🐛 Bug Report: #506

New Issue

OVERLORD · 2026-02-04T20:17:53+03:00

OVERLORD commented

2026-02-04 20:17:53 +03:00

Originally created by @leof28 on GitHub (Oct 12, 2025).

Reproduction steps

When I lunch Caddy with Pocket ID, I have a lot of spam (every 1 sec) of "no token found" for Caddy.
Also, I can't login through the Streamyfin APP and Jellyfin TV app because nothing load when I enter my credentials.
Here my caddyfile :

{
    email admin@domain.com
    # DNS Cloudflare pour certificats
    acme_dns cloudflare {env.CF_API_TOKEN}
	
servers {
    trusted_proxies cloudflare
}

    # ───────────────────────────────────────────────
    # 🔒 Sécurité : Authentification & Autorisation
    # ───────────────────────────────────────────────

    order authenticate before respond
    security {

        oauth identity provider generic {
            delay_start 3
            realm generic
            driver generic
            client_id xxxx
            client_secret xxxxx
            scopes openid email profile
            base_auth_url https://auth.domain.com
            metadata_url https://auth.domain.com/.well-known/openid-configuration
		}

		authentication portal authportal {
			enable identity provider generic
			cookie domain *.domain.com
			cookie path /
			crypto default token lifetime 3600
			transform user {
				match realm generic
				action add role user
			}
		}

    # ─────────── AUTORISATION ───────────
		authorization policy authpolicy {
			set auth url /oauth2/generic
			allow roles user
			# inject headers générés par Caddy Security automatiquement
			inject headers with claims
		}
	}
}

# ───────────────────────────────────────────────
# 🎬 Jellyfin
# ───────────────────────────────────────────────
jellyfin.domain.com {

    @auth {
        path /oauth2/generic 
        path /oauth2/generic/authorization-code-callback
    }

    route @auth {
        authenticate with authportal
    }

    route /* {
        authorize with authpolicy
        reverse_proxy 192.168.1.100:8096 {
            header_up X-Real-IP {http.request.remote}
            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {http.request.remote}
            header_up Authorization {http.request.header.Authorization}

        }
    }

    tls {
        dns cloudflare {env.CF_API_TOKEN}
    }

    log {
        output file /var/log/caddy/jelly_access.log {
            roll_size 10MiB
            roll_keep 5
            roll_keep_for 48h
        }
        format json
        level INFO
    }
}

# ───────────────────────────────────────────────
# 📥 Demande (Jellyseer)
# ───────────────────────────────────────────────
demande.domain.com {
    @auth path /caddy-security/*
    route @auth {
        authenticate with authportal
    }

    route /* {
        authorize with authpolicy
        reverse_proxy 192.168.1.100:8097 {
            header_up X-Real-IP {http.request.remote}
            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {http.request.remote}
        }
    }

    tls {
        dns cloudflare {env.CF_API_TOKEN}
    }

    log {
        output file /var/log/caddy/demande_access.log {
            roll_size 10MiB
            roll_keep 5
            roll_keep_for 48h
        }
        format json
        level INFO
    }
}

# ───────────────────────────────────────────────
# 🔐 Auth (PocketID / Keycloak)
# ───────────────────────────────────────────────
auth.domain.com {
    reverse_proxy 192.168.1.100:1411

    tls {
        dns cloudflare {env.CF_API_TOKEN}
    }

    log {
        output file /var/log/caddy/pocketid_access.log {
            roll_size 10MiB
            roll_keep 5
            roll_keep_for 48h
        }
        format json
        level INFO
    }
}

Expected behavior

It should not spam and I should be able to connect through Streamyfin and Jellyfin TV app

Actual Behavior

Spam of logs

Pocket ID Version

[Pocket ID] (1.13.1)

Database

None ?

OS and Environment

Docker Compose
Caddy :


services:
  caddy:
    container_name: caddyv2
    image: caddy-security-cloudflare-jwt-ip:latest
    build:
      context: .
      dockerfile_inline: |
        FROM caddy:2-builder AS builder
        RUN xcaddy build \
          --with github.com/caddy-dns/cloudflare \
          --with github.com/ggicci/caddy-jwt \
          --with github.com/greenpau/caddy-security \
          --with github.com/WeidiDeng/caddy-cloudflare-ip
        FROM caddy:2-alpine
        COPY --from=builder /usr/bin/caddy /usr/bin/caddy
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    environment:
      - CF_API_TOKEN=${CF_API_TOKEN}
      - GENERIC_CLIENT_ID=${GENERIC_CLIENT_ID}
      - GENERIC_CLIENT_SECRET=${GENERIC_CLIENT_SECRET}
    volumes:
      - /mnt/base/apps/config/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - /mnt/base/apps/config/caddy/data:/data
      - /mnt/base/apps/config/caddy/config:/config
      - /mnt/base/apps/config/caddy/logs:/var/log/caddy
    networks:
      - auth
networks:
  auth:
    external: true

