starred/pocket-id
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2025-12-06 09:13:19 +03:00
Code Issues 121 Packages Projects Releases 16 Wiki Activity

🐛 Bug Report: refreshing page returns 502 Error #457

New Issue
Closed
opened 2025-10-07 00:15:40 +03:00 by OVERLORD · 17 comments
OVERLORD commented 2025-10-07 00:15:40 +03:00
Owner
Copy Link

Originally created by @CyberB1aze on GitHub.

Reproduction steps

when on page
https://domain.com/settings/admin/oidc-clients

When clicking refresh, it returns a 502 error

I'm running pocket-id as a docker container on ubuntu server 24.04, behind nginx reverse proxy.

Expected behavior

Assuming it should just display the oidc-clients page

Actual Behavior

vivaldi_4JHWsKoWRf

Originally created by @CyberB1aze on GitHub. ### Reproduction steps when on page https://domain.com/settings/admin/oidc-clients When clicking refresh, it returns a 502 error I'm running pocket-id as a docker container on ubuntu server 24.04, behind nginx reverse proxy. ### Expected behavior Assuming it should just display the oidc-clients page ### Actual Behavior ![vivaldi_4JHWsKoWRf](https://github.com/user-attachments/assets/bb38a22f-1740-49d9-88c7-4e13bc940d1f)
OVERLORD added the bug label 2025-10-07 00:15:40 +03:00
OVERLORD commented 2025-10-07 00:15:42 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

Please share the container logs if they contain any error, the docker-compose.yml and the Nginx configuration.

@stonith404 commented on GitHub: Please share the container logs if they contain any error, the `docker-compose.yml` and the Nginx configuration.
OVERLORD commented 2025-10-07 00:15:43 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

Hello, I have the problem too. The configurations will follow shortly.

@simono41 commented on GitHub: Hello, I have the problem too. The configurations will follow shortly.
OVERLORD commented 2025-10-07 00:15:43 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

Here is my docker-compose.yml

services:
  pocketid:
    image: stonith404/pocket-id:latest
    container_name: pocket-id
    restart: unless-stopped
    env_file: .env
    volumes:
      - "./data:/app/backend/data"

    environment:
      - TRUST_PROXY=true # Set to true if a reverse proxy is in front of the container
      - VIRTUAL_HOST=pocket-id.brothertec.eu
      - VIRTUAL_PORT=80
      - LETSENCRYPT_HOST=pocket-id.brothertec.eu
      - LETSENCRYPT_EMAIL=admin@brothertec.eu

    labels:
      - "com.centurylinklabs.watchtower.enable=true"

    networks:
      - default
      - proxy
      - edge-tier

networks:
  proxy:
    name: nginx-proxy
    external: true
  edge-tier:
    name: edge
    external: true

