Can't login once baseurl is set - v1.9.5

[narenarora]

Hello,

I am using the docker version of pigallery2 on a RPi4. With the breaking change of config.json , I figured i'll let the app create a fresh config.json and modify that as needed. I let it use my existing db (sqlite) , so that I don't have to run a new full scan.

Due to the existing db, my existing login worked once the new image started. Made all changes in the settings UI to match what I had before. Everything worked okay until I set the baseUrl. Once the baseUrl is set and container is restarted, I can't login anymore.
The login screen does not give any error, nothing on the page changes, but it doesn't login.

Please help me resolve this. Feel free to point out if I messed up any config.

Once I hit the login button, docker logs get flooded with below message repeatedly -

1/12/2023, 5:52:21 PM[DEBUG] POST /user/logout 401 7ms
1/12/2023, 5:52:21 PM[WARN_] Handled error:
ErrorDTO {
  code: 1,
  message: 'Invalid CSRF token',
  details: ForbiddenError: invalid csrf token
      at csrf (/app/node_modules/csurf/index.js:112:19)
      at /app/node_modules/express-unless/dist/index.js:52:13
      at Generator.next (<anonymous>)
      at fulfilled (/app/node_modules/express-unless/dist/index.js:5:58)
      at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
    code: 'EBADCSRFTOKEN'
  },
  request: { method: 'POST', url: '/user/logout' },
  detailsStr: 'ForbiddenError: invalid csrf token'
}

I am using Nginx Proxy Manager. Below is the config I had before - worked without any issues before v1.9.5

location /myphotos/ {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass http://pigallery2/;
        }

With the new version, and introduction of /pgapi , I tried below config. But could only get the login page. Can't get past it.

location /myphotos/ {
                limit_except GET {
                      deny  all;
                }
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass http://pigallery2/;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_cache_bypass $http_upgrade;
        }

location /myphotos/pgapi/ {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass http://pigallery2/;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_cache_bypass $http_upgrade;
        }

Additional Question - With baseUrl set to /myphotos , for example, what should the value of apiPath be ? /pgapi or /myphotos/pgapi ?
Also, in the nginx config, what should the location be ? /pgapi or /myphotos/pgapi ?

My Apologies if any of these seem basic / ignorant questions. I am finding my way in the Self-Hosted community with the help of such wonderful projects.

Edit: I have attached the output of docker logs with NODE_ENV=debug for above issue
docker_logs_debug.txt

[bpatrik]

Did you remove the apiPath from the config?

Based on this it looks like to me:
1/12/2023, 5:52:21 PM[DEBUG] POST /user/logout 401 7ms.

I do not recommend chaning apiPath. Also take a look at the recommended nginx settings, that might help: https://github.com/bpatrik/pigallery2/blob/master/docker/docker-compose/default/nginx.conf

[bpatrik]

Having a deeper look, you problem is probably with the nginx proxy. With these, your are sending /myphotos/pgapi path to /myphotos, but it should go to /myphotos/pgapi

location /myphotos/pgapi/ { <-----
....
                proxy_pass http://pigallery2/;  <-----
...

Note: there was always a /api path, but now its renamed to /pgapi and configurable.

[narenarora]

Thank you ! I updated the above to "proxy_pass http://pigallery2/pgapi;" and it worked !
Should the below be updated in file https://github.com/bpatrik/pigallery2/blob/master/docker/docker-compose/default/nginx.conf then ? Or am I misreading this ?

    # Only allow all methods (GET,POST,PUT,etc..) for root (/pgapi).
    # see https://github.com/bpatrik/pigallery2/issues/214
    location /pgapi {
      proxy_pass http://pigallery2:80; # forwarding to the other container, named 'pigallery2' <-- this is what I picked up from
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_cache_bypass $http_upgrade;
    }

[bpatrik]

Looked into and it seems that the recommended settings works because there is no ending '/' at the /pgapi. Added note to the config file.

[narenarora]

Understood. Thank you for the explanation.