Pocket ID :

services:
  pocket-id:
    image: ghcr.io/pocket-id/pocket-id:v1
    restart: unless-stopped
    env_file: .env
    networks:
      - auth
    ports:
      - 1411:1411
    volumes:
      - /mnt/base/apps/config/pocketid/data:/app/data
    # Optional healthcheck
    healthcheck:
      test:
        - CMD
        - /app/pocket-id
        - healthcheck
      interval: 1m30s
      timeout: 5s
      retries: 2
      start_period: 10s
networks:
  auth:
    external: true

Log Output

pocket-id-1  | Oct 12 11:52:34 INF Request app=pocket-id version=1.13.1 status=200 method=GET path=/authorize query="client_id=8d54f791-68c4-4aca-9f06-2d8c94f0a6dd&nonce=pjrbaIlfqctsKcTAROZHDNYcpFaTEaSG&redirect_uri=https%3A%2F%2Fjelly.my.domain%2Foauth2%2Fgeneric%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=caa9a897-7f74-4be1-bcf8-13fbf8ff6a08" route="" ip=privateIP latency=47.075µs referer="" user_agent=axios/1.7.2 body_size=1508
pocket-id-1  | Oct 12 11:52:35 INF Request app=pocket-id version=1.13.1 status=200 method=GET path=/authorize query="client_id=8d54f791-68c4-4aca-9f06-2d8c94f0a6dd&nonce=X9gDfhDdcI7sjcbPYvpoIgYmd6agSZoh&redirect_uri=https%3A%2F%2Fjelly.my.domain%2Foauth2%2Fgeneric%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=f8bf295c-f366-4b3b-8c12-a9120b2c94a1" route="" ip=privateIP latency=28.838µs referer="" user_agent=axios/1.7.2 body_size=1508

And log of Caddy :

caddyv2  | {"level":"error","ts":1760270181.1038342,"logger":"http.handlers.authentication","msg":"auth provider returned error","provider":"authorizer","error":"user authorization failed: src_ip=MYIP, src_conn_ip=172.70.108.XXX, reason: no token found"}
caddyv2  | {"level":"error","ts":1760270182.1048965,"logger":"http.handlers.authentication","msg":"auth provider returned error","provider":"authorizer","error":"user authorization failed: src_ip=MYIP, src_conn_ip=162.158.23.XXX, reason: no token found"}
caddyv2  | {"level":"error","ts":1760270183.1036727,"logger":"http.handlers.authentication","msg":"auth provider returned error","provider":"authorizer","error":"user authorization failed: src_ip=MYIP, src_conn_ip=172.68.234.XXX, reason: no token found"}