and here the automatic generated nginx config

# pocket-id.brothertec.eu/
upstream pocket-id.brothertec.eu {
    # Container: pocket-id
    #     networks:
    #         edge (reachable)
    #         nginx-proxy (ignored; reachable but redundant)
    #         pocket-id_default (unreachable)
    #     IP address: 10.201.1.69
    #     exposed ports: 3000/tcp
    #     default port: 3000
    #     using port: 80
    server 10.201.1.69:80;
}
server {
    server_name pocket-id.brothertec.eu;
    listen 80 ;
    listen [::]:80 ;
    access_log /var/log/nginx/access.log json_analytics;
    # Do not HTTPS redirect Let's Encrypt ACME challenge
    location ^~ /.well-known/acme-challenge/ {
        auth_basic off;
        auth_request off;
        allow all;
        root /usr/share/nginx/html;
        try_files $uri =404;
        break;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}
server {
    server_name pocket-id.brothertec.eu;
    http2 on;
    access_log /var/log/nginx/access.log json_analytics;
    listen 443 ssl ;
    listen [::]:443 ssl ;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_certificate /etc/nginx/certs/pocket-id.brothertec.eu.crt;
    ssl_certificate_key /etc/nginx/certs/pocket-id.brothertec.eu.key;
    ssl_dhparam /etc/nginx/certs/pocket-id.brothertec.eu.dhparam.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/pocket-id.brothertec.eu.chain.pem;
    set $sts_header "";
    if ($https) {
        set $sts_header "max-age=31536000";
    }
    add_header Strict-Transport-Security $sts_header always;
    include /etc/nginx/vhost.d/default;
    location / {
        proxy_pass http://pocket-id.brothertec.eu;
        set $upstream_keepalive false;
        include /etc/nginx/vhost.d/default_location;
    }
}
@simono41 commented on GitHub: Here is my docker-compose.yml ~~~ services: pocketid: image: stonith404/pocket-id:latest container_name: pocket-id restart: unless-stopped env_file: .env volumes: - "./data:/app/backend/data" environment: - TRUST_PROXY=true # Set to true if a reverse proxy is in front of the container - VIRTUAL_HOST=pocket-id.brothertec.eu - VIRTUAL_PORT=80 - LETSENCRYPT_HOST=pocket-id.brothertec.eu - LETSENCRYPT_EMAIL=admin@brothertec.eu labels: - "com.centurylinklabs.watchtower.enable=true" networks: - default - proxy - edge-tier networks: proxy: name: nginx-proxy external: true edge-tier: name: edge external: true ~~~ and here the automatic generated nginx config ~~~ # pocket-id.brothertec.eu/ upstream pocket-id.brothertec.eu { # Container: pocket-id # networks: # edge (reachable) # nginx-proxy (ignored; reachable but redundant) # pocket-id_default (unreachable) # IP address: 10.201.1.69 # exposed ports: 3000/tcp # default port: 3000 # using port: 80 server 10.201.1.69:80; } server { server_name pocket-id.brothertec.eu; listen 80 ; listen [::]:80 ; access_log /var/log/nginx/access.log json_analytics; # Do not HTTPS redirect Let's Encrypt ACME challenge location ^~ /.well-known/acme-challenge/ { auth_basic off; auth_request off; allow all; root /usr/share/nginx/html; try_files $uri =404; break; } location / { return 301 https://$host$request_uri; } } server { server_name pocket-id.brothertec.eu; http2 on; access_log /var/log/nginx/access.log json_analytics; listen 443 ssl ; listen [::]:443 ssl ; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_certificate /etc/nginx/certs/pocket-id.brothertec.eu.crt; ssl_certificate_key /etc/nginx/certs/pocket-id.brothertec.eu.key; ssl_dhparam /etc/nginx/certs/pocket-id.brothertec.eu.dhparam.pem; ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate /etc/nginx/certs/pocket-id.brothertec.eu.chain.pem; set $sts_header ""; if ($https) { set $sts_header "max-age=31536000"; } add_header Strict-Transport-Security $sts_header always; include /etc/nginx/vhost.d/default; location / { proxy_pass http://pocket-id.brothertec.eu; set $upstream_keepalive false; include /etc/nginx/vhost.d/default_location; } } ~~~
OVERLORD commented 2025-10-07 00:15:43 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

