Evgen/3x-ui-pro
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Gate diagnostics behind 3x-ui panel login via nginx SSO bridge

Browse Source 
The 3x-ui session cookie is Path-scoped to the panel base path, so the
diag vhost locations can never see it directly. Instead a bridge
location under the panel path (/<panel_path>/diag) validates the
session with auth_request against GET <basePath>/panel/ (sent with
X-Requested-With: XMLHttpRequest so 3x-ui answers 401 instead of a
login redirect), then issues a path-scoped diag_key cookie and
redirects to the diagnostics page. All diag locations return 404
without that cookie.

auth_request runs in the access phase while "return" runs in the
rewrite phase, so the success path hops through try_files to a named
location; the cookie is set only there, never on the 401 redirect.

Replaces the previous ?key= token link, which is removed entirely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Ivan Razin
2026-07-03 15:05:29 +03:00
co-authored by Claude Fable 5
parent bd2c47753e
commit d816b5edcc
3 changed files with 104 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+7 -1
View File
@@ -37,7 +37,13 @@ effect on servers only after push to `main`.
Clash/Mihomo user agents get generated clash.yaml, `?provider=1` bypasses it
10. Downloads a random fake cover site (`install_fake_site`) → `/var/www/html/`
11. Installs network diagnostics (`install_diagnostics`) → `/var/www/diagnostics/` +
`mtr-backend` systemd service (hardened, dedicated user, localhost-only)
`mtr-backend` systemd service (hardened, dedicated user, localhost-only).
Access only via `/<panel_path>/diag` (SSO bridge): nginx auth_request validates
the 3x-ui session against `GET <basePath>/panel/` (with X-Requested-With header →
401 instead of login redirect), then issues a path-scoped `diag_key` cookie and
redirects to the diag page; all diag locations 404 without that cookie.
The 3x-ui session cookie is Path-scoped to the panel base path, which is why
the bridge must live under the panel path
12. Tunes kernel/BBR (`tune_system`)
13. Sets up cron (`setup_cron`) — daily x-ui restart + nginx reload; monthly certbot renew
with pre/post hooks stopping/starting nginx (certs are standalone-issued)
x-ui-latest.sh
+45 -2
View File
@@ -115,6 +115,7 @@ xhttp_path=$(gen_random_string 10)
config_username=$(gen_random_string 10)
config_password=$(gen_random_string 10)
diag_path="/net-$(gen_random_string 12)/"
diag_token=$(gen_random_string 16)
mtr_backend_port=$(make_port)
# ─── Argument parsing ────────────────────────────────────────────────────────
@@ -440,6 +441,12 @@ map "\$is_clash_ua:\$arg_provider" \$serve_clash_yaml {
default 0;
}
# Diagnostics access: cookie issued by the SSO bridge after panel login
map \$cookie_diag_key \$diag_auth {
"${diag_token}" 1;
default 0;
}
server {
server_tokens off;
server_name ${domain};
@@ -490,19 +497,51 @@ server {
proxy_pass https://127.0.0.1:${panel_port};
}
# ── Diagnostics SSO bridge ───────────────────────────────────────────────
# Lives under the panel path so the browser attaches the 3x-ui session
# cookie (its Path is scoped to the panel base path). Valid panel session
# → issue the diag cookie and redirect; otherwise → panel login page.
# NOTE: auth_request runs in the access phase; a plain "return" here would
# skip it (rewrite phase), hence the try_files → named-location hop.
location = /${panel_path}/diag {
auth_request /__diag_auth;
error_page 401 403 =302 /${panel_path}/;
try_files /__nonexistent @diag_sso_ok;
}
location @diag_sso_ok {
add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
return 302 ${diag_path};
}
location = /__diag_auth {
internal;
proxy_pass https://127.0.0.1:${panel_port}/${panel_path}/panel/;
proxy_http_version 1.1;
proxy_set_header Host \$host;
# 3x-ui answers AJAX requests with 401 instead of a login redirect
proxy_set_header X-Requested-With XMLHttpRequest;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_intercept_errors off;
