Evgen/3x-ui-pro
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add h2/http1.1 ALPN to tls hosts; make raw diag link self-authorize

Browse Source 
Host ALPN: ws/xhttp/trojan hosts now advertise ["h2","http/1.1"];
reality host gets [] (its ALPN comes from the reality stream).

Diagnostics access: opening the diag path directly without the
diag_key cookie previously 404'd, so a bookmarked link only worked
after manually visiting /<panel_path>/diag. Now the diag page
302-bounces unauthenticated hits through the SSO bridge, which
validates the 3x-ui panel session and mints the cookie, then redirects
back - so the link works once you're logged into the panel. API and
asset sub-locations still 404 without the cookie (only the HTML page
redirects, never XHR/asset requests).

Verified end to end with nginx + the auth semantics of the installed
3x-ui v3.4.2: logged-in raw hit resolves to the page with no loop,
anonymous hit lands on the panel login.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Ivan Razin
2026-07-03 15:54:56 +03:00
co-authored by Claude Fable 5
parent 716840a691
commit ba6d9ca1d2
3 changed files with 22 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
x-ui-latest.sh
+10 -8
View File
@@ -525,10 +525,12 @@ server {
}
# ── Network diagnostics page ─────────────────────────────────────────────
# Requires the diag cookie (issued by the SSO bridge above); re-setting it
# here extends the expiry on every visit
# No diag cookie yet → bounce through the SSO bridge, which checks the panel
# session and mints the cookie, so a bookmarked diag link "just works" once
# you're logged into the panel. (Only the HTML page redirects; the API/asset
# sub-locations below stay 404 without the cookie.)
location ^~ ${diag_path} {
if (\$diag_auth = 0) { return 404; }
if (\$diag_auth = 0) { return 302 /${panel_path}/diag; }
limit_req zone=diag_page burst=10 nodelay;
limit_conn per_ip 5;
alias /var/www/diagnostics/;
@@ -949,12 +951,12 @@ VALUES (
-- rendered as the share-link endpoint at subscription time.
-- REALITY keeps its own TLS params (security=same); the rest front through
-- nginx at :443 with TLS.
INSERT INTO "hosts" ("inbound_id","sort_order","remark","address","port","security","fingerprint")
INSERT INTO "hosts" ("inbound_id","sort_order","remark","address","port","security","fingerprint","alpn")
VALUES
((SELECT id FROM inbounds WHERE tag='inbound-8443'), 0, 'reality', '${domain}', 443, 'same', ''),
((SELECT id FROM inbounds WHERE tag='inbound-${ws_port}'), 0, 'ws', '${domain}', 443, 'tls', 'firefox'),
((SELECT id FROM inbounds WHERE tag='inbound-/dev/shm/uds2023.sock,0666:0|'), 0, 'xhttp', '${domain}', 443, 'tls', 'firefox'),
((SELECT id FROM inbounds WHERE tag='inbound-${trojan_port}'), 0, 'trojan', '${domain}', 443, 'tls', 'firefox');
((SELECT id FROM inbounds WHERE tag='inbound-8443'), 0, 'reality', '${domain}', 443, 'same', '', '[]'),
((SELECT id FROM inbounds WHERE tag='inbound-${ws_port}'), 0, 'ws', '${domain}', 443, 'tls', 'firefox', '["h2","http/1.1"]'),
((SELECT id FROM inbounds WHERE tag='inbound-/dev/shm/uds2023.sock,0666:0|'), 0, 'xhttp', '${domain}', 443, 'tls', 'firefox', '["h2","http/1.1"]'),
((SELECT id FROM inbounds WHERE tag='inbound-${trojan_port}'), 0, 'trojan', '${domain}', 443, 'tls', 'firefox', '["h2","http/1.1"]');
EOF
/usr/local/x-ui/x-ui setting \