And here is the error message from the docker log

pocket-id  | {"level":"error","ts":1730284086.5689123,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":"localhost:3000","duration":0.024754679,"request":{"remote_ip":"10.201.1.100","remote_port":"59658","client_ip":"10.201.1.100","proto":"HTTP/1.1","method":"GET","host":"pocket-id.brothertec.eu","uri":"/settings/admin/user-groups","headers":{"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-Site":["same-origin"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"X-Forwarded-Port":["443"],"X-Real-Ip":["2003:df:bf07:9600::12ee"],"Accept-Language":["de-DE,de;q=0.9"],"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1"],"X-Forwarded-Host":["pocket-id.brothertec.eu"],"Cookie":[],"X-Forwarded-Ssl":["on"],"Priority":["u=0, i"],"Accept-Encoding":["gzip, deflate, br"],"X-Original-Uri":["/settings/admin/user-groups"],"X-Forwarded-For":["2003:df:bf07:9600::12ee, 10.201.1.100"],"Sec-Fetch-Dest":["document"],"X-Forwarded-Proto":["https"]}},"error":"writing: write tcp 10.201.1.69:80->10.201.1.100:59658: write: connection reset by peer"}
pocket-id  | {"level":"error","ts":1730284365.4897547,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":"localhost:3000","duration":0.03114577,"request":{"remote_ip":"10.201.1.100","remote_port":"53830","client_ip":"10.201.1.100","proto":"HTTP/1.1","method":"GET","host":"pocket-id.brothertec.eu","uri":"/settings/admin/oidc-clients","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Priority":["u=0, i"],"Accept-Encoding":["gzip, deflate, br"],"X-Forwarded-Port":["443"],"Accept-Language":["de-DE,de;q=0.9"],"X-Forwarded-Host":["pocket-id.brothertec.eu"],"Sec-Fetch-Mode":["navigate"],"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1"],"X-Original-Uri":["/settings/admin/oidc-clients"],"Cookie":[],"X-Forwarded-Proto":["https"],"X-Forwarded-Ssl":["on"],"Sec-Fetch-Site":["none"],"X-Forwarded-For":["2003:df:bf07:9600::12ee, 10.201.1.100"],"Sec-Fetch-Dest":["document"],"X-Real-Ip":["2003:df:bf07:9600::12ee"]}},"error":"writing: write tcp 10.201.1.69:80->10.201.1.100:53830: write: broken pipe"}
@simono41 commented on GitHub: And here is the error message from the docker log ~~~ pocket-id | {"level":"error","ts":1730284086.5689123,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":"localhost:3000","duration":0.024754679,"request":{"remote_ip":"10.201.1.100","remote_port":"59658","client_ip":"10.201.1.100","proto":"HTTP/1.1","method":"GET","host":"pocket-id.brothertec.eu","uri":"/settings/admin/user-groups","headers":{"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-Site":["same-origin"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"X-Forwarded-Port":["443"],"X-Real-Ip":["2003:df:bf07:9600::12ee"],"Accept-Language":["de-DE,de;q=0.9"],"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1"],"X-Forwarded-Host":["pocket-id.brothertec.eu"],"Cookie":[],"X-Forwarded-Ssl":["on"],"Priority":["u=0, i"],"Accept-Encoding":["gzip, deflate, br"],"X-Original-Uri":["/settings/admin/user-groups"],"X-Forwarded-For":["2003:df:bf07:9600::12ee, 10.201.1.100"],"Sec-Fetch-Dest":["document"],"X-Forwarded-Proto":["https"]}},"error":"writing: write tcp 10.201.1.69:80->10.201.1.100:59658: write: connection reset by peer"} pocket-id | {"level":"error","ts":1730284365.4897547,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":"localhost:3000","duration":0.03114577,"request":{"remote_ip":"10.201.1.100","remote_port":"53830","client_ip":"10.201.1.100","proto":"HTTP/1.1","method":"GET","host":"pocket-id.brothertec.eu","uri":"/settings/admin/oidc-clients","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Priority":["u=0, i"],"Accept-Encoding":["gzip, deflate, br"],"X-Forwarded-Port":["443"],"Accept-Language":["de-DE,de;q=0.9"],"X-Forwarded-Host":["pocket-id.brothertec.eu"],"Sec-Fetch-Mode":["navigate"],"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1"],"X-Original-Uri":["/settings/admin/oidc-clients"],"Cookie":[],"X-Forwarded-Proto":["https"],"X-Forwarded-Ssl":["on"],"Sec-Fetch-Site":["none"],"X-Forwarded-For":["2003:df:bf07:9600::12ee, 10.201.1.100"],"Sec-Fetch-Dest":["document"],"X-Real-Ip":["2003:df:bf07:9600::12ee"]}},"error":"writing: write tcp 10.201.1.69:80->10.201.1.100:53830: write: broken pipe"} ~~~
OVERLORD commented 2025-10-07 00:15:44 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

Thanks for sharing. This issue only occurs when you open the /settings/admin/oidc-clients page, not on any other page? And are those really the only errors you can see with docker compose logs pocket-id?

