Homarr•3w ago

Internal Server Error with AUTH_OIDC_FORCE_USERINFO="true"

Logs: https://privatebin.io/?d2ac1028e434320e#AQHUZxYpTsACyFcP6Kc3YvfG3Z7AwLcM4W68zDiXN2xg I was trying to debug authelia and found out I had to add that for the new version but now the only thing that shows up is a 500 Internal Server Error Page

Send text and files securely and anonymously with end-to-end encryption (no account required) | PrivateBin

Encrypted note on Send text and files securely and anonymously with...

Visit this link to see the note. Giving the URL to anyone allows them to access the note, too.

Solution:

``` Error: Validation must be synchronous, but AUTH_OIDC_FORCE_USERINFO returned a Promise. at ensureSynchronous (/app/apps/websocket/wssServer.cjs:331605:11) at parseWithDictionary (/app/apps/websocket/wssServer.cjs:331613:5) at createEnv (/app/apps/websocket/wssServer.cjs:331659:109)...

Jump to solution

27 Replies

Cakey Bot•3w ago

Thank you for submitting a support request. Depending on the volume of requests, our team should get in contact with you shortly.

⚠️ Please include the following details in your post or we may reject your request without further comment: - Log (See https://homarr.dev/docs/community/faq#how-do-i-open-the-console--log) - Operating system (Unraid, TrueNAS, Ubuntu, ...) - Exact Homarr version (eg. 0.15.0, not latest) - Configuration (eg. docker-compose, screenshot or similar. Use ``your-text`` to format) - Other relevant information (eg. your devices, your browser, ...)

Frequently Asked Questions | Homarr documentation

Can I install Homarr on a Raspberry Pi?

Manicraft1001•3w ago

@Meierschlumpf can you take a look? @TheRedCyclops please provide the full compose / run command with your secret encryption key removed

TheRedCyclopsOP•3w ago

Compose file: https://privatebin.io/?1b1e97825b0d8848#2eCmAUPa4oMzgC7WyUNfAr8JQZPogcK617Hu6uc2DiMg Version 1.18.1 Running on OMV (Sandworm) (Debian based) It is running with traefik and authelia Relevant section of the authelia configuration:

      # Homarr
      - client_id: 'redacted-client-id'
        client_name: 'Homarr'
        client_secret: '[REDACTED]'
        authorization_policy: 'one_factor'
        redirect_uris:
          - 'https://domain.com/api/auth/callback/oidc'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
        consent_mode: 'explicit'

      # Homarr
      - client_id: 'redacted-client-id'
        client_name: 'Homarr'
        client_secret: '[REDACTED]'
        authorization_policy: 'one_factor'
        redirect_uris:
          - 'https://domain.com/api/auth/callback/oidc'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
        consent_mode: 'explicit'

Since the HTML may be the auth page here is my access control too:

access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: 'deny'
 
  rules:
    - domain_regex: '^.*\.domain\.com$'
      subject: 'group:admin'
      policy: 'one_factor'
    - domain: 'domain.com'
      resources:
      - '^/[a-z]+arr([/?].*)?$'
      - '^/qbittorrent(-private)?([/?].*)?$'
      policy: 'deny'
    - domain:
      - 'jellyfin.domain.com'
      - 'jellyseerr.domain.com'
      - 'domain.com'
      - 'auth.domain.com'
      - 'immich.domain.com'
      - 'vaultwarden.domain.com'
      policy: 'one_factor'

access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: 'deny'
 
  rules:
    - domain_regex: '^.*\.domain\.com$'
      subject: 'group:admin'
      policy: 'one_factor'
    - domain: 'domain.com'
      resources:
      - '^/[a-z]+arr([/?].*)?$'
      - '^/qbittorrent(-private)?([/?].*)?$'
      policy: 'deny'
    - domain:
      - 'jellyfin.domain.com'
      - 'jellyseerr.domain.com'
      - 'domain.com'
      - 'auth.domain.com'
      - 'immich.domain.com'
      - 'vaultwarden.domain.com'
      policy: 'one_factor'

I have managed to recreate it with a completely clean homarr

Meierschlumpf•3w ago

Okay, but I guess with the same environment variables, correct?

Solution

Meierschlumpf•3w ago

Error: Validation must be synchronous, but AUTH_OIDC_FORCE_USERINFO returned a Promise.
    at ensureSynchronous (/app/apps/websocket/wssServer.cjs:331605:11)
    at parseWithDictionary (/app/apps/websocket/wssServer.cjs:331613:5)
    at createEnv (/app/apps/websocket/wssServer.cjs:331659:109)
    at createEnv2 (/app/apps/websocket/wssServer.cjs:331706:10)
    at createEnv3 (/app/apps/websocket/wssServer.cjs:331721:31)
    at Object.<anonymous> (/app/apps/websocket/wssServer.cjs:333803:12)
    at Module._compile (node:internal/modules/cjs/loader:1730:14)
    at Object..js (node:internal/modules/cjs/loader:1895:10)
    at Module.load (node:internal/modules/cjs/loader:1465:32)
    at Function._load (node:internal/modules/cjs/loader:1282:12)

Error: Validation must be synchronous, but AUTH_OIDC_FORCE_USERINFO returned a Promise.
    at ensureSynchronous (/app/apps/websocket/wssServer.cjs:331605:11)
    at parseWithDictionary (/app/apps/websocket/wssServer.cjs:331613:5)
    at createEnv (/app/apps/websocket/wssServer.cjs:331659:109)
    at createEnv2 (/app/apps/websocket/wssServer.cjs:331706:10)
    at createEnv3 (/app/apps/websocket/wssServer.cjs:331721:31)
    at Object.<anonymous> (/app/apps/websocket/wssServer.cjs:333803:12)
