# Dashboard 2 behind authenticating reverse proxy

**URL:** <https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830>\
**Category:** Dashboard\
**Tags:** dashboard-2\
**Created:** [28 July 2024 07:06 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830 "2024-07-28T07:06:32Z")\
**Posts on this page:** 7\
**Page:** 2

<div class="post-metadata">

**Author:** ![Fredrik](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fredrik/32/107652_2.png) [@Fredrik](https://discourse.nodered.org/u/Fredrik)\
**Post date:** [30 July 2024 16:54 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830/21 "2024-07-30T16:54:56Z")

</div>

@kitori It looks like Dashboard sets Access-Control-Allow-Origin to '\*' which according to Google SHOULD mean everywhere, but for some reason isn't. Anybody have any idea why, does this header need to be explicit in certain cases or something like that?

Anyway, I think you might be on to something. I've configured Traefik to overwrite the header with my explicit URL. Now let's wait and see...

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [30 July 2024 19:19 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830/22 "2024-07-30T19:19:15Z")

</div>

> [@Fredrik](#):
>
> Anybody have any idea why

The only thing I can think of immediately is that maybe browsers or the proxy are ignoring it since I don't believe it is considered good practice? It rather negates the reasons for using CORS in the first place doesn't it?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [30 July 2024 19:21 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830/23 "2024-07-30T19:21:10Z")

</div>

Actually, I thought of another possibility.

Maybe you are hitting something I came across recently as well? That [Socket.IO](http://Socket.IO) has its own header handling. Perhaps it is [Socket.IO](http://Socket.IO) connections that have problems?

---

<div class="post-metadata">

**Author:** ![kitori](https://avatars.discourse-cdn.com/v4/letter/k/f08c70/32.png) [@kitori](https://discourse.nodered.org/u/kitori)\
**Post date:** [31 July 2024 07:33 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830/24 "2024-07-31T07:33:26Z")

</div>

more tinkering:

i have 2 domains: [auth.xyz.com](http://auth.xyz.com) and [board.xyz.com](http://board.xyz.com)

**auth** -\> authelia  
**board** -\> node-red

if i am not logged in in **auth** , **auth** is requested from **board** --\> which is not allowed

 ![grafik](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/e/9/e95c972e64477ac8e5a65f8f7e8a54bb1c181084.png)

so i added this snippet to **auth**

> <https://serverfault.com/questions/958965/nginx-enabling-cors-for-multiple-subdomains/1045483#1045483>

In your case, the Domain [login.microsoft](http://login.microsoftonline.com) ist called from [noderd.furtenbach.org](http://noderd.furtenbach.org) -- which is not allowed.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [31 July 2024 07:52 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830/25 "2024-07-31T07:52:58Z")

</div>

I think probably the immediate cause is not important. The solution is to catch all failure modes on connection and force a full page reload, there are one or two situations where this does not happen. I can probably implement that but not for a couple of weeks due to pressure of other stuff.

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [31 July 2024 15:49 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830/26 "2024-07-31T15:49:42Z")

</div>

The only thing I can see is we set is this

"Content-Security-Policy", "frame-ancestors 'self' ${settings.forgeURL}"

But that's for the embedded editor iirc

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [3 September 2024 05:09 UTC](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830/28 "2024-09-03T05:09:53Z")

</div>

Closed on 3 September 2024 05:09 UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

[Previous page](https://discourse.nodered.org/t/dashboard-2-behind-authenticating-reverse-proxy/89830.md?page=1)