Invalid login credentials on android app with reverse proxy

[Alfsvag 2]

I use nginx with letsencrypt and have an issue on the android app. The http redirect doesn't work. I can login just fine if I add https:// infront of my domain, however if I don't then I get complaints about my credentials (server still gets added). This works just fine in the browser, it's only the android app that gives me this issue.

Nginx is setup to redirect all http requests to https.

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        return 301 https://$host$request_uri;
}
 

I have seen similiar issues posted here prior and it seems to be related to the header being altered. I have the following configured:

proxy_http_version 1.1; 
proxy_set_header Connection $connection_upgrade;
proxy_set_header Early-Data $ssl_early_data;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Real-IP $remote_addr;

Am I missing something obvious?
 

Edited March 14, 2021 by Alfsvag

[Luke 42270]

Hi there, I would suggest comparing your nginx config to that of @pir8radio

[pir8radio 1313]

10 hours ago, Alfsvag said:

I use nginx with letsencrypt and have an issue on the android app. The http redirect doesn't work. I can login just fine if I add https:// infront of my domain, however if I don't then I get complaints about my credentials (server still gets added). This works just fine in the browser, it's only the android app that gives me this issue.

Nginx is setup to redirect all http requests to https.

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        return 301 https://$host$request_uri;
}
 

I have seen similiar issues posted here prior and it seems to be related to the header being altered. I have the following configured:

proxy_http_version 1.1; 
proxy_set_header Connection $connection_upgrade;
proxy_set_header Early-Data $ssl_early_data;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Real-IP $remote_addr;

Am I missing something obvious?
 

emby apps wont follow redirects.  FireTV, androidTV the same way.   you have to include https and the port in the apps. 

I believe the reason is that the app "login" page is not pulled from the server, yet built into the emby app.  So what happens is the app tries to "Post"  the form details to the server,  and according to RFC2616 (i think...  might google that to make sure)  the HTTP spec says not to follow any redirect unless it comes to the server as a GET or HEAD which the form submittal would not be..  and therefore the android http client will crap out.

Yea I just googled it is RFC2616 and here is what it says, same for 301's i believe i guess i should have checked. lol:

10.3.3 302 Found
...

   If the 302 status code is received in response to a request other
   than GET or HEAD, the user agent MUST NOT automatically redirect the
   request unless it can be confirmed by the user, since this might
   change the conditions under which the request was issued.

Edited March 15, 2021 by pir8radio

[Alfsvag 2]

21 hours ago, pir8radio said:

emby apps wont follow redirects.  FireTV, androidTV the same way.   you have to include https and the port in the apps. 

I believe the reason is that the app "login" page is not pulled from the server, yet built into the emby app.  So what happens is the app tries to "Post"  the form details to the server,  and according to RFC2616 (i think...  might google that to make sure)  the HTTP spec says not to follow any redirect unless it comes to the server as a GET or HEAD which the form submittal would not be..  and therefore the android http client will crap out.

Yea I just googled it is RFC2616 and here is what it says, same for 301's i believe i guess i should have checked. lol:

10.3.3 302 Found
...

   If the 302 status code is received in response to a request other
   than GET or HEAD, the user agent MUST NOT automatically redirect the
   request unless it can be confirmed by the user, since this might
   change the conditions under which the request was issued.

Ah, thanks for the detailed explanation