Authentication Logs not working on Portainer-EE behind reverse proxy

[Fratt]

Bug description
"Authentication Logs" don't work if your Portainer-EE is behind a reverse proxy that serves portainer in a subfolder.
e.g. https://my.host.com/portainer/
The reason is that the path is absolute (/api/) instead of relative (api/)

Expected behavior
"Authentication Logs" works.

Portainer Logs

Steps to reproduce the issue:

1. Put Portainer behind a reverse proxy where it's served under a subfolder.
2. Try to access "Authentication logs"

Technical details:

• Portainer version: 2.14.0 (and 2.13.1 as well)
• Docker version (managed by Portainer): 20.10.17, build 100c701
• Platform (windows/linux): Linux Unbuntu Server 22.04 LTS
• Command used to start Portainer (docker run -p 9443:9443 portainer/portainer):

sudo docker run -d \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v portainer_data:/data \
    --network=traefik_default \
    --label 'traefik.enable=true' \
    --label 'traefik.docker.network=traefik_default' \
    --label 'traefik.http.routers.portainer.entrypoints=web,websecure' \
    --label 'traefik.http.routers.portainer.middlewares=portainer_strip-prefix' \
    --label 'traefik.http.routers.portainer.rule=Host(`my.host.com`) && PathPrefix(`/portainer`)' \
    --label 'traefik.http.routers.portainer.tls=true' \
    --label 'traefik.http.routers.portainer.tls.certresolver=production' \
    --label 'traefik.http.services.portainer.loadbalancer.server.port=9000' \
    --label 'traefik.http.middlewares.portainer_strip-prefix.stripprefix.prefixes=/portainer,/portainer/' \
    --name portainer \
    --restart=always \
    portainer/portainer-ee:2.14.0

• Browser: Firefox 101.0.1
• Use Case (delete as appropriate): Using Portainer at Home
• Have you reviewed our technical documentation and knowledge base? Yes

Additional context

[Fratt]

This still happens in Portainer EE 2.14.0 : I updated the ticket

[samdulam]

Fix for this issue is not in 2.14.0, slated for the next release.

[Fratt]

Thank you for the answer @samdulam !

[tomgidden]

I've been trying a similar configuration with strippath, too, in 2.14.1. Auth logs fail for me the same way. It triggers the basic-auth I have on /api in Traefik (don't ask) and invalidates my session.

In addition, If I try to click "Helm" in the sidebar it fails in the same way, as an API call goes to /api/templates/helm?repo=... rather than [/portainer/]api/templates/helm?repo=...

I'm guessing this is an unsupported configuration, but it's a shame almost all of the API calls work just fine in this configuration but these two don't. It might be worth looking for similar occurrences of /api.

[WaysonWei]

Closing this issue as we already completed the fixed and that will go into Portainer EE 2.15 release. Thanks.