Originally created by @leof28 on GitHub (Oct 12, 2025). ### Reproduction steps When I lunch Caddy with Pocket ID, I have a lot of spam (every 1 sec) of "no token found" for Caddy. Also, I can't login through the Streamyfin APP and Jellyfin TV app because nothing load when I enter my credentials. Here my caddyfile : ``` { email admin@domain.com # DNS Cloudflare pour certificats acme_dns cloudflare {env.CF_API_TOKEN} servers { trusted_proxies cloudflare } # ─────────────────────────────────────────────── # 🔒 Sécurité : Authentification & Autorisation # ─────────────────────────────────────────────── order authenticate before respond security { oauth identity provider generic { delay_start 3 realm generic driver generic client_id xxxx client_secret xxxxx scopes openid email profile base_auth_url https://auth.domain.com metadata_url https://auth.domain.com/.well-known/openid-configuration } authentication portal authportal { enable identity provider generic cookie domain *.domain.com cookie path / crypto default token lifetime 3600 transform user { match realm generic action add role user } } # ─────────── AUTORISATION ─────────── authorization policy authpolicy { set auth url /oauth2/generic allow roles user # inject headers générés par Caddy Security automatiquement inject headers with claims } } } # ─────────────────────────────────────────────── # 🎬 Jellyfin # ─────────────────────────────────────────────── jellyfin.domain.com { @auth { path /oauth2/generic path /oauth2/generic/authorization-code-callback } route @auth { authenticate with authportal } route /* { authorize with authpolicy reverse_proxy 192.168.1.100:8096 { header_up X-Real-IP {http.request.remote} header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {http.request.remote} header_up Authorization {http.request.header.Authorization} } } tls { dns cloudflare {env.CF_API_TOKEN} } log { output file /var/log/caddy/jelly_access.log { roll_size 10MiB roll_keep 5 roll_keep_for 48h } format json level INFO } } # ─────────────────────────────────────────────── # 📥 Demande (Jellyseer) # ─────────────────────────────────────────────── demande.domain.com { @auth path /caddy-security/* route @auth { authenticate with authportal } route /* { authorize with authpolicy reverse_proxy 192.168.1.100:8097 { header_up X-Real-IP {http.request.remote} header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {http.request.remote} } } tls { dns cloudflare {env.CF_API_TOKEN} } log { output file /var/log/caddy/demande_access.log { roll_size 10MiB roll_keep 5 roll_keep_for 48h } format json level INFO } } # ─────────────────────────────────────────────── # 🔐 Auth (PocketID / Keycloak) # ─────────────────────────────────────────────── auth.domain.com { reverse_proxy 192.168.1.100:1411 tls { dns cloudflare {env.CF_API_TOKEN} } log { output file /var/log/caddy/pocketid_access.log { roll_size 10MiB roll_keep 5 roll_keep_for 48h } format json level INFO } } ``` ### Expected behavior It should not spam and I should be able to connect through Streamyfin and Jellyfin TV app ### Actual Behavior Spam of logs ### Pocket ID Version [Pocket ID] (1.13.1) ### Database None ? ### OS and Environment Docker Compose Caddy : ``` services: caddy: container_name: caddyv2 image: caddy-security-cloudflare-jwt-ip:latest build: context: . dockerfile_inline: | FROM caddy:2-builder AS builder RUN xcaddy build \ --with github.com/caddy-dns/cloudflare \ --with github.com/ggicci/caddy-jwt \ --with github.com/greenpau/caddy-security \ --with github.com/WeidiDeng/caddy-cloudflare-ip FROM caddy:2-alpine COPY --from=builder /usr/bin/caddy /usr/bin/caddy restart: unless-stopped ports: - 80:80 - 443:443 environment: - CF_API_TOKEN=${CF_API_TOKEN} - GENERIC_CLIENT_ID=${GENERIC_CLIENT_ID} - GENERIC_CLIENT_SECRET=${GENERIC_CLIENT_SECRET} volumes: - /mnt/base/apps/config/caddy/Caddyfile:/etc/caddy/Caddyfile:ro - /mnt/base/apps/config/caddy/data:/data - /mnt/base/apps/config/caddy/config:/config - /mnt/base/apps/config/caddy/logs:/var/log/caddy networks: - auth networks: auth: external: true ``` Pocket ID : ``` services: pocket-id: image: ghcr.io/pocket-id/pocket-id:v1 restart: unless-stopped env_file: .env networks: - auth ports: - 1411:1411 volumes: - /mnt/base/apps/config/pocketid/data:/app/data # Optional healthcheck healthcheck: test: - CMD - /app/pocket-id - healthcheck interval: 1m30s timeout: 5s retries: 2 start_period: 10s networks: auth: external: true ``` <img width="1128" height="715" alt="Image" src="https://github.com/user-attachments/assets/6b5a6687-a0de-4088-8ef6-2f156c02338a" /> ### Log Output ``` pocket-id-1 | Oct 12 11:52:34 INF Request app=pocket-id version=1.13.1 status=200 method=GET path=/authorize query="client_id=8d54f791-68c4-4aca-9f06-2d8c94f0a6dd&nonce=pjrbaIlfqctsKcTAROZHDNYcpFaTEaSG&redirect_uri=https%3A%2F%2Fjelly.my.domain%2Foauth2%2Fgeneric%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=caa9a897-7f74-4be1-bcf8-13fbf8ff6a08" route="" ip=privateIP latency=47.075µs referer="" user_agent=axios/1.7.2 body_size=1508 pocket-id-1 | Oct 12 11:52:35 INF Request app=pocket-id version=1.13.1 status=200 method=GET path=/authorize query="client_id=8d54f791-68c4-4aca-9f06-2d8c94f0a6dd&nonce=X9gDfhDdcI7sjcbPYvpoIgYmd6agSZoh&redirect_uri=https%3A%2F%2Fjelly.my.domain%2Foauth2%2Fgeneric%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=f8bf295c-f366-4b3b-8c12-a9120b2c94a1" route="" ip=privateIP latency=28.838µs referer="" user_agent=axios/1.7.2 body_size=1508 ``` And log of Caddy : ``` caddyv2 | {"level":"error","ts":1760270181.1038342,"logger":"http.handlers.authentication","msg":"auth provider returned error","provider":"authorizer","error":"user authorization failed: src_ip=MYIP, src_conn_ip=172.70.108.XXX, reason: no token found"} caddyv2 | {"level":"error","ts":1760270182.1048965,"logger":"http.handlers.authentication","msg":"auth provider returned error","provider":"authorizer","error":"user authorization failed: src_ip=MYIP, src_conn_ip=162.158.23.XXX, reason: no token found"} caddyv2 | {"level":"error","ts":1760270183.1036727,"logger":"http.handlers.authentication","msg":"auth provider returned error","provider":"authorizer","error":"user authorization failed: src_ip=MYIP, src_conn_ip=172.68.234.XXX, reason: no token found"} ```

OVERLORD closed this issue

2026-02-04 20:17:56 +03:00

OVERLORD commented

2026-02-04 20:18:01 +03:00

@stonith404 commented on GitHub (Oct 12, 2025):

This seems like a configuration issue instead of a bug with Pocket ID, because of that I'm converting this to a discussion. I can't really help you here because i'm not using Caddy security, but maybe someone else can.

@stonith404 commented on GitHub (Oct 12, 2025): This seems like a configuration issue instead of a bug with Pocket ID, because of that I'm converting this to a discussion. I can't really help you here because i'm not using Caddy security, but maybe someone else can.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#506