Asset Download failed under Android

[Johnny-755]

The bug

the Android app (on different devices like Pixel 8 and Samsung S22) cannot download individual pictures. On iPhone the download works.

The OS that Immich Server is running on

Debian

Version of Immich Server

1.122.3

Version of Immich Mobile App

1.122.3 171

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - ${EXTERNAL_PATH}:/usr/src/app/external
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - "127.0.0.1:2283:2283"
    depends_on:
      - redis
      - database
    restart: always

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always

  immich-folder-album-creator:
    container_name: immich_folder_album_creator
    image: salvoxia/immich-folder-album-creator:latest
    restart: unless-stopped
    environment:
      API_URL: http://immich_server:3001/api
      API_KEY: 
      ROOT_PATH: /usr/src/app/external
      ALBUM_LEVELS: 4
      ALBUM_SEPARATOR: " - "
      CRON_EXPRESSION: "0 0 * * *"
      TZ: Europe/Berlin

  redis:
    container_name: immich_redis
    image: registry.hub.docker.com/library/redis:6.2-alpine@sha256:84882e87b54734154586e5f8abd4dce69fe7311315e2fc6d67c29614c8de2672
    restart: always

  database:
    container_name: immich_postgres
    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    restart: always
    command: ["postgres", "-c" ,"shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"]

volumes:
  model-cache:

Your .env content

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=./library
# The location where your database files are stored
DB_DATA_LOCATION=./postgres
EXTERNAL_PATH=/media/pics
# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

Reproduction steps

1. Open app on android
2. open a picture on the timeline
3. click on the cloud-download icon in the top right corner

Relevant log output

No log on the device itself

Additional information

server is using NGINX with basic-auth, if thats of any relevance

[aviv926]

Have you tried testing via a direct local connection to the server without a reverse proxy?

[Johnny-755]

Have you tried testing via a direct local connection to the server without a reverse proxy?

Its a public VPS, so I cannot simply disable the reverse proxy unfortunately.

[bo0tzz]

We need to rule out third party components before we can look into a bug. If you can reproduce this with a direct connection we can reopen this issue.

[Johnny-755]

We need to rule out third party components before we can look into a bug. If you can reproduce this with a direct connection we can reopen this issue.

It was working with the previous version of the app, that by itself rules out any other component

[alextran1502]

Help us help you. Can you try the operation over local connection if you can?

[Johnny-755]

Help us help you. Can you try the operation over local connection if you can?

what do you understand under "local connection"?

[alextran1502]

Direct IP connection to the instance i.e via

http://x.x.x.x:2283

[Johnny-755]

Ok that was too complicated but also not necessary. When I temporarily disabled auth-basic, it was working again.

So something changed in the downloader, that it is not using the full URL anymore?

[alextran1502]

Yes that is plausible. How do you setup basic auth? Perhaps you can share you settings so we can try reproduce and troubleshoot?

[Johnny-755]

fairly straightforward, Ive just used existing templates and adjusted them, the important part is in the location section:

server {
server_name ...; #managed by Certbot
listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot

    # DNS Servers to use for OCSP lookups
    resolver 8.8.8.8 1.1.1.1 9.9.9.9 valid=300s;
    resolver_timeout 5s;

    # - - - - - - - - -
    # Reverse Proxy
    # - - - - - - - - -
    proxy_redirect           off;
    proxy_set_header         X-Real-IP $remote_addr;                        # Let PP know the clients real IP
    proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;    # Let PP know that a proxy did forward this request
    proxy_set_header         Host $http_host;                               # Set Proxy host info

    proxy_http_version 1.1;                                                 # Required for WebSocket connection
    proxy_set_header Upgrade $http_upgrade;                                 # Allow protocol switch to websocket
    proxy_set_header Connection "upgrade";                                  # Do protocol switch
    proxy_set_header X-Forwarded-Proto $scheme;                             # Let PP know that this connection used HTTP or HTTPS
    
    client_max_body_size 500M;                                              # Bump the max body size, you may want to upload huge stuff via the upload GUI
    proxy_buffering off;
    

    location / {
            proxy_pass http://127.0.0.1:2283/;
            auth_basic "private area";
            auth_basic_user_file /etc/nginx/.htpasswd;
    }


ssl_certificate /etc/letsencrypt/live/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/privkey.pem; # managed by Certbot

}

[Johnny-755]

Can I help some more to trace down the bug? Will that BR stay closed until the exact bug is found?

[Johnny-755]

Hi, how do we go from here?

[alextran1502]

While waiting for this issue to be worked on, you can use normal proxy without basic auth as a workaround

[mmomjian]

#15230