HTTP 401 Unauthorized: Admin user has no admin rights when logging in with token (and using reverse proxy)

C5roki 21 days ago

For security and internet availability I run my Traccar server via a reverse proxy (Apache webserver).
When I'm on my own network, I use a token to login as admin (like https://fake.traccar.public/?token=very_long_and_secret).

That worked fine until version 6.15: When I now login as admin with my token and want to change something that needs admin rights (like change the icon of a device), I get a popup that says 'HTTP 401 Unauthorized | More Details'.

The weird thing is that I get admin rights when I login with my username and password (via the reverse proxy https://fake.traccar.public) or when I login with my token directly via the local IP address (like http://192.168.0.1:8080/?token=very_long_and_secret).

Is this change in behavior in 6.15.2 (using a token on reverse proxy) one of the security fixes that are mentioned in the blog?
And do I need to change something in the Traccar (or the Apache) configuration to be able to login as admin with a token via the reverse proxy?

Anton Tananaev 21 days ago

What do you see in more details?
Are you sure you logged out first?

C5roki 21 days ago

More Details:

jakarta.ws.rs.WebApplicationException: HTTP 401 Unauthorized
	at org.traccar.api.security.SecurityRequestFilter.filter(SecurityRequestFilter.java:122)
	at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:108)
	at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:44)
	at org.glassfish.jersey.process.internal.Stages.process(Stages.java:173)
	at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:266)
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266)
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253)
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:703)
	at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:422)
	at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:374)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:355)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:309)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:202)
	at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:754)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1642)
	at org.traccar.web.WebServer.lambda$initClientProxy$0(WebServer.java:131)
	at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.traccar.web.OverrideFileFilter.doFilter(OverrideFileFilter.java:49)
	at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:89)
	at org.traccar.web.OverrideTextFilter.doFilter(OverrideTextFilter.java:53)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:121)
	at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:133)
	at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1556)
	at org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:871)
	at org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:449)
	at org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:469)
	at org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:719)
	at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1253)
	at org.eclipse.jetty.server.Handler$Sequence.handle(Handler.java:859)
	at org.eclipse.jetty.server.Server.handle(Server.java:197)
	at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:804)
	at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:420)
	at org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1790)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
	at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:492)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.epcRunTask(AdaptiveExecutionStrategy.java:428)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:401)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:255)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:204)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:317)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1240)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194)
	at java.base/java.lang.Thread.run(Unknown Source)

And I tried with staying logged in, logging out, other web browser... same popup and error.
Also I noticed that when you login as admin with username and password and in the settings -> users choose another admin user and use the 'login' button, you also get the same popup and error for the new admin user.

Anton Tananaev 21 days ago

You need to make sure you enable this in Apache:

ProxyPreserveHost On

The change was by design to fix some security issues.

C5roki 21 days ago

Added

ProxyPreserveHost On

to all my Traccar reverse proxies in Apache and my admin user has admin rights again (when using a token to login).

Thanks for the tip (and fixing some security issues :-) )