@stonith404 commented on GitHub: Thanks for sharing. This issue only occurs when you open the `/settings/admin/oidc-clients` page, not on any other page? And are those really the only errors you can see with `docker compose logs pocket-id`?
OVERLORD commented 2025-10-07 00:15:45 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

But since I'm not with Cloudflare, but have a reverse proxy with nginx, my site obviously looks different.

grafik

@simono41 commented on GitHub: But since I'm not with Cloudflare, but have a reverse proxy with nginx, my site obviously looks different. ![grafik](https://github.com/user-attachments/assets/53dac1b5-8231-4b9f-bd33-e8556e333e2f)
OVERLORD commented 2025-10-07 00:15:46 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

Thanks for sharing. This issue only occurs when you open the /settings/admin/oidc-clients page, not on any other page? And are those really the only errors you can see with docker compose logs pocket-id?

No, I also have the problem on other pages like settings/admin/user-groups and settings/audit-log but on settings/account I don't get a 502 Bad Gateway when reloading.

And excuse me here are my complete logs attached in the file.
logs.txt

@simono41 commented on GitHub: > Thanks for sharing. This issue only occurs when you open the `/settings/admin/oidc-clients` page, not on any other page? And are those really the only errors you can see with `docker compose logs pocket-id`? No, I also have the problem on other pages like settings/admin/user-groups and settings/audit-log but on settings/account I don't get a 502 Bad Gateway when reloading. And excuse me here are my complete logs attached in the file. [logs.txt](https://github.com/user-attachments/files/17571123/logs.txt)
OVERLORD commented 2025-10-07 00:15:46 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

@simono41 Thanks I've found the problem. The problem is that the "link" header of Svelte Kit is too large for Nginx. I'll create a new release ASAP.

@stonith404 commented on GitHub: @simono41 Thanks I've found the problem. The problem is that the "link" header of Svelte Kit is too large for Nginx. I'll create a new release ASAP.
OVERLORD commented 2025-10-07 00:15:46 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

Thanks @simono41. I can debug this further tomorrow. Can you try to delete all the cookies? Additionally, does this issue only occur since the latest release?

I've only been using their software since v0.11.0. The problem continues to occur in the private window.

The version was automatically upgraded from Watchtower to the new version v0.12.0.

By the way, I think your project is very cool. I run 18 services with it that I have connected with OIDC and originally come from Keycloak, but for the private application that is simply too much.

@simono41 commented on GitHub: > Thanks @simono41. I can debug this further tomorrow. Can you try to delete all the cookies? Additionally, does this issue only occur since the latest release? I've only been using their software since v0.11.0. The problem continues to occur in the private window. The version was automatically upgraded from Watchtower to the new version v0.12.0. By the way, I think your project is very cool. I run 18 services with it that I have connected with OIDC and originally come from Keycloak, but for the private application that is simply too much.
OVERLORD commented 2025-10-07 00:15:47 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

Thanks @simono41. I can debug this further tomorrow. Can you try to delete all the cookies? Additionally, does this issue only occur since the latest release?

@stonith404 commented on GitHub: Thanks @simono41. I can debug this further tomorrow. Can you try to delete all the cookies? Additionally, does this issue only occur since the latest release?
OVERLORD commented 2025-10-07 00:15:48 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

Okay, let me know if this happens. Then I'll remove the header completely.

No, everything's fine. This proxy setting is already correct. I mean if he's not there that some mobile apps have problems. I have adjusted these adjustments on my nginx and can no longer get the faulty page. Thanks again for your hard work.

