Invalid Username or Password on iOS app only

[vmcosco 24]

Wasn't sure if this should be posted in the General forum or iOS but since my issue is only related to the iOS app, I decided to come here.

I am running the current version of Emby on a Windows 10 box.  I access Emby remotely via  emby.domain.xyz.  When I on my LAN, all devices and apps automatically find and connect to my Emby server (iPhone browsers, iPhone app, FireTV app, etc).  When I am remote, I am able to connect and login via emby.domain.xyz on my iPhone in Safari, Firefox and Chrome.  From the iOS app only, I am able to connect to the server, but the correct username and password returns "Invalid Username or Password".  I deleted and reinstalled the app.  That did not help.

What is needed from me to determine what the issue may be?  First issue I have had with Emby in a long time.  I recently moved from Caddy and Namecheap to Traefik and Cloudflare but since the username and password combo works everywhere else, It did not seem like that would be the issue.  I am pretty sure that the app has worked remotely since I made that change anyway.

Thanks

[Luke 42077]

Hi, have you tried turning off cloudfare caching?

[vmcosco 24]

13 hours ago, Luke said:

Hi, have you tried turning off cloudfare caching?

I have not, I will look into that.

Edit:  I am currently using Cloudflare for DNS only so I don't think that I am using Cloudflare caching

Edited February 1, 2022 by vmcosco

[Luke 42077]

Please see this and see if it helps: 

Thanks.

[vmcosco 24]

So try to configure Traefik to allow localhost:12344 or should localhost be the IP of the host running Emby?

 

[Luke 42077]

1 hour ago, vmcosco said:

So try to configure Traefik to allow localhost:12344 or should localhost be the IP of the host running Emby?

 

Well if your proxy is restricting based on the referrer header then you will need to look at that.

[vmcosco 24]

22 minutes ago, Luke said:

Well if your proxy is restricting based on the referrer header then you will need to look at that.

Ok, I will do some digging and see what I come up with.  I don't have a lot of "native" knowledge on that stuff so I will need to consult Google

[curiousgally 0]

same observation here. Tried to login on my wife's iphone with the same result. Me too have emby exposed over traefik and cloudfare as the DNS server.

[Luke 42077]

On 3/6/2022 at 4:07 PM, curiousgally said:

same observation here. Tried to login on my wife's iphone with the same result. Me too have emby exposed over traefik and cloudfare as the DNS server.

Hi, have you checked your emby server log? Perhaps the authentication request never even reaches your emby server.

[vmcosco 24]

On 3/7/2022 at 8:19 PM, Luke said:

Hi, have you checked your emby server log? Perhaps the authentication request never even reaches your emby server.

Finally getting back to this.  I enabled the debug log, attempted to login from the iOS app while on cellular.  The login page appears and when I try to log in I get "invalid username or password".  I opened emby on Safari (same phone) and was able to successfully login.

I have attached a log that identifies to the separate logins.  The differences seem to be 404 errors on the failure.  But there is also no real indication that the login attempt reached the emby server.  emby ios app.txt

[Luke 42077]

2 minutes ago, vmcosco said:

Finally getting back to this.  I enabled the debug log, attempted to login from the iOS app while on cellular.  The login page appears and when I try to log in I get "invalid username or password".  I opened emby on Safari (same phone) and was able to successfully login.

I have attached a log that identifies to the separate logins.  The differences seem to be 404 errors on the failure.  But there is also no real indication that the login attempt reached the emby server.  emby ios app.txt

Yea doesn't look like it even reaches emby server. Can you get the logs from your reverse proxy?

[vmcosco 24]

24 minutes ago, Luke said:

Yea doesn't look like it even reaches emby server. Can you get the logs from your reverse proxy?

These are the only lines in the Traefik log form that time.  No log entries from the successful login to compare.

traefik log.txt

[Luke 42077]

4 minutes ago, vmcosco said:

These are the only lines in the Traefik log form that time.  No log entries from the successful login to compare.

traefik log.txt 1.03 kB · 0 downloads

I'm curious about the requests in the server log on port 443 but with http:// rather than https. It would be interesting to find out how those looked at the point of the reverse proxy.

[vmcosco 24]

2 hours ago, Luke said:

I'm curious about the requests in the server log on port 443 but with http:// rather than https. It would be interesting to find out how those looked at the point of the reverse proxy.

Agreed.  I cannot find any reference to that in the Traefik logs.

[Luke 42077]

21 hours ago, vmcosco said:

Agreed.  I cannot find any reference to that in the Traefik logs.

Without logging from the reverse proxy it's hard to determine if the problem comes from the app or the proxy. If it were coming from the app then you'd think the requests would not even get past the reverse proxy. Nonetheless we did a sweep through the app code to look for possible cases where this might happen, and while we didn't find any, we did do some general cleanup around the way the urls are put together, so there's always a chance that will help.

[vmcosco 24]

Makes sense.  Thanks for the additional info.  I will keep doing some digging in Traefik as well to see if I missed something in my config.

[vmcosco 24]

@Luke

Doing some additional digging in the forums, I found this comment on a related thread.  I created a separate  header middleware in Traefik for Emby and am able to connect via the iOS app when not on my LAN.  Something in my the secure headers config that I use for everything else must have been causing the iOS app to have connection issues.

I am more than happy to share both of the header configs if you, or someone on the team want to review the differences.  I am not sure how many questions I could answer because I am not particularly knowledgeable.  I am able to follow guides and effectively copy/paste

[Luke 42077]

Is there no request log in traffic because without that this is essentially guess work.

[vmcosco 24]

These are the acces log entries from the successful and unsuccessful connections and the corresponding Traefik header middlewares.  Not sure if this is helpful or not.  I cannot find a way to get any additional details from Traefik (which seems odd).

failed connection.txtsuccessful connection.txt

[Luke 42077]

What does traefik do with the options requests? That might be the issue.

[Luke 42077]

@vmcosco ?

[vmcosco 24]

On 3/27/2022 at 6:31 PM, Luke said:

What does traefik do with the options requests?

I really am not sure.  I am far from an expert.  I did find this thread maybe makes sense to you or someone more knowledgeable than I.

https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266

[Luke 42077]

41 minutes ago, vmcosco said:

I really am not sure.  I am far from an expert.  I did find this thread maybe makes sense to you or someone more knowledgeable than I.

https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266

Ideally you should make sure the options requests are either sent to Emby Server, which is not currently happening. @pir8radio is that how your nginx config handles them?

[Luke 42077]

@vmcosco has this helped?

[SGBVida 1]

Hello @vmcosco did you fix your issue ?

I discover today that I have the same issue ! can you share you ingress route & your middleware config please ?

 

Thanks !

Edited October 3, 2022 by SGBVida