HTTP 411 when restricting access to MyMPD with a SSO (OpenID/Authentik) #1374

nanawel · 2024-11-19T09:06:39Z

nanawel
Nov 19, 2024

myMPD version: 18.2.1

This is not exactly a bug but rather a how-to in case some one else stumbles upon the same issue some day.

I have a MyMPD instance running on Docker, and I access it using Apache as a reverse-proxy. It works flawlessly but I wanted to prevent unauthorized access using an already existing OIDP I use for several other services: Authentik.

So I've configured a new OAuth/OpenID provider, just like I've done for similar services, and applied the necessary configuration to the vhost in Apache (using libapache2-mod-auth-openidc on Debian).

But after reloading the configuration and logging in through Authentik, MyMPD fails to load the page and I can see a weird HTTP 411 error in the console on the /api/default request.

Corresponding HAR below (I've removed unnecessary elements).

{
    "request": {
      "bodySize": 78,
      "method": "POST",
      "url": "https://mympd.tld/api/default",
      "httpVersion": "HTTP/1.1",
      "headers": [
        {
          "name": "Host",
          "value": "mympd.tld"
        },
        {
          "name": "User-Agent",
          "value": "Mozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0"
        },
        {
          "name": "Accept",
          "value": "*/*"
        },
        {
          "name": "Accept-Encoding",
          "value": "gzip, deflate, br, zstd"
        },
        {
          "name": "Content-Type",
          "value": "application/json"
        },
        {
          "name": "Content-Length",
          "value": "78"
        },
        {
          "name": "Origin",
          "value": "https://mympd.tld"
        },
        {
          "name": "Connection",
          "value": "keep-alive"
        },
        {
          "name": "Cookie",
          "value": "mod_auth_openidc_session=xxxxxxxxxxxxxxxxxxxxxxxx"
        },
        {
          "name": "Sec-Fetch-Dest",
          "value": "empty"
        },
        {
          "name": "Sec-Fetch-Mode",
          "value": "same-origin"
        }
      ],
      "cookies": [
        {
          "name": "mod_auth_openidc_session",
          "value": "xxxxxxxxxxxxxxxxxxxxxxxx"
        }
      ],
      "queryString": [],
      "headersSize": 627,
      "postData": {
        "mimeType": "application/json",
        "params": [],
        "text": "{\"jsonrpc\":\"2.0\",\"id\":161954001,\"method\":\"MYMPD_API_SETTINGS_GET\",\"params\":{}}"
      }
    },
    "response": {
      "status": 411,
      "statusText": "Length Required",
      "httpVersion": "HTTP/1.1",
      "headers": [
        {
          "name": "Date",
          "value": "Sun, 17 Nov 2024 16:48:49 GMT"
        },
        {
          "name": "Server",
          "value": "Apache"
        },
        {
          "name": "Content-Length",
          "value": "0"
        },
        {
          "name": "Via",
          "value": "1.1 mympd.nanawel.homelinux.org"
        },
        {
          "name": "Connection",
          "value": "close"
        }
      ],
      "cookies": [],
      "content": {
        "mimeType": "text/plain",
        "size": 0,
        "text": ""
      },
      "redirectURL": "",
      "headersSize": 225,
      "bodySize": 930
    }
}

And on the server side, reading at the Docker container's logs, I can see for those calls:

app-1  | ERROR    webserver       8271205b 1 mongoose.c:3264:http_cb      Content length missing from request
app-1  | ERROR    webserver       8271208f 1 mongoose.c:3264:http_cb      Content length missing from request
app-1  | ERROR    webserver       8271208f 1 mongoose.c:3264:http_cb      Content length missing from request

After digging a lot into this issue, I've finally found that the OpenID-related authentication headers added by Authentik/Apache are interfering with the request processing in MyMPD. It seems that Mongoose tries to use these headers although they're not intended for it.

The solution is to strip those headers - one by one, thanks to Apache... - in the vhost like so:

RequestHeader unset OIDC_CLAIM_sub
RequestHeader unset OIDC_CLAIM_nonce
RequestHeader unset OIDC_CLAIM_iss
RequestHeader unset OIDC_CLAIM_aud
RequestHeader unset OIDC_CLAIM_exp
RequestHeader unset OIDC_CLAIM_iat
RequestHeader unset OIDC_CLAIM_auth_time
RequestHeader unset OIDC_CLAIM_acr
RequestHeader unset OIDC_CLAIM_amr
RequestHeader unset OIDC_CLAIM_sid
RequestHeader unset OIDC_access_token
RequestHeader unset OIDC_access_token_expires

Thanks to mitmproxy for being here for that kind of debug sessions ^^

Hope it could help!