Update to 1.23.9 How to set an environment variable UPTIME_KUMA_WS_ORIGIN_CHECK #4210

BabyYodaOne · 2023-12-10T21:09:54Z

⚠️ Please verify that this bug has NOT been raised before.

I checked and didn't find similar issue

🛡️ Security Policy

I agree to have read this project Security Policy

📝 Describe your problem

Hi,
I have updated to 1.23.9 and as listed in the warning banner, it broke my SSL domain origin. I used your docker install method and updated using your default values. I don't know where or which file contains the environment variable to change to bypass.
Could you please point me to the file name and location so I can change the variable to bypass?

Thank you for your help.

Additional verification of the HTTP Origin header has been added to the socket.io connection handler. By default, if the Origin header is present, it would be checked against the Host header. Connection would be denied if the hostnames do not match, which would indicate that the request is cross-origin. Connection would be allowed if the Origin header is not present.

Users can override this behaviour by setting environment variable UPTIME_KUMA_WS_ORIGIN_CHECK=bypass.
(What is the file name and location to make this change? Using the Docker default values and method)

📝 Error Message(s) or Log

No response

🐻 Uptime-Kuma Version

1.23.9

💻 Operating System and Arch

Ubunut 22

🌐 Browser

Firefox

🐋 Docker Version

No response

🟩 NodeJS Version

No response

louislam · 2023-12-10T21:16:59Z

Add -e UPTIME_KUMA_WS_ORIGIN_CHECK="bypass"

docker run -d --restart=always -p 3001:3001 -e UPTIME_KUMA_WS_ORIGIN_CHECK="bypass" -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1

louislam · 2023-12-10T21:22:48Z

But I am curious, how could it be affected by this in details?

Because for my instance, my SSL cert is provided by Cloudflare. It is still working without bypass: https://status.kuma.pet
Origin: https://status.kuma.pet
WebSocket server: wss://status.kuma.pet
It is matched.

BabyYodaOne · 2023-12-10T21:24:46Z

That fixed it, thank you very much.
Will be sponsoring you on such a great and useful tool.

That command you gave me, for newbies like me who was just introduced to your project, would be great to have in the release notes. I was not aware of how to pass those variables using the command line. I thought I needed to edit a config file and change the option to "bypass"
I know now though.
Thanks again.

BabyYodaOne · 2023-12-10T21:34:23Z

So my install for the SSL I followed a tutorial. Installed Apache and used certbot for a Let's Encrypt SSL.
As soon as I did the upgrade, I got the red banner, indicating a websocket, reverse proxy issue.

CommanderStorm · 2023-12-10T21:49:22Z

Could you have a look if you have these paramerters enabled? louislam/uptime-kuma-wiki#73

(The same issue was raised last week in #4168, but @luchris did not respond if this addressed the issue [and therefore should be added to the wiki])

ErminMerdanovic · 2023-12-10T22:49:35Z

Encountered the same issue today when updating to the latest version of Uptime Kuma. Faced a WebSocket connection problem, but after incorporating the following into my Docker Compose file:
environment: UPTIME_KUMA_WS_ORIGIN_CHECK: "bypass"
everything started working again. Running it with Apache reverse proxy and Cloudflare.

louislam · 2023-12-11T01:14:40Z

Actually, using bypass is not a good idea, since it is a part of security fix.

If anyone encountered this, can you check your log and show me the error here?

Should be similar to this:
Origin (https://xxxxx.com) does not match host (xxxx.com), IP: 1.2.3.4

I want to see why the hostname do not match.

@BabyYodaOne Appreciated! Will try to reproduce this with Apache reverse proxy

louislam · 2023-12-11T02:19:09Z

Never mind, I am able to reproduce it now.

compose.yaml

version: "3.8"
services:
  uptime-kuma:
    image: louislam/uptime-kuma:1
    volumes:
      - ./data:/app/data
    restart: unless-stopped
  apache:
    restart: unless-stopped
    image: php:8.2-apache-bullseye
    ports:
      - 80:80
    volumes:
      - ./sites-enabled:/etc/apache2/sites-enabled
    command: |
      sh -c 'a2enmod rewrite proxy_http && apache2-foreground'
networks: {}

./sites-enabled/uptime-kuma.conf

<VirtualHost *:80>
  ServerName instance-tokyo-arm

  ProxyPass / http://uptime-kuma:3001/
  RewriteEngine on
  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteCond %{HTTP:Connection} upgrade [NC]
  RewriteRule ^/?(.*) "ws://uptime-kuma:3001/$1" [P,L]
</VirtualHost>

Error:

2023-12-11T10:11:38+08:00 [AUTH] ERROR: Origin (http://instance-tokyo-arm) does not match host (uptime-kuma:3001), IP: ::ffff:172.23.0.2

It seems that the Host header is being overridden by Apache unfortunately, not sure about other reverse proxy apps.

