`tailscale web` does not allow login from Docker container (including Home Assistant)

[tendstofortytwo]

What is the issue?

tailscale web for a tailscaled running in a Docker container fails with "Failed to login". Looking at the web console, there is an "invalid origin" error.

Steps to reproduce

1. docker create -i -t --name=Tailscale --privileged \
        --net=host \
        --cap-add NET_ADMIN \
        --cap-add NET_RAW \
        --cap-add SYS_ADMIN \
        -v /share/Docker/Tailscale:/var/lib/tailscale:rw \
        -v /dev/net/tun:/dev/net/tun \
        --restart unless-stopped \
        tailscale/tailscale:latest tailscaled --port=41641```
   

2. docker exec Tailscale tailscale web
3. Go to http://localhost:8088 and try to log in

Are there any recent changes that introduced the issue?

No response

OS

Linux

OS version

Reproduced on Fedora 41, ASUSTOR NAS

Tailscale version

1.80.0

Other software

No response

Bug report

No response

[lmagyar]

This issue breaks all (new) Home Assistant installations also.

cc @willnorris based on previous comments on hassio-addons/addon-tailscale#314

[lmagyar]

Note: #15108 is related, can be fixed at the same time.

[lmagyar]

I've tested this login issue with TS v1.80.2 (through ingress), only http access were broken, https worked.

Users of TS v1.80.0 reported that both http and https is broken.

[lmagyar]

Still broken in v1.80.3

But now https got broken, and http works.

[patrickod]

hey folks, thanks for the report.

The library we use for CSRF prevention in the web UI recently changed its behavior to presume that all traffic is served over TLS and requires the consuming app to signal via a request context variable if instead it is using plaintext HTTP (this information is necessary to perform origin checks on inbound requests). The 1.80.0 release contained a bug where this signaling only occurred after the CSRF middleware had already executed and so requests were incorrectly denied with an "invalid origin" error.

My understanding based on the comments in this & other threads is that users who were accessing their web UI via a TLS terminating reverse proxy would have accidentally sidestepped this bug in 1.80.0.

The 1.80.3 release included #15156 which fixed the ordering of the middleware/signaling and restored functionality for users accessing the web UI over their tailnet IP or via plain HTTP. However, as you note access via TLS is still broken.

My current thought is to make this CSRF middleware TLS signaling optional via a new flag for the tailscale web command.

@lmagyar do you know if there is any way for HA addons to discover whether they're being exposed over TLS in the HA web UI? my thought would be to use that configuration information to optionally set that flag in the HA config

[lmagyar]

Thanks for the detailed explanation!

do you know if there is any way for HA addons to discover whether they're being exposed over TLS in the HA web UI?

Disclaimer: I don't have deep knowledge about HA internals, and in case of web "development" I'm a total newbie.

TLDR: I don't think it is possible

Usually HA exposed on a plain http port and eg. an nginx add-on (+duckdns, letsencrypt) provides https access on another port, so users on the LAN can access both. In this case TLS is terminated outside of HA, and HA forwards plain http traffic to TS add-on, but the browser sees https traffic (and my web/CSRF knowledge ends here).

But HA can serve https traffic on it's own (certs created by eg. duckdns add-on), but this is discouraged when TS add-on is used, because TS's serve/funnel can forward traffic only to a plain http port. But not everybody uses serve/funnel.

[lmagyar]

Note: I'm just googled for it, I have zero knowledge about these things.

If I understand correctly, an X-Forwarded-Proto header would be useful, but eg. the default nginx add-on (seems to me) doesn't use this: https://github.com/home-assistant/addons/blob/master/nginx_proxy/rootfs/etc/nginx/nginx.conf.gtpl#L92

Though HA core uses:

• when exposes itself as http(s): https://github.com/home-assistant/core/blob/dev/homeassistant/components/http/forwarded.py#L19
• when forwards traffic toward the add-on's: https://github.com/home-assistant/core/blob/dev/homeassistant/components/hassio/ingress.py#L261

Maybe add it to the nginx add-on??? A one-liner???