starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 17:35:52 +03:00

[GH-ISSUE #2123] External IP's getting successful static GET request with Auth Enabled #1525

New issue

Closed

opened 2026-02-26 07:31:25 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 07:31:25 +03:00

Owner

Originally created by @shanelord01 on GitHub (Jun 22, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2123

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug
Synology NAS sitting behind NPM. Basic Auth is enabled and works for main root protection, but logs show external IP's issuing a successful static GET request and accessing images using this call:

[server address]/webapi/entry.cgi?api=SYNO.Core.Synohdpack&version=1&method=getHDIcon&res=24&retina=false&path=webman/3rdparty/DownloadStation/images/download_station_{0}.png

Also:
webman/3rdparty/FileBrowser/images/icon/FileStation_{0}.png
webman/3rdparty/Virtualization/images/VirtualManagement_{0}.png
webman/3rdparty/SynologyPhotos/images/icon/photos_{0}.png

This skips straight past the auth and shows the file, allowing the person sending this to know a Synology NAS is present.

Issuing just [server address]/webapi correctly asks for auth.

Nginx Proxy Manager Version
2.9.18

To Reproduce
Can provide the URL to my server for @jc21 or similar to assess how to resolve.

Expected behavior
Expect auth to be required for any access to the server including this. How to block "SYNO.Core.Synohdpack" request?

Screenshots
n/a

Operating System
n/a - But tested on Windows client, Mac client and iOS client and all show the same.

Additional context
n/a

Originally created by @shanelord01 on GitHub (Jun 22, 2022). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2123 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** Synology NAS sitting behind NPM. Basic Auth is enabled and works for main root protection, but logs show external IP's issuing a successful static GET request and accessing images using this call: [server address]/webapi/entry.cgi?api=SYNO.Core.Synohdpack&version=1&method=getHDIcon&res=24&retina=false&path=webman/3rdparty/DownloadStation/images/download_station_{0}.png Also: webman/3rdparty/FileBrowser/images/icon/FileStation_{0}.png webman/3rdparty/Virtualization/images/VirtualManagement_{0}.png webman/3rdparty/SynologyPhotos/images/icon/photos_{0}.png This skips straight past the auth and shows the file, allowing the person sending this to know a Synology NAS is present. Issuing just [server address]/webapi correctly asks for auth. **Nginx Proxy Manager Version** 2.9.18 **To Reproduce** Can provide the URL to my server for @jc21 or similar to assess how to resolve. **Expected behavior** Expect auth to be required for any access to the server including this. How to block "SYNO.Core.Synohdpack" request? **Screenshots** n/a **Operating System** n/a - But tested on Windows client, Mac client and iOS client and all show the same. **Additional context** n/a

kerem

2026-02-26 07:31:25 +03:00

closed this issue
added the
stale

bug
labels

kerem commented

2026-02-26 07:31:26 +03:00

Author

Owner

@shanelord01 commented on GitHub (Jun 22, 2022):

For the moment I've added this to my Advanced "Custom NGINX Config":

location = /webapi {
allow 192.168.1.1/24;
allow 127.0.0.1;
deny all;
}

@shanelord01 commented on GitHub (Jun 22, 2022): For the moment I've added this to my Advanced "Custom NGINX Config": location = /webapi { allow 192.168.1.1/24; allow 127.0.0.1; deny all; }

kerem commented

2026-02-26 07:31:26 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Feb 14, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Feb 14, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:31:26 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 31, 2025):

Issue was closed due to inactivity.

@github-actions[bot] commented on GitHub (Mar 31, 2025): Issue was closed due to inactivity.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#1525

No description provided.

Rows
Columns