2026.3 libwebem change results in unauthenticated admin access Topic is solved

[domovincent]

Sorry for cross posting, but maybe it's okay because my original post is a reply to the release, and it won't be seen quickly enough.
Version: 2026.3
Platform: Linux binary
Plugin/Hardware: core webserver
Description:
- New libwebem ignores proxy headers by default. Forwarded headers are now ignored unless the new trusted_proxy_header_family setting is explicitly configured. Its new default is None.
- Domoticz does not configure this new header-family setting.
- Domoticz sees trusted proxy IP, and grants all clients admin access without login.

This applies to: setups with trusted reverse proxy in front of Domoticz with X-Forwarded-For to forward real client IPs.

Fix: Add headers explicitly to the libwebem config:
https://github.com/domoticz/domoticz/pull/6937

We probably want to do a quick patch release here.

[rugspin]

Just a question on the above.

In my local network, I use nginx as a revers proxy on the same host as domoticz is running, just to have a decent url and not always have to put the port number. It looks like that and was working fine so far:

Code: Select all

    ########################################
    # domoticz
    ########################################
    # domoticz
    location = /domoticz {
        return 301 /domoticz/;
    }

    location ^~ /domoticz/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:8085/;
        proxy_ssl_trusted_certificate /opt/domoticz-docker/domoticz-com.pem;
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 2;
        proxy_redirect off;
    }

Now when I do the

Code: Select all

https://<hostnname>/domoticz/

I get error: "403 Forbidden"

But with

Code: Select all

http://127.0.0.1:8085/

everything is fine.

I'm not much of an expert in reverse proxies, but is that related to the above problem with revers proxies?
Would be glad about some help.

[domovincent]

@rugspin that is a different issue. There's some nice reverse proxy examples on the wiki. The logs of your proxy are usually very helpful as well.

On the main topic: the latest beta fixes the issue (About page states Compile Date 2026-08-02 18:55:45). Just installed and tested. X-Forwarded-For works as expected.

[rugspin]

@rugspin that is a different issue. There's some nice reverse proxy examples on the wiki. The logs of your proxy are usually very helpful as well.

On the main topic: the latest beta fixes the issue (About page states Compile Date 2026-08-02 18:55:45). Just installed and tested. X-Forwarded-For works as expected.

Somehow, my reverse proxy was affected. The 2026-08-02 18:55:45 version showed that strange behavior.
Now, I have 2026-08-03 16:43:35 and it works as before.
Thanks for the help.

[domovincent]

Oh, well, that's unexpected. But good news nonetheless.

[gizmocuz]

You need to proxy to HTTP, NPM is doing the certificates