Let's see how to handle this smoothly.

louislam · 2023-12-11T02:28:47Z

Ah, so the better solution would be using ProxyPreserveHost on in the VirtualHost like this:

<VirtualHost *:80>
  ServerName instance-tokyo-arm

  # ADD THIS
  ProxyPreserveHost on

  ProxyPass / http://uptime-kuma:3001/
  RewriteEngine on
  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteCond %{HTTP:Connection} upgrade [NC]
  RewriteRule ^/?(.*) "ws://uptime-kuma:3001/$1" [P,L]
</VirtualHost>

Added a caution message in the changelog https://github.com/louislam/uptime-kuma/releases/tag/1.23.9

louislam · 2023-12-11T03:57:35Z

Maybe I was too confident and underestimated it (again). The breaking change impact of this security fix is very big, since it is not just affecting Apache only. It is affecting across many reverse proxy apps.

~~1.23.X should not contains such a big breaking change. My new plan would be:~~

~~1.23.10~~
- ~~Change the default to bypass~~
- ~~Add an alert in the UI to advise the user that they should change to cors-like + some guides~~
~~2.0.0~~
- ~~Default to cors-like~~

chakflying · 2023-12-11T08:02:43Z

It is a pretty big security risk if someone is running no-auth mode. Personally I think passing through the host header is a pretty reasonable thing for a reverse proxy to do, and the config change is not difficult (just 1 line), there should be no need to revert.

Nuklon · 2023-12-11T09:04:36Z

Anyone got this to work with IIS? I can set UPTIME_KUMA_WS_ORIGIN_CHECK to bypass but I cannot seem to get rewrite to work.

chakflying · 2023-12-11T09:18:01Z

Assuming you are talking about this specific reverse proxy websocket connection issue, according to this answer, there is a specific setting for preserving the host header. Have you tried setting this setting?

Nuklon · 2023-12-11T13:42:54Z

Assuming you are talking about this specific reverse proxy websocket connection issue, according to this answer, there is a specific setting for preserving the host header. Have you tried setting this setting?

Thanks, that worked.

brainsys · 2023-12-11T15:58:18Z

Sorry, I'm still confused. Where is the file I need to set the UPTIME_KUMA_WS_ORIGIN_CHECK variable? I have searched the installed uptime-kima directory/subdirectories with grep to find if it already exists and got a null response. Apologies if it's so obvious I missed it.

(It's a plain, not a Docker install).

louislam · 2023-12-11T16:04:34Z

@brainsys I am now working on 1.23.10 which should not cause this breaking change anymore.

You can stick back to 1.23.8 first.

elipromark · 2023-12-11T17:08:44Z

Anyone know if this breaks cloudflare tunnels formerly argo tunnels ?

louislam · 2023-12-11T17:11:53Z

Anyone know if this breaks cloudflare tunnels formerly argo tunnels ?

It is OK, my intance is using Cloudflare Tunnel: https://status.kuma.pet/dashboard

elipromark · 2023-12-11T17:13:02Z

Anyone know if this breaks cloudflare tunnels formerly argo tunnels ?

It is OK, my instance is using Cloudflare Tunnel: https://status.kuma.pet/dashboard

Great Updating now (Good to know CF is used to test updates)

crittersfritters · 2023-12-12T02:52:34Z

Anyone know if this breaks cloudflare tunnels formerly argo tunnels ?

It is OK, my instance is using Cloudflare Tunnel: https://status.kuma.pet/dashboard

Great Updating now (Good to know CF is used to test updates)

Is this working as intended for you? My setup will block the connection using the CF tunnel linked to it. It's unusually not blocking the status page itself, which is set to default. But when I try to open the manager, it gets the websocket error.

elipromark · 2023-12-12T14:44:57Z

Anyone know if this breaks cloudflare tunnels formerly argo tunnels ?

It is OK, my instance is using Cloudflare Tunnel: https://status.kuma.pet/dashboard

Great Updating now (Good to know CF is used to test updates)

Is this working as intended for you? My setup will block the connection using the CF tunnel linked to it. It's unusually not blocking the status page itself, which is set to default. But when I try to open the manager, it gets the WebSocket error.

Works for me no issues

louislam · 2023-12-12T17:43:22Z

1.23.10 has been released, it should cause no issue now.

