HTTP 401 Unauthorized: Admin user has no admin rights when logging in with token (and using reverse proxy)

C5roki 2 months ago

For security and internet availability I run my Traccar server via a reverse proxy (Apache webserver).
When I'm on my own network, I use a token to login as admin (like https://fake.traccar.public/?token=very_long_and_secret).

That worked fine until version 6.15: When I now login as admin with my token and want to change something that needs admin rights (like change the icon of a device), I get a popup that says 'HTTP 401 Unauthorized | More Details'.

The weird thing is that I get admin rights when I login with my username and password (via the reverse proxy https://fake.traccar.public) or when I login with my token directly via the local IP address (like http://192.168.0.1:8080/?token=very_long_and_secret).

Is this change in behavior in 6.15.2 (using a token on reverse proxy) one of the security fixes that are mentioned in the blog?
And do I need to change something in the Traccar (or the Apache) configuration to be able to login as admin with a token via the reverse proxy?

Anton Tananaev 2 months ago

What do you see in more details?
Are you sure you logged out first?

C5roki 2 months ago

More Details:

jakarta.ws.rs.WebApplicationException: HTTP 401 Unauthorized
	at org.traccar.api.security.SecurityRequestFilter.filter(SecurityRequestFilter.java:122)
	at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:108)
	at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:44)
	at org.glassfish.jersey.process.internal.Stages.process(Stages.java:173)
	at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:266)
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266)
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253)
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:703)
	at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:422)
	at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:374)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:355)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:309)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:202)
	at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:754)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1642)
	at org.traccar.web.WebServer.lambda$initClientProxy$0(WebServer.java:131)
	at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.traccar.web.OverrideFileFilter.doFilter(OverrideFileFilter.java:49)
	at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:89)
	at org.traccar.web.OverrideTextFilter.doFilter(OverrideTextFilter.java:53)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:121)
	at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:133)
	at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1556)
	at org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:871)
	at org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:449)
	at org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:469)
	at org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:719)
	at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1253)
	at org.eclipse.jetty.server.Handler$Sequence.handle(Handler.java:859)
	at org.eclipse.jetty.server.Server.handle(Server.java:197)
	at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:804)
	at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:420)
	at org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1790)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
	at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:492)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.epcRunTask(AdaptiveExecutionStrategy.java:428)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:401)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:255)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:204)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:317)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1240)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194)
	at java.base/java.lang.Thread.run(Unknown Source)

And I tried with staying logged in, logging out, other web browser... same popup and error.
Also I noticed that when you login as admin with username and password and in the settings -> users choose another admin user and use the 'login' button, you also get the same popup and error for the new admin user.

Anton Tananaev 2 months ago

You need to make sure you enable this in Apache:

ProxyPreserveHost On

The change was by design to fix some security issues.

C5roki 2 months ago

Added

ProxyPreserveHost On

to all my Traccar reverse proxies in Apache and my admin user has admin rights again (when using a token to login).

Thanks for the tip (and fixing some security issues :-) )