sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

DC-044: fix plex.sami auto-login JS 404 (add check-session to legacy shim)

Browse Source 
The Plex/Jellyfin/Emby/chat auto-login page JS (sso-gate.js
buildLoginPage) calls /api/auth/totp/check-session — the pre-1.5.0
legacy prefix. The back-compat shim in app.js only handled
/api/auth/gate/ and /api/auth/app-token/, so check-session 404'd and
the page hung at "Signing in to Plex..." forever (user reported
2026-07-09, confirmed: request returns "Route GET /v1/auth/totp/
check-session not found").

Add /api/auth/totp/check-session to the legacy path rewrite so the JS
gets the canonical /api/v1/totp/check-session endpoint.

Verified: plex.sami/dashcaddy-login now returns the auto-login page
and the JS check-session fetch resolves to {"authenticated":true} for
active TOTP sessions.
This commit is contained in:
Krystie
2026-07-08 21:33:06 -07:00
parent d539ee3b08
commit a7b0714643
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/src/app.js
+11 -5
View File
@@ -192,12 +192,18 @@ async function createApp() {
// auto-login pages) historically call these endpoints under the pre-1.5.0
// prefix `/api/auth/...`. The canonical mount is `/api/v1`. Hand-maintained
// Caddyfiles have repeatedly drifted back to the old prefix and 404'd the SSO
// gate (breaking Plex/Jellyfin/Emby/chat). Transparently rewrite ONLY these two
// auth paths to the v1 mount so the gate is tolerant of that drift. Must run
// before configureMiddleware() so CSRF/auth see the canonical path. This is
// deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
// gate (breaking Plex/Jellyfin/Emby/chat). Transparently rewrite ONLY these
// three auth paths to the v1 mount so the gate is tolerant of that drift.
// Must run before configureMiddleware() so CSRF/auth see the canonical path.
// This is deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
// /api/auth/totp/check-session is added because the auto-login page JS in
// sso-gate.js (buildLoginPage) uses the legacy prefix; without this rewrite
// the JS gets a 404 and the page hangs at "Signing in to Plex..." forever
// (user-reported 2026-07-09).
app.use((req, res, next) => {
if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/auth/app-token/')) {
if (req.url.startsWith('/api/auth/gate/')
|| req.url.startsWith('/api/auth/app-token/')
|| req.url.startsWith('/api/auth/totp/check-session')) {
req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
}
next();