mirror of
https://github.com/anonaddy/anonaddy.git
synced 2026-04-25 06:05:55 +03:00
[GH-ISSUE #728] GET https://app.addy.io/api/v1/chart-data: 401 message "Unauthenticated." #1072
Labels
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/anonaddy#1072
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mrusme on GitHub (Apr 12, 2025).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/728
For a while now I've been experiencing the following issue on the dashboard:
After this there are subsequent errors, presumably due to this:
I have tried logging out, clearing all data/cookies/localstorage, logging back in, still it doesn't work. The chart remains empty and the error persists.
@mrusme commented on GitHub (Apr 12, 2025):
Can confirm that in a different browser (ungoogled-chromium) it works.
@mrusme commented on GitHub (Apr 12, 2025):
Turned down
Protection Settingsin Firefox fromStricttoStandard, and disabledEnhanced Protection Settingsfor the site, yet still the chart won't load. DisabledDecentraleyesas well asuBlock Origin, still nothing.@mrusme commented on GitHub (Apr 12, 2025):
When I manually request the URL (https://app.addy.io/api/v1/chart-data) in Firefox, I get the following reply:
@willbrowningme commented on GitHub (Apr 15, 2025):
You can't manually request the URL since it is an API endpoint and needs authentication.
I just tested this in Firefox and it works as expected.
Your request seems to be missing the
referer: https://app.addy.io/header.Something must be removing it which may be the problem.
@mrusme commented on GitHub (Apr 15, 2025):
Thank you for testing! I'm using Firefox with rather strict settings. However, the
referershouldn't be a requirement for the request to work.If Addy requires it then this issue might be renamed into something along the lines of Remove requirement for
refererheader in API requests.@willbrowningme commented on GitHub (Apr 15, 2025):
It is how Laravel Sanctum works to authenticate SPAs through the API - https://laravel.com/docs/12.x/sanctum#how-it-works-spa-authentication
You will have to add an exception for this if Firefox (or whichever extension it is allows it).
@mrusme commented on GitHub (Apr 15, 2025):
According to the docs:
Does Addy set the
Origin? I would believe that if it would setOrigin(as SPAs normally do for CORS) it should work even without theRefererheader.@willbrowningme commented on GitHub (Apr 16, 2025):
The
cors.phpconfig file is here - https://github.com/anonaddy/anonaddy/blob/master/config/cors.phpDoes it return
401for other API actions such as activating/deactivating an alias?@mrusme commented on GitHub (Apr 16, 2025):
Other requests work fine -- and apparently they contain the
Originheader.@willbrowningme commented on GitHub (Apr 16, 2025):
If you click the bell icon next to your username in the nav bar do the notifications load successfully?
@mrusme commented on GitHub (Apr 16, 2025):
Nope, only seeing a loading spinner.
@willbrowningme commented on GitHub (Apr 16, 2025):
It seems to only be affecting the two GET API requests then, other methods (POST, DELETE) seem to be working as expected.
@mrusme commented on GitHub (Apr 16, 2025):
Okay, so, do you want to reopen this issue or shall I use the "Share Feedback" form in my Addy Pro account to submit the problem? What's the preferred process to get this fixed? Thank you!
@willbrowningme commented on GitHub (Apr 17, 2025):
The user agent doesn't always set the
Originheader forGETorHEADrequests - https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin#descriptionYou must have
network.http.sendRefererHeaderset to0in yourabout:configin Firefox.I'm looking for a potential solution for this now.
@mrusme commented on GitHub (Apr 17, 2025):
Correct, yes, amongst other things like
privacy.resistFingerprintingand subsequent configurations. Amongst the tools I use, however, I only noticed Addy not liking this -- and only in particular locations. Charts in e.g. Grafana show up fine.@willbrowningme commented on GitHub (Apr 17, 2025):
This is the method and line in the Sanctum middleware that determines if the request is from the first-party application frontend:
https://github.com/laravel/sanctum/blob/4.x/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php#L74
If neither the
RefererorOriginheaders are being included by the browser then it will always return false and I'm not sure what else can be done.I think the only option may be to change these
GETrequests toPOSTones instead.@mrusme commented on GitHub (Apr 17, 2025):
As stated before, for other requests (disabling/enabling aliases) Firefox does include the
Originheader:What is the difference between the disabling/enabling aliases requests and the graph/notifications requests? It seems like for the former Addy is using
Originand it works just fine, while for the latter it doesn't. Is that due to the different method? (POSTvsGET)I don't know whether it's easily possible to pre-render a version of the chart as well as the notification upon delivery, but that would certainly help with this issue. Then at least I could refresh the page to get an output.
@willbrowningme commented on GitHub (Apr 17, 2025):
It's because those other requests are not
GETrequests and therefore Firefox does include theOriginheader.It is only the
GETAPI requests that are not working because:I will have to change those requests to
POSTones and that should fix it.@willbrowningme commented on GitHub (Apr 22, 2025):
This should work now if you try it again.
@mrusme commented on GitHub (Apr 22, 2025):
I can confirm that on app.addy.io I can now see graphs as well as notifications! Thank you so much for fixing this! :-)