Evgen/3x-ui-pro
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Gate diagnostics behind 3x-ui panel login via nginx SSO bridge

Browse Source 
The 3x-ui session cookie is Path-scoped to the panel base path, so the
diag vhost locations can never see it directly. Instead a bridge
location under the panel path (/<panel_path>/diag) validates the
session with auth_request against GET <basePath>/panel/ (sent with
X-Requested-With: XMLHttpRequest so 3x-ui answers 401 instead of a
login redirect), then issues a path-scoped diag_key cookie and
redirects to the diagnostics page. All diag locations return 404
without that cookie.

auth_request runs in the access phase while "return" runs in the
rewrite phase, so the success path hops through try_files to a named
location; the cookie is set only there, never on the 401 redirect.

Replaces the previous ?key= token link, which is removed entirely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Ivan Razin
2026-07-03 15:05:29 +03:00
co-authored by Claude Fable 5
parent bd2c47753e
commit d816b5edcc
3 changed files with 104 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
x-ui-patch.sh
+52 -1
View File
@@ -107,6 +107,20 @@ else
blue "diag_path generated: $diag_path"
fi
# ── detect or generate diag access token ─────────────────────────────────────
diag_token=""
for f in /etc/nginx/sites-available/*; do
[[ -f "$f" ]] || continue
t=$(grep -oP 'diag_key=\K[a-zA-Z0-9]+' "$f" 2>/dev/null | head -1 || true)
[[ -n "$t" ]] && { diag_token="$t"; break; }
done
if [[ -n "$diag_token" ]]; then
blue "diag_token reused"
else
diag_token=$(tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 16)
blue "diag_token generated"
fi
# ── detect or generate mtr_backend_port ──────────────────────────────────────
mtr_backend_port=""
if [[ -f /etc/systemd/system/mtr-backend.service ]]; then
@@ -298,6 +312,12 @@ map "\$is_clash_ua:\$arg_provider" \$serve_clash_yaml {
default 0;
}
# Diagnostics access: cookie issued by the SSO bridge after panel login
map \$cookie_diag_key \$diag_auth {
"${diag_token}" 1;
default 0;
}
server {
server_tokens off;
server_name ${domain};
@@ -348,16 +368,43 @@ server {
proxy_pass https://127.0.0.1:${panel_port};
}
# Diagnostics SSO bridge: valid panel session → diag cookie + redirect.
# auth_request runs in the access phase; plain "return" would skip it,
# hence the try_files → named-location hop.
location = /${panel_path}/diag {
auth_request /__diag_auth;
error_page 401 403 =302 /${panel_path}/;
try_files /__nonexistent @diag_sso_ok;
}
location @diag_sso_ok {
add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
return 302 ${diag_path};
}
location = /__diag_auth {
internal;
proxy_pass https://127.0.0.1:${panel_port}/${panel_path}/panel/;
proxy_http_version 1.1;
proxy_set_header Host \$host;
# 3x-ui answers AJAX requests with 401 instead of a login redirect
proxy_set_header X-Requested-With XMLHttpRequest;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_intercept_errors off;
}
location ^~ ${diag_path} {
if (\$diag_auth = 0) { return 404; }
limit_req zone=diag_page burst=10 nodelay;
limit_conn per_ip 5;
alias /var/www/diagnostics/;
index index.html;
try_files \$uri \$uri/ /index.html;
add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800" always;
add_header Cache-Control "no-store" always;
add_header X-Robots-Tag "noindex, nofollow" always;
}
location ^~ ${diag_path}api/mtr {
if (\$diag_auth = 0) { return 404; }
limit_req zone=diag_api burst=2 nodelay;
limit_conn per_ip 2;
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/mtr;
@@ -368,6 +415,7 @@ server {
proxy_send_timeout 120s;
}
location ^~ ${diag_path}api/st/up {
if (\$diag_auth = 0) { return 404; }
access_log off;
limit_conn per_ip 8;
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/st/up;
@@ -380,6 +428,7 @@ server {
add_header Cache-Control "no-store" always;
}
location = ${diag_path}api/st/ping {
if (\$diag_auth = 0) { return 404; }
access_log off;
limit_conn per_ip 8;
add_header Cache-Control "no-store" always;
@@ -387,12 +436,14 @@ server {
return 200 "";
}
location = ${diag_path}api/st/getip {
if (\$diag_auth = 0) { return 404; }
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/st/getip;
proxy_http_version 1.1;
proxy_set_header X-Real-IP \$remote_addr;
add_header Cache-Control "no-store" always;
}
location ^~ ${diag_path}testfiles/ {
if (\$diag_auth = 0) { return 404; }
alias /var/www/diagnostics/testfiles/;
access_log off;
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
@@ -589,5 +640,5 @@ green "════════════════════════
green " Patch complete"
green "══════════════════════════════════════════════"
printf "\n Panel: https://%s/%s/\n" "$domain" "$panel_path"
printf " Diagnostics: https://%s%s\n" "$domain" "$diag_path"
printf " Diagnostics (panel login): https://%s/%s/diag\n" "$domain" "$panel_path"
echo