    at Module._compile (node:internal/modules/cjs/loader:1730:14)
    at Object..js (node:internal/modules/cjs/loader:1895:10)
    at Module.load (node:internal/modules/cjs/loader:1465:32)
    at Function._load (node:internal/modules/cjs/loader:1282:12)

This is pretty odd, what happens when you remove the quotes?

TheRedCyclopsOP•3w ago

where?

Meierschlumpf•3w ago

From AUTH_OIDC_FORCE_USERINFO like AUTH_OIDC_FORCE_USERINFO=true instead of AUTH_OIDC_FORCE_USERINFO="true"

TheRedCyclopsOP•3w ago

I have changed the client id and secret let me try ok, that worked on the recreation, but that didn't have the expected JSON got HTML errors, let me try that in prod nope, no luck

Meierschlumpf•3w ago

Okay but thanks for trying

TheRedCyclopsOP•3w ago

These are the new logs: https://privatebin.io/?5bf9ce38e972bf04#FMxthdzYRCnw2QnaGEU4CgRa7FiK5oeKmzwRpGgsYf1h (thank you for helping, I was completely lost)

Send text and files securely and anonymously with end-to-end encryption (no account required) | PrivateBin

Encrypted note on Send text and files securely and anonymously with...

Visit this link to see the note. Giving the URL to anyone allows them to access the note, too.

Meierschlumpf•3w ago

Okay, but it seems like the error above is gone. So we are one step further

TheRedCyclopsOP•3w ago

now I'm going to try prod without the volume to see if it's something that could be fixed by a reset (at this point it would be faster) ok, that worked!, the first error, still remains though:

2025-04-30T15:55:12.194Z error: URI malformed 
    at decodeURIComponent (<anonymous>)
    at /app/apps/websocket/wssServer.cjs:331979:20
    at Array.forEach (<anonymous>)
    at parseCookies (/app/apps/websocket/wssServer.cjs:331972:27)
    at createContext (/app/apps/websocket/wssServer.cjs:455602:21)
    at /app/apps/websocket/wssServer.cjs:313960:39
    at run (/app/apps/websocket/wssServer.cjs:104:19)
    at createCtxPromise (/app/apps/websocket/wssServer.cjs:313959:22)
    at /app/apps/websocket/wssServer.cjs:314009:91
    at WebSocketServer2.<anonymous> (/app/apps/websocket/wssServer.cjs:314357:5)

2025-04-30T15:55:12.194Z error: URI malformed 
    at decodeURIComponent (<anonymous>)
    at /app/apps/websocket/wssServer.cjs:331979:20
    at Array.forEach (<anonymous>)
    at parseCookies (/app/apps/websocket/wssServer.cjs:331972:27)
    at createContext (/app/apps/websocket/wssServer.cjs:455602:21)
    at /app/apps/websocket/wssServer.cjs:313960:39
    at run (/app/apps/websocket/wssServer.cjs:104:19)
    at createCtxPromise (/app/apps/websocket/wssServer.cjs:313959:22)
    at /app/apps/websocket/wssServer.cjs:314009:91
    at WebSocketServer2.<anonymous> (/app/apps/websocket/wssServer.cjs:314357:5)

Now it successfully authenticates

Meierschlumpf•3w ago

error: URI malformed this is because of cookie parsing. Our implementation seems to be unable to parse the cookie value of something

TheRedCyclopsOP•3w ago

want a (minimaly censored) copy? it's going to be invalid as soon as a restart authelia to change the auth mode back to implicit

Meierschlumpf•3w ago

Would be great, you can also send it to my dm (remove all secret values. it's enough to just have the special chars and for example x for any other char

TheRedCyclopsOP•3w ago

any specific format?

Meierschlumpf•3w ago

We parse it from the header so in format a=b;c=d and so on, but it should not really matter. I can make it the correct format if needed

TheRedCyclopsOP•3w ago

no special chars :( I'm going to quickly check none of these allow you to log back in after a reboot of authelia

Meierschlumpf•3w ago

Okay sound like a plan, probably our method is is just bad 😉

TheRedCyclopsOP•3w ago

yup, does not allow access sent I really should build a proper dev environment for this

Meierschlumpf•3w ago

Okay I now know the problem, we use decodeURIComponent for the value but it's unable to decode the uri (or in this case value) of the authelia session token, because it contains a % sign. So I guess we have to change the logic of our algorithm a bit. Thanks for sharing, you can remove the message if you want and revoke any shared tokens So maybe if you sign out of it and back in the websocket service works as well (if the cookie value no longer contains a % character)

TheRedCyclopsOP•3w ago

nope. it appears every time, also it seems like it isn't doing the log in automatically,

Meierschlumpf•3w ago

I'll update our method and we'll release the change if all goes well this friday. Until then the realtime connections will probably not work for you then, sorry for the inconvenience

TheRedCyclopsOP•3w ago

np, thanks for all the help, I had no way to figure this out on my own

Meierschlumpf•3w ago

You're welcome 😄

TheRedCyclopsOP•3w ago

now to recreate everything

Meierschlumpf•3w ago

Second issue with URI malformed fixed with https://github.com/homarr-labs/homarr/pull/2989

GitHub

fix(cookie): parsing of header not working with percentage char by ...

Homarr Thank you for your contribution. Please ensure that your pull request meets the following pull request: Builds without warnings or errors (pnpm build, autofix with pnpm format:fix) Pull ...

Gaming

Programming

Internal Server Error with AUTH_OIDC_FORCE_USERINFO="true"

Did you find this page helpful?