From bd5aa223fb5d0ae682cfab5079b7079a1f9deeed Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 24 Aug 2026 00:15:33 +0000 Subject: [PATCH] Prevent a doubled portal domain when the full domain is typed by mistake install_authelia()'s and add_authelia_domain()'s "subdomain for the login portal" prompts concatenated whatever was typed directly with the apex domain (AUTHELIA_PORTAL_SUBDOMAIN + "." + AUTHELIA_DOMAIN), with no guard against someone typing the full portal domain they actually want (e.g. "authelia.mydomain.com") instead of just the subdomain label ("authelia"). That produces a silently broken, doubled hostname like "authelia.mydomain.com.mydomain.com" -- which never matches a real request, so Caddy falls through to some default response instead of ever reaching real Authelia policy evaluation. Confirmed live: this is exactly what happened on a real box, and explains a much bigger symptom than the obviously-wrong hostname alone would suggest -- every forward_auth-gated site on the instance silently bypassed Authelia entirely, not just requests to the portal itself, since the forward_auth subrequest to the (wrong) portal URL never got a real answer either. Both prompts now detect and strip an accidentally-included apex suffix (with a one-line notice), and fall back to "auth" if someone enters the bare apex domain itself (which can't work as the portal -- it would collide with the wildcard rule protecting every other domain). Verified against the exact doubled-domain input, a bare-apex input, and two ordinary short-label inputs before shipping. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01SpKTLpwAgZNooTacWeQLuc --- services/authelia.sh | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/services/authelia.sh b/services/authelia.sh index 72cfea7..4e67952 100644 --- a/services/authelia.sh +++ b/services/authelia.sh @@ -315,6 +315,24 @@ install_authelia() { # it back from configuration.yml's session.cookies authelia_url instead # of assuming "auth." — see those functions for why. prompt_text " Subdomain for the login portal (e.g. 'auth' -> auth.${AUTHELIA_DOMAIN}):" "auth" AUTHELIA_PORTAL_SUBDOMAIN + # Auto-correct the full domain being typed here by mistake (e.g. + # "authelia.mydomain.com" instead of just "authelia") — concatenating + # that with .${AUTHELIA_DOMAIN} below would otherwise silently produce + # a doubled, broken domain like "authelia.mydomain.com.mydomain.com" + # that never matches any real request. Confirmed live: this is exactly + # what happened on a real box, and it explained a much bigger mystery + # than the obviously-wrong hostname alone would suggest — every + # forward_auth-gated site on the instance silently bypassed Authelia, + # because Caddy had no site block matching the real portal hostname at + # all, so the forward_auth subrequest never reached real policy + # evaluation in the first place. + if [[ "$AUTHELIA_PORTAL_SUBDOMAIN" == *".${AUTHELIA_DOMAIN}" ]]; then + AUTHELIA_PORTAL_SUBDOMAIN="${AUTHELIA_PORTAL_SUBDOMAIN%.${AUTHELIA_DOMAIN}}" + log_info "That already included the domain — using just '${AUTHELIA_PORTAL_SUBDOMAIN}' as the subdomain." + elif [[ "$AUTHELIA_PORTAL_SUBDOMAIN" == "$AUTHELIA_DOMAIN" ]]; then + log_warning "That's the apex domain itself, not a subdomain — the portal can't live at the bare apex (it would collide with the wildcard rule protecting everything else). Using 'auth' instead." + AUTHELIA_PORTAL_SUBDOMAIN="auth" + fi AUTHELIA_PORTAL_DOMAIN="${AUTHELIA_PORTAL_SUBDOMAIN}.${AUTHELIA_DOMAIN}" prompt_text " Admin username:" "admin" AUTHELIA_ADMIN_USER prompt_text " Admin display name:" "Administrator" AUTHELIA_ADMIN_DISPLAY @@ -695,6 +713,17 @@ add_authelia_domain() { local NEW_PORTAL_SUBDOMAIN NEW_PORTAL_DOMAIN prompt_text " Subdomain for this domain's own login portal (e.g. 'auth' -> auth.${NEW_DOMAIN}):" "auth" NEW_PORTAL_SUBDOMAIN + # See install_authelia's identical guard on AUTHELIA_PORTAL_SUBDOMAIN + # for why this matters — typing the full domain here instead of just + # the subdomain silently produces a doubled, broken hostname that + # never matches any real request. + if [[ "$NEW_PORTAL_SUBDOMAIN" == *".${NEW_DOMAIN}" ]]; then + NEW_PORTAL_SUBDOMAIN="${NEW_PORTAL_SUBDOMAIN%.${NEW_DOMAIN}}" + log_info "That already included the domain — using just '${NEW_PORTAL_SUBDOMAIN}' as the subdomain." + elif [[ "$NEW_PORTAL_SUBDOMAIN" == "$NEW_DOMAIN" ]]; then + log_warning "That's the apex domain itself, not a subdomain — the portal can't live at the bare apex (it would collide with the wildcard rule protecting everything else). Using 'auth' instead." + NEW_PORTAL_SUBDOMAIN="auth" + fi NEW_PORTAL_DOMAIN="${NEW_PORTAL_SUBDOMAIN}.${NEW_DOMAIN}" # ── access_control.rules: insert right after "rules:" ────────────────────