token. Make sure the client secret is correct.
undefined"

I am using Pocket ID behind Traefik and used issue #11's fix to at least get to the setup page but /api/oidc/token returns 404 not found

Expected behavior

It should successfully exchange code for token and complete the authentication.

Actual Behavior

Originally created by @Rxyanlaw on GitHub. ### Reproduction steps Make a Cloudflare Access application Add Pocket ID as custom OIDC provider Test the OIDC provider Cloudflare Access throws "OIDC ERROR: Failed to exchange code for token. Make sure the client secret is correct. undefined" I am using Pocket ID behind Traefik and used issue #11's fix to at least get to the setup page but /api/oidc/token returns 404 not found ### Expected behavior It should successfully exchange code for token and complete the authentication. ### Actual Behavior ![image](https://github.com/user-attachments/assets/ec8ca2c0-295f-4b49-924b-ee7d3f2d393e)

OVERLORD added the bug label 2025-10-08 00:10:54 +03:00

OVERLORD closed this issue

2025-10-08 00:10:55 +03:00

OVERLORD commented

2025-10-08 00:10:57 +03:00

@Rxyanlaw commented on GitHub:

I fixed the issue. I had my Cloudflare Access policy on *.example.com so it was protecting every subdomain. Adding an exclusion for the authentication subdomain fixed the issue. Thank you.

@Rxyanlaw commented on GitHub: I fixed the issue. I had my Cloudflare Access policy on *.example.com so it was protecting every subdomain. Adding an exclusion for the authentication subdomain fixed the issue. Thank you.

OVERLORD commented

2025-10-08 00:10:57 +03:00

@stonith404 commented on GitHub:

I'm using Pocket ID with Cloudflare Access too so there is probably something wrong with your configuration.

Are you using the Docker installation? Can you share the Traefik configuration?

@stonith404 commented on GitHub: I'm using Pocket ID with Cloudflare Access too so there is probably something wrong with your configuration. Are you using the Docker installation? Can you share the Traefik configuration?

OVERLORD commented

2025-10-08 00:10:57 +03:00

@Rxyanlaw commented on GitHub:

I'm using the docker compose installation. Here is my Traefik config:

traefik.enable: true
traefik.http.routers.pocketid.rule: Host(auth.example.com) && PathPrefix(/)
traefik.http.routers.pocketid.entryPoints: https
traefik.http.services.pocketid.loadbalancer.server.port: 80`

@Rxyanlaw commented on GitHub: I'm using the docker compose installation. Here is my Traefik config: traefik.enable: true traefik.http.routers.pocketid.rule: Host(`auth.example.com`) && PathPrefix(`/`) traefik.http.routers.pocketid.entryPoints: https traefik.http.services.pocketid.loadbalancer.server.port: 80`

OVERLORD commented

2025-10-08 00:10:58 +03:00

@stonith404 commented on GitHub:

Thanks. Does a POST request to /api/oidc/token really return 404 or did you make a GET request? Additionally, do you see any errors in the logs of the container?

@stonith404 commented on GitHub: Thanks. Does a POST request to `/api/oidc/token` really return 404 or did you make a GET request? Additionally, do you see any errors in the logs of the container?

OVERLORD referenced this issue

2025-10-08 00:16:54 +03:00

[PR #491] [MERGED] chore(translations): update translations via Crowdin #773

OVERLORD referenced this issue

2025-10-08 00:16:58 +03:00

[PR #491] chore(translations): update translations via Crowdin #777

Sign in to join this conversation.