CSP error on /preferences/test-notification

[RuralAnemone]

Support guidelines

• I've read the support guidelines

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem
• ... it's definitely a Firefly III issue, not me

Description

Caveat: this may be due to my exact setup

the following paths (and more?) give me a CSP error from a scheme mismatch:

• json/intro/preferences_index
• /preferences/test-notification

Firefly III is trying to use http on these when it should be using https.

edit: censor my instance url better (:

Debug information

Debug information generated at 2025-06-04 22:53:46 for Firefly III version v6.2.16.

System information
Item	Value
Firefly III	v6.2.16 / #25 (expects #25)
PHP version	8.4.7 (64bits) / fpm-fcgi / Linux x86_64
BCscale	12
Error reporting	Display: Off, reporting: ALL errors
Max upload	104857600 (100 MB)
Database drivers	*mysql*, pgsql, sqlite,

Firefly III information
Item	Value
Timezone	Europe/Amsterdam + America/Chicago
App environment	production, debug: false
Layout	v1
Logging	notice, stack / (empty)
Cache driver, session driver	file, file
Default language and locale	en_US + equal
Trusted proxies
Login provider & user guard	eloquent / web
Login headers	N/A + N/A
Stateful domains
Last cron job	2025-06-03 22:00:00 (22 hours ago)
Mailer	log
Exchange rates	Disabled, downloads disabled
RB-column	Disabled

User-specific information
Item	Value
User	#1 of 1
User flags	🐷 🔧 📑 📧
Native currency	USD
Convert to native currency?	Disabled
Session start	2025-06-01 00:00:00
Session end	2025-06-30 23:59:59
View range	1M
User language	en_US
User locale	en_US
Locale(s) supported	en_US.utf8: ✅ en_US.UTF-8: ✅
User agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Expected behaviour

Test notification gets sent out. (and other endpoints succeed as well)

Steps to reproduce

• use cloudflared tunneling
• don't use port 80?
• otherwise default setup

Additional info

My setup is:

neofetch

       _,met$$$$$gg.          doed@edward 
    ,g$$$$$$$$$$$$$$$P.       ----------- 
  ,g$$P"     """Y$$.".        OS: Debian GNU/Linux 12 (bookworm) x86_64 
 ,$$P'              `$$$.     Host: Precision WorkStation 690 
',$$P       ,ggs.     `$$b:   Kernel: 6.1.0-37-amd64 
`d$$'     ,$P"'   .    $$$    Uptime: 4 days, 22 hours, 45 mins 
 $$P      d$'     ,    $$P    Packages: 2237 (dpkg) 
 $$:      $$.   -    ,d$$'    Shell: bash 5.2.15 
 $$;      Y$b._   _,d$P'      Resolution: 1920x1200 
 Y$$.    `.`"Y$$$$P"'         Terminal: /dev/pts/1 
 `$$b      "-.__              CPU: Intel Xeon 5150 (4) @ 2.657GHz 
  `Y$$                        GPU: NVIDIA Quadro FX 1700 
   `Y$$.                      Memory: 2638MiB / 32093MiB 
     `$$b.
       `Y$$b.                                         
          `"Y$b._                                     
              `"""

• Docker version 28.2.2, build e6534b4
• I used the importer docker-container setup, and set the main app's port to 3030 as I have a webserver already on 80. I left the importer on 81 though that doesn't really matter for this.
• using cloudflared tunneling, default setup with http://localhost:3030
  ...and that's it. I can also share my .envs if need be.
  This is absolutely not make-or-break for me, I very much love and enjoy Firefly III (:

[JC5]

Hey, thanks for starting this discussion.

Since you're tunnelling, I expect this solution does not work (but you could try it). Depending on your webserver you need to make sure that you set it up to serve https URLs like so.

Cheers,
James

[RuralAnemone]

I've tried both to no avail...

With my very limited knowledge of nginx, I assume by "add to location block" you mean:

/var/www/html/nginx_app.conf becomes, from the default:

# prevent HTTPoxy vulnerability
fastcgi_param HTTP_PROXY "";

location / {
    if ( != "https") {
        return 301 https://;
    }
    # try to serve file directly, fallback to rewrite
    try_files  @rewriteapp;

    proxy_set_header X-Forwarded-Proto ;
    proxy_set_header X-Forwarded-Host ;
    proxy_set_header X-Forwarded-Server ;
    proxy_set_header X-Forwarded-For ;
    proxy_set_header Host ;
    # This line is optional and may help in some cases.
    proxy_set_header X-Forwarded-Port ;
    client_max_body_size 64M;
    proxy_read_timeout 300s;
}

location @rewriteapp {
    # rewrite all to index.php
    rewrite ^(.*)$ /index.php last;
}

[JC5]

 proxy_set_header X-Forwarded-Proto ;
    proxy_set_header X-Forwarded-Host ;
    proxy_set_header X-Forwarded-Server ;
    proxy_set_header X-Forwarded-For ;

Why are the values for these headers missing?

[RuralAnemone]

OH I see now lol
they're missing because of my limited knowledge of nginx (:

I'm honestly not sure why they were inputted empty though as the documentation uses the variables

[RuralAnemone]

this is what I get for blindly using cat and heredoc

[RuralAnemone]

my config is now

# prevent HTTPoxy vulnerability
fastcgi_param HTTP_PROXY "";

location / {
    if ($http_x_forwarded_proto != "https") {
        return 301 https://$host$request_uri;
    }

    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    # This line is optional and may help in some cases.
    proxy_set_header X-Forwarded-Port $server_port;

    client_max_body_size 64M;
    proxy_read_timeout 300s;
    # try to serve file directly, fallback to rewrite
    try_files $uri @rewriteapp;
}

location @rewriteapp {
    # rewrite all to index.php
    rewrite ^(.*)$ /index.php last;
}

...and it seems to be the same issue as #10390

[RuralAnemone]

This might be the same issue as #10390?? not sure

[RuralAnemone]

I messed around with a bunch of nginx config and eventually just rebuit the container
and now it works?? I have no idea why though
my app block in my docker-compose.yml now looks like this and I'm really curious what all made the difference:

services:
  app:
    image: fireflyiii/core:latest
    hostname: app
    container_name: firefly_iii_core
    networks:
      - firefly_iii
    restart: always
    volumes:
      - firefly_iii_upload:/var/www/html/storage/upload
      - /etc/letsencrypt/live/f3.domain.tld:/var/www/certificates
      - /var/www/html/.well-known/acme-challenge:/var/www/html/public/.well-known/acme-challenge
    env_file: .env
    ports:
      - '3030:8080'
      - '443:8080'
    depends_on:
      - db
# etc

yippee (:

[RuralAnemone]

I did also threaten to set up portainer but never actually used it... but it's still running on my docker socket