fix: disable SSO auth header injection for main permission

Invoice Ninja manages its own authentication and does not integrate with
YunoHost SSO for the main web UI. When auth_header is enabled (the
default), SSOwat injects an 'Authorization: Basic' header containing the
YunoHost user's credentials into every proxied request. Invoice Ninja
receives this header and attempts to use it for authentication; since
YunoHost users do not exist in Invoice Ninja's own database, this causes
a silent login loop: the app briefly loads before redirecting back to
the login page.

The api permission already correctly sets auth_header = false (needed
for mobile app and API token access). This commit applies the same fix
to the main permission for consistency and to restore web UI login.

The app already declares sso = false and ldap = false, making
auth_header = false the consistent and expected setting.

This commit is contained in:

Dillard Blom

2026-07-06 03:43:33 +02:00

parent 2fd634c2c0

commit a59cb4ead3

1 changed files with 1 additions and 0 deletions

									
										manifest.toml
									
		+1
		
												View File
												
				@@ -72,6 +72,7 @@ ram.runtime = "50M"

				    [resources.permissions]

				    main.url = "/"

				    main.auth_header = false

				    api.url = "/api"

				    api.allowed = "visitors"

				    api.auth_header = false