Login TLS issue

[declan-wade]

Hi! I love the app, really well designed and executed!

I was using it previously with Navidrome over VPN and a local IP, but I've now moved it to a reverse proxy. It works well on desktop, no issues logging in. But now, I'm getting this error on Flo:

Login Failed The resource could not be loaded because the App Transport Security policy requires the use of a secure connection.

Here is the log:

ATS Requirement Failed

POST
http://music.xxxxx.com/auth/login

URLSessionDataTask
Host: music.xxxx.com
Date: Jan 3, 2025 at 3:52:32 PM (GMT+8)
Duration: 2.4 ms

Error
Domain: NSURLErrorDomain
Code: -1022 (ATS Requirement Failed)
Description: Error Domain=NSURLErrorDomain Code=-1022 "The resource could not be loaded because the App Transport Security policy requires the use of a secure connection." UserInfo={NSLocalizedDescription=The resource could not be loaded because the App Transport Security policy requires the use of a secure connection., NSErrorFailingURLStringKey=http://music.xxxxx.com/auth/login, NSErrorFailingURLKey=http://music.xxxxx.com/auth/login, _NSURLErrorRelatedURLSessionTaskErrorKey=(
    "LocalDataTask <C44D7CB3-B87B-41C2-A071-928EF32B8CAC>.<1>"
), _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask <C44D7CB3-B87B-41C2-A071-928EF32B8CAC>.<1>, NSUnderlyingError=0x301283b70 {Error Domain=kCFErrorDomainCFNetwork Code=-1022 "(null)"}}

Request Headers (7)
Accept: */*
Accept-Encoding: br;q=1.0, gzip;q=0.9, deflate;q=0.8
Accept-Language: en-AU;q=1.0
Content-Length: 44
Content-Type: application/json
User-Agent: flo/1.4.0 (com.penerbangwalet.flo; build:5; iOS 18.2.0) Alamofire/5.9.1
X-ND-Authorization: Bearer xxxx

Request Body (44 bytes)
{
  "password": "xxxx",
  "username": "xxxx"
}

Response Body
–

I'm not sure if this is a config issue with Navidrome? I have checked the documentation and the reverse proxy settings are correctly setup, I'm not using certificates directly - it's being handled by Cloudflare if it makes any difference? Happy to provide more logs or further information if required.

Thanks!

[faultables]

is it work if the server url is https://music.xxxxx.com instead of music.xxxxx.com?

[declan-wade]

is it work if the server url is https://music.xxxxx.com instead of music.xxxxx.com?

Hmm,I've only tried it with https, it seems that's what it's using in the UI - not sure if it's been cached though...

[faultables]

based on the log you attached above, I assume the server URL is using HTTP?

ATS Requirement Failed

POST
http://music.xxxxx.com/auth/login

URLSessionDataTask
Host: music.xxxx.com
Date: Jan 3, 2025 at 3:52:32 PM (GMT+8)
Duration: 2.4 ms

...

And for this:

I'm not sure if this is a config issue with Navidrome? I have checked the documentation and the reverse proxy settings are correctly setup, I'm not using certificates directly - it's being handled by Cloudflare if it makes any difference? Happy to provide more logs or further information if required.

i think your Navidrome & Cloudflare setup is fine! as long as you can access the Navidrome Web UI in your browser

also, based on the screenshot above, did you enable the "Save login info" experimental feature? The server URL is cached by the app, and I'm not entirely sure if I tested it when the server URL was changed. how about trying to log out and log back in?

[declan-wade]

I think I have fixed it!

The Navidrome server itself accepts http, but Cloudflare only accepts https.

I deleted and re-installed the app, and now it magically works:

200 OK

GET
https://music.xxxx.com/rest/getScanStatus?u=admin&t=xxx&s=46db63&v=1.16.1&c=flo&f=json

URLSessionDataTask
Host: music.xxxx.com
Date: Jan 4, 2025 at 12:24:50 PM (GMT+8)
Duration: 1.001 s

Request Headers (3)
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-AU,en;q=0.9

Request Body
–

Response Headers (17)
Alt-Svc: h3=":443"; ma=86400
Content-Encoding: gzip
Content-Length: 203
Content-Type: application/json
Date: Sat, 04 Jan 2025 04:24:51 GMT
Server: cloudflare
Set-Cookie: blah; Max-Age=31536000; HttpOnly; SameSite=Strict
Strict-Transport-Security: max-age=2592000; includeSubDomains; preload
Vary: Origin, Accept-Encoding
cf-cache-status: DYNAMIC
cf-ray: 8fc876150e4240f0-SIN
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy: autoplay=(), camera=(), microphone=(), usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xxx"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-frame-options: DENY

Response Body (240 bytes)
{
  "subsonic-response": {
    "openSubsonic": true,
    "scanStatus": {
      "count": 15254,
      "folderCount": 1335,
      "lastScan": "2025-01-04T04:00:29.003708982Z",
      "scanning": false
    },
    "serverVersion": "0.54.3 (734eb30a)",
    "status": "ok",
    "type": "navidrome",
    "version": "1.16.1"
  }
}

To answer your question, yes I did briefly have 'save login info' enabled, it might have had the wrong protocol originally (I can't remember 😅). I did set it to 'off' before raising the bug.

I would say that there was some sort of caching issue as the UI was showing https:// and the request was http:// but there were quite a few variables - sorry!

Thanks for your assistance 😁