If you added UPTIME_KUMA_WS_ORIGIN_CHECK=bypass, not because of 3rd-party apps, you should remove it.

CommanderStorm · 2023-12-14T19:54:12Z

Closing as #4216 was merged and 1.23.10 released

opvexe · 2024-02-27T09:29:27Z

添加-e UPTIME_KUMA_WS_ORIGIN_CHECK="bypass"

docker run -d --restart=always -p 3001:3001 -e UPTIME_KUMA_WS_ORIGIN_CHECK="bypass" -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1

don't work ..

CommanderStorm · 2024-02-27T11:41:20Z

@opvexe
Please open a new issue with full context.
You cited the first comment in this thread. Please make shure that you have read the whole thread before doing so.

BabyYodaOne added the help label Dec 10, 2023

CommanderStorm mentioned this issue Dec 10, 2023

Reverse Proxy - Apache + certbot #4168

Closed

2 tasks

chakflying changed the title ~~Update to 1.23.9 HOW TO: You can set an environment variable UPTIME_KUMA_WS_ORIGIN_CHECK to bypass to skip this check.~~ Update to 1.23.9 How to set an environment variable UPTIME_KUMA_WS_ORIGIN_CHECK Dec 11, 2023

louislam linked a pull request Dec 11, 2023 that will close this issue

Smoothing the update for origin check #4216

Merged

6 tasks

CommanderStorm closed this as completed Dec 14, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update to 1.23.9 How to set an environment variable UPTIME_KUMA_WS_ORIGIN_CHECK #4210

Update to 1.23.9 How to set an environment variable UPTIME_KUMA_WS_ORIGIN_CHECK #4210

BabyYodaOne commented Dec 10, 2023

louislam commented Dec 10, 2023

louislam commented Dec 10, 2023

BabyYodaOne commented Dec 10, 2023

BabyYodaOne commented Dec 10, 2023

CommanderStorm commented Dec 10, 2023 •

edited

Loading

ErminMerdanovic commented Dec 10, 2023

louislam commented Dec 11, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading

chakflying commented Dec 11, 2023 •

edited

Loading

Nuklon commented Dec 11, 2023

chakflying commented Dec 11, 2023

Nuklon commented Dec 11, 2023

brainsys commented Dec 11, 2023

louislam commented Dec 11, 2023 •

edited

Loading

elipromark commented Dec 11, 2023

louislam commented Dec 11, 2023

elipromark commented Dec 11, 2023

crittersfritters commented Dec 12, 2023

elipromark commented Dec 12, 2023

louislam commented Dec 12, 2023

CommanderStorm commented Dec 14, 2023

opvexe commented Feb 27, 2024

CommanderStorm commented Feb 27, 2024

Update to 1.23.9 How to set an environment variable UPTIME_KUMA_WS_ORIGIN_CHECK #4210

Update to 1.23.9 How to set an environment variable UPTIME_KUMA_WS_ORIGIN_CHECK #4210

Comments

BabyYodaOne commented Dec 10, 2023

⚠️ Please verify that this bug has NOT been raised before.

🛡️ Security Policy

📝 Describe your problem

📝 Error Message(s) or Log

🐻 Uptime-Kuma Version

💻 Operating System and Arch

🌐 Browser

🐋 Docker Version

🟩 NodeJS Version

louislam commented Dec 10, 2023

louislam commented Dec 10, 2023

BabyYodaOne commented Dec 10, 2023

BabyYodaOne commented Dec 10, 2023

CommanderStorm commented Dec 10, 2023 • edited Loading

ErminMerdanovic commented Dec 10, 2023

louislam commented Dec 11, 2023 • edited Loading

louislam commented Dec 11, 2023 • edited Loading

louislam commented Dec 11, 2023 • edited Loading

louislam commented Dec 11, 2023 • edited Loading

chakflying commented Dec 11, 2023 • edited Loading

Nuklon commented Dec 11, 2023

chakflying commented Dec 11, 2023

Nuklon commented Dec 11, 2023

brainsys commented Dec 11, 2023

louislam commented Dec 11, 2023 • edited Loading

elipromark commented Dec 11, 2023

louislam commented Dec 11, 2023

elipromark commented Dec 11, 2023

crittersfritters commented Dec 12, 2023

elipromark commented Dec 12, 2023

louislam commented Dec 12, 2023

CommanderStorm commented Dec 14, 2023

opvexe commented Feb 27, 2024

CommanderStorm commented Feb 27, 2024

CommanderStorm commented Dec 10, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading

chakflying commented Dec 11, 2023 •

edited

Loading

louislam commented Dec 11, 2023 •

edited

Loading