starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-25 16:06:04 +03:00

[GH-ISSUE #2457] All authenticated POST endpoints return 403 behind nginx (signout + tRPC mutations) despite valid session & CSRF; docker restart temporarily fixes #1477

New issue

Closed

opened 2026-03-02 11:57:35 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 11:57:35 +03:00

Owner

Originally created by @anupamck on GitHub (Feb 5, 2026).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/2457

Describe the Bug

I’m running Karakeep behind an nginx reverse proxy. Login works and the dashboard loads, but all authenticated POST requests fail with 403 Forbidden, including:

POST /api/trpc/bookmarks.createBookmark?batch=1

POST /api/auth/signout

The browser console then throws:

Failed to execute 'json' on 'Response': Unexpected end of JSON input

because the 403 response body is empty / non-JSON.

This is not limited to bookmarking — even signing out fails.

Key point: GET endpoints work, session is valid, CSRF endpoint works — but POST actions are rejected.

However, restarting docker-compose temporarily resolves this issue (I am hosting Karakeep via docker with Meilisearch, env file is given below):

KARAKEEP_VERSION=release
NEXTAUTH_SECRET=***
MEILI_MASTER_KEY=***
NEXTAUTH_URL=https://karakeep.anupam.de
DISABLE_SIGNUPS=true

What I've already checked

Browser POSTs include CSRF token

Confirmed in DevTools:

POST /api/auth/signout includes csrfToken
Cookies are attached
Origin and Referer are correct (https://karakeep.anupam.de)

Despite this, server returns: 403 Forbidden

Direct upstream call via curl on the server also returns 403. E.g. curl -i http://localhost:3000/api/trpc/bookmarks.createBookmark?batch=1

Steps to Reproduce

Deploy Karakeep via docker-compose
Put nginx in front (TLS termination)
Log in via browser
Try to:

Add bookmark
Sign out

Observed:

POST endpoints return 403
frontend crashes parsing JSON
user cannot mutate state or log out

Restarting docker-compose temporarily resolves the issue.

Expected Behaviour

Authenticated users should be able to:

Create bookmarks
Sign out

If rejected, server should return structured JSON instead of raw 403.

Screenshots or Additional Context

No response

Device Details

No response

Exact Karakeep Version

Karakeep v0.27.1

Environment Details

Docker + Nginx

Debug Logs

No response

Have you checked the troubleshooting guide?

I have checked the troubleshooting guide and I haven't found a solution to my problem

Originally created by @anupamck on GitHub (Feb 5, 2026). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/2457 ### Describe the Bug I’m running Karakeep behind an nginx reverse proxy. Login works and the dashboard loads, but all authenticated POST requests fail with 403 Forbidden, including: POST /api/trpc/bookmarks.createBookmark?batch=1 POST /api/auth/signout The browser console then throws: `Failed to execute 'json' on 'Response': Unexpected end of JSON input` because the 403 response body is empty / non-JSON. This is not limited to bookmarking — even signing out fails. Key point: GET endpoints work, session is valid, CSRF endpoint works — but POST actions are rejected. However, restarting docker-compose temporarily resolves this issue (I am hosting Karakeep via docker with Meilisearch, env file is given below): ``` KARAKEEP_VERSION=release NEXTAUTH_SECRET=*** MEILI_MASTER_KEY=*** NEXTAUTH_URL=https://karakeep.anupam.de DISABLE_SIGNUPS=true ``` ### What I've already checked Browser POSTs include CSRF token Confirmed in DevTools: - POST /api/auth/signout includes csrfToken - Cookies are attached - Origin and Referer are correct (https://karakeep.anupam.de) Despite this, server returns: 403 Forbidden Direct upstream call via curl on the server also returns 403. E.g. `curl -i http://localhost:3000/api/trpc/bookmarks.createBookmark?batch=1` ### Steps to Reproduce 1. Deploy Karakeep via docker-compose 2. Put nginx in front (TLS termination) 3. Log in via browser 4. Try to: - Add bookmark - Sign out Observed: - POST endpoints return 403 - frontend crashes parsing JSON - user cannot mutate state or log out Restarting docker-compose temporarily resolves the issue. ### Expected Behaviour Authenticated users should be able to: - Create bookmarks - Sign out If rejected, server should return structured JSON instead of raw 403. ### Screenshots or Additional Context _No response_ ### Device Details _No response_ ### Exact Karakeep Version Karakeep v0.27.1 ### Environment Details Docker + Nginx ### Debug Logs _No response_ ### Have you checked the troubleshooting guide? - [x] I have checked the troubleshooting guide and I haven't found a solution to my problem

kerem

2026-03-02 11:57:35 +03:00

closed this issue
added the
bug

status/untriaged
labels

kerem commented

2026-03-02 11:57:36 +03:00

Author

Owner

@anupamck commented on GitHub (Feb 9, 2026):

This issue went away on its own after I updated to a higher karakeep version (0.30.0). So I will close this for now, and open it again if it reoccurs.

@anupamck commented on GitHub (Feb 9, 2026): This issue went away on its own after I updated to a higher karakeep version (0.30.0). So I will close this for now, and open it again if it reoccurs.

kerem referenced this issue

2026-03-02 11:59:24 +03:00

[PR #1477] [CLOSED] ui: harmonize tab bar for link content in preview + enhancements #1834

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#1477

No description provided.

Rows
Columns