Ensembia/invoiceninja5_ynh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

merge into: Ensembia/invoiceninja5_ynh:master
Branches Tags
Ensembia/invoiceninja5_ynh:master Ensembia/invoiceninja5_ynh:fix-phpfpm-ondemand-cold-start Ensembia/invoiceninja5_ynh:fix-api-secret-breaks-web-login
...
pull from: Ensembia/invoiceninja5_ynh:fix-api-secret-breaks-web-login
Branches Tags
Ensembia/invoiceninja5_ynh:fix-phpfpm-ondemand-cold-start Ensembia/invoiceninja5_ynh:fix-api-secret-breaks-web-login Ensembia/invoiceninja5_ynh:master

2 Commits
master ... fix-api-secret-breaks-web-login

Author SHA1 Message Date
dillard fa89f4312d fix: remove API_SECRET from .env template to restore web UI login 
When API_SECRET is set, Invoice Ninja requires the X-API-SECRET header
on ALL API calls including /api/v1/login. The web UI (React SPA) never
sends this header, so browser login silently fails with "Invalid secret"
while the mobile app (which can be configured with the secret) continues
to work.

UPDATE_SECRET serves a different purpose (protecting the /update endpoint)
and is kept. API_SECRET should remain unset for self-hosted YunoHost installs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-06 16:34:09 +02:00
dillard a59cb4ead3 fix: disable SSO auth header injection for main permission 
Invoice Ninja manages its own authentication and does not integrate with
YunoHost SSO for the main web UI. When auth_header is enabled (the
default), SSOwat injects an 'Authorization: Basic' header containing the
YunoHost user's credentials into every proxied request. Invoice Ninja
receives this header and attempts to use it for authentication; since
YunoHost users do not exist in Invoice Ninja's own database, this causes
a silent login loop: the app briefly loads before redirecting back to
the login page.

The api permission already correctly sets auth_header = false (needed
for mobile app and API token access). This commit applies the same fix
to the main permission for consistency and to restore web UI login.

The app already declares sso = false and ldap = false, making
auth_header = false the consistent and expected setting.
 2026-07-06 03:43:33 +02:00
2 changed files with 3 additions and 1 deletions
Expand all files Collapse all files
conf/default.env
+2 -1
View File
@@ -57,7 +57,8 @@ PHANTOMJS_KEY='__PHANTOMJS_KEY__'
PHANTOMJS_SECRET=__APP_KEY__
UPDATE_SECRET=__API_SECRET__
API_SECRET=__API_SECRET__
# API_SECRET is intentionally not set: when set, it requires the X-API-SECRET header
# on ALL API calls including the web UI login (React SPA), which breaks browser login.
PRECONFIGURED_INSTALL=true
manifest.toml
+1
View File
@@ -72,6 +72,7 @@ ram.runtime = "50M"
[resources.permissions]
main.url = "/"
main.auth_header = false
api.url = "/api"
api.allowed = "visitors"
api.auth_header = false