@simono41 commented on GitHub: > Okay, let me know if this happens. Then I'll remove the header completely. No, everything's fine. This proxy setting is already correct. I mean if he's not there that some mobile apps have problems. I have adjusted these adjustments on my nginx and can no longer get the faulty page. Thanks again for your hard work.
OVERLORD commented 2025-10-07 00:15:48 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

Okay, let me know if this happens. Then I'll remove the header completely.

@stonith404 commented on GitHub: Okay, let me know if this happens. Then I'll remove the header completely.
OVERLORD commented 2025-10-07 00:15:49 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx:

proxy_busy_buffers_size   512k;
proxy_buffers   4 512k;
proxy_buffer_size   256k;

I'll update the docs.

@stonith404 commented on GitHub: I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx: ``` proxy_busy_buffers_size 512k; proxy_buffers 4 512k; proxy_buffer_size 256k; ``` I'll update the docs.
OVERLORD commented 2025-10-07 00:15:49 +03:00
Author
Owner
Copy Link

@CyberB1aze commented on GitHub:

I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx:

proxy_busy_buffers_size   512k;
proxy_buffers   4 512k;
proxy_buffer_size   256k;

I'll update the docs.

With keycloak I also had to adjust this, but there was the problem that it did not work in some mobile apps the Oauth.

would this have to be added to the nginx-proxy-manager reverse proxy?

@CyberB1aze commented on GitHub: > > I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx: > > ``` > > proxy_busy_buffers_size 512k; > > proxy_buffers 4 512k; > > proxy_buffer_size 256k; > > ``` > > > > > > > > > > > > > > > > > > > > > > > > I'll update the docs. > > With keycloak I also had to adjust this, but there was the problem that it did not work in some mobile apps the Oauth. would this have to be added to the nginx-proxy-manager reverse proxy?
OVERLORD commented 2025-10-07 00:15:49 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx:

proxy_busy_buffers_size   512k;
proxy_buffers   4 512k;
proxy_buffer_size   256k;

I'll update the docs.

With keycloak I also had to adjust this, but there was the problem that it did not work in some mobile apps the Oauth.

@simono41 commented on GitHub: > I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx: > > ``` > proxy_busy_buffers_size 512k; > proxy_buffers 4 512k; > proxy_buffer_size 256k; > ``` > > I'll update the docs. With keycloak I also had to adjust this, but there was the problem that it did not work in some mobile apps the Oauth.
OVERLORD commented 2025-10-07 00:15:50 +03:00
Author
Owner
Copy Link

@simono41 commented on GitHub:

I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx:

proxy_busy_buffers_size   512k;
proxy_buffers   4 512k;
proxy_buffer_size   256k;

I'll update the docs.

With keycloak I also had to adjust this, but there was the problem that it did not work in some mobile apps the Oauth.

would this have to be added to the nginx-proxy-manager reverse proxy?

Yes

@simono41 commented on GitHub: > > > I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx: > > > ``` > > > proxy_busy_buffers_size 512k; > > > proxy_buffers 4 512k; > > > proxy_buffer_size 256k; > > > ``` > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > I'll update the docs. > > > > > > With keycloak I also had to adjust this, but there was the problem that it did not work in some mobile apps the Oauth. > > would this have to be added to the nginx-proxy-manager reverse proxy? Yes
OVERLORD commented 2025-10-07 00:15:50 +03:00
Author
Owner
Copy Link

@adebisi-fa commented on GitHub:

I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx:

proxy_busy_buffers_size   512k;
proxy_buffers   4 512k;
proxy_buffer_size   256k;

I'll update the docs.

This fixed the issue for me. Thanks!

@adebisi-fa commented on GitHub: > I could solve this issue by removing the header but it would hurt the performance. The recommended solution is to add the following configuration to Nginx: > > ``` > proxy_busy_buffers_size 512k; > proxy_buffers 4 512k; > proxy_buffer_size 256k; > ``` > > I'll update the docs. This fixed the issue for me. Thanks!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id#457
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?