[Bug]: ProxyAuth crashes with "Invalid character" on Non-ASCII/Cyrillic Names (OIDC works fine) #262

New issue

Closed

opened 2026-01-07 09:30:59 -06:00 by dimka511 · 2 comments

dimka511 commented

2026-01-07 09:30:59 -06:00

(Migrated from github.com)

Describe the bug:

When using Cyrillic (or other non-ASCII) characters in the User Profile Name field, authentication via ProxyAuth fails, causing the application to crash with an Invalid character in header content error.

However, OIDC authentication works perfectly fine with the same Cyrillic name. The issue seems isolated to ProxyAuth, likely because it attempts to inject the raw Name string into the Remote-Name HTTP header, which Node.js rejects if it contains non-ASCII characters.

To Reproduce:

Go to Settings -> Profile.
Change the Name field to a string containing Cyrillic characters (e.g., Дима or Администратор).
Save the profile.
Attempt to access a service configured to use ProxyAuth (Forward Auth).
Observe the "Internal Server Error" in the browser and the crash in the container logs.

Expected behavior:

The application should handle non-ASCII characters in ProxyAuth headers correctly. The value for the Remote-Name header should be encoded (e.g., URL-encoded/percent-encoded) or sanitized before being set, as the Node.js HTTP implementation strictly prohibits non-ASCII characters in headers.

Database Driver:

postgres:16-alpine

Screenshots:

Additional context:

Logs:

voidauth-1     | Connected to postgres database.
voidauth-1     | Listening on port: 3000
voidauth-1     | (node:1) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
voidauth-1     | (Use `node --trace-deprecation ...` to show where the warning was created)
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]
voidauth-1     | Invalid character in header content ["Remote-Name"]

### Describe the bug: When using Cyrillic (or other non-ASCII) characters in the User Profile Name field, authentication via ProxyAuth fails, causing the application to crash with an Invalid character in header content error. However, OIDC authentication works perfectly fine with the same Cyrillic name. The issue seems isolated to ProxyAuth, likely because it attempts to inject the raw Name string into the Remote-Name HTTP header, which Node.js rejects if it contains non-ASCII characters. ### To Reproduce: 1. Go to Settings -> Profile. 2. Change the Name field to a string containing Cyrillic characters (e.g., Дима or Администратор). 3. Save the profile. 4. Attempt to access a service configured to use ProxyAuth (Forward Auth). 5. Observe the "Internal Server Error" in the browser and the crash in the container logs. ### Expected behavior: The application should handle non-ASCII characters in ProxyAuth headers correctly. The value for the Remote-Name header should be encoded (e.g., URL-encoded/percent-encoded) or sanitized before being set, as the Node.js HTTP implementation strictly prohibits non-ASCII characters in headers. ### Database Driver: postgres:16-alpine ### Screenshots:  <img width="1920" height="710" alt="Image" src="https://github.com/user-attachments/assets/a3b1fcee-e092-4c4b-b700-a740159db1be" /> ### Additional context: Logs: ``` voidauth-1 | Connected to postgres database. voidauth-1 | Listening on port: 3000 voidauth-1 | (node:1) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead. voidauth-1 | (Use `node --trace-deprecation ...` to show where the warning was created) voidauth-1 | Invalid character in header content ["Remote-Name"] voidauth-1 | Invalid character in header content ["Remote-Name"] voidauth-1 | Invalid character in header content ["Remote-Name"] voidauth-1 | Invalid character in header content ["Remote-Name"] voidauth-1 | Invalid character in header content ["Remote-Name"] ```

👍 1

notquitenothing commented

2026-01-07 18:53:59 -06:00

(Migrated from github.com)

Good catch, I should be able to release a fix for this shortly.

notquitenothing commented

2026-01-08 07:35:14 -06:00

(Migrated from github.com)

Should be fixed in the v1.9.0 release, going to close but please re-open if needed.

Should be fixed in the [v1.9.0](https://github.com/voidauth/voidauth/releases/tag/v1.9.0) release, going to close but please re-open if needed.

👍 1