}
# ── Network diagnostics page ─────────────────────────────────────────────
# Requires the diag cookie (issued by the SSO bridge above); re-setting it
# here extends the expiry on every visit
location ^~ ${diag_path} {
if (\$diag_auth = 0) { return 404; }
limit_req zone=diag_page burst=10 nodelay;
limit_conn per_ip 5;
alias /var/www/diagnostics/;
index index.html;
try_files \$uri \$uri/ /index.html;
add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800" always;
add_header Cache-Control "no-store" always;
add_header X-Robots-Tag "noindex, nofollow" always;
}
# ── Diagnostics MTR API ──────────────────────────────────────────────────
location ^~ ${diag_path}api/mtr {
if (\$diag_auth = 0) { return 404; }
limit_req zone=diag_api burst=2 nodelay;
limit_conn per_ip 2;
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/mtr;
@@ -517,6 +556,7 @@ server {
# No limit_req: librespeed fires many short POSTs (parallel streams).
# proxy_request_buffering off = client sees true network backpressure.
location ^~ ${diag_path}api/st/up {
if (\$diag_auth = 0) { return 404; }
access_log off;
limit_conn per_ip 8;
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/st/up;
@@ -531,6 +571,7 @@ server {
# ── LibreSpeed ping endpoint (answered by nginx, no backend hop) ─────────
location = ${diag_path}api/st/ping {
if (\$diag_auth = 0) { return 404; }
access_log off;
limit_conn per_ip 8;
add_header Cache-Control "no-store" always;
@@ -540,6 +581,7 @@ server {
# ── LibreSpeed client IP ─────────────────────────────────────────────────
location = ${diag_path}api/st/getip {
if (\$diag_auth = 0) { return 404; }
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/st/getip;
proxy_http_version 1.1;
proxy_set_header X-Real-IP \$remote_addr;
@@ -548,6 +590,7 @@ server {
# ── Download test files ──────────────────────────────────────────────────
location ^~ ${diag_path}testfiles/ {
if (\$diag_auth = 0) { return 404; }
alias /var/www/diagnostics/testfiles/;
access_log off;
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
@@ -1047,7 +1090,7 @@ EOF
systemctl enable mtr-backend
systemctl restart mtr-backend
msg_ok "Network diagnostics installed at https://${domain}${diag_path}"
msg_ok "Network diagnostics installed at https://${domain}/${panel_path}/diag (panel login required)"
}
# ─────────────────────────────────────────────────────────────────────────────
@@ -1107,7 +1150,7 @@ show_results() {
echo -e "Username: ${config_username}\n"
echo -e "Password: ${config_password}\n"
msg_inf "────────────────────────────────────────────────────────────────────────────────"
msg_inf "Network Diagnostics: https://${domain}${diag_path}\n"
msg_inf "Network Diagnostics (panel login required): https://${domain}/${panel_path}/diag\n"
msg_inf "────────────────────────────────────────────────────────────────────────────────"
msg_inf "Please save this screen!"
else
x-ui-patch.sh
+52 -1
View File
@@ -107,6 +107,20 @@ else
blue "diag_path generated: $diag_path"
fi
# ── detect or generate diag access token ─────────────────────────────────────
diag_token=""
for f in /etc/nginx/sites-available/*; do
[[ -f "$f" ]] || continue
t=$(grep -oP 'diag_key=\K[a-zA-Z0-9]+' "$f" 2>/dev/null | head -1 || true)
[[ -n "$t" ]] && { diag_token="$t"; break; }
done
if [[ -n "$diag_token" ]]; then
blue "diag_token reused"
else
diag_token=$(tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 16)
blue "diag_token generated"
fi
# ── detect or generate mtr_backend_port ──────────────────────────────────────
mtr_backend_port=""
if [[ -f /etc/systemd/system/mtr-backend.service ]]; then
@@ -298,6 +312,12 @@ map "\$is_clash_ua:\$arg_provider" \$serve_clash_yaml {
default 0;
}
# Diagnostics access: cookie issued by the SSO bridge after panel login
map \$cookie_diag_key \$diag_auth {
"${diag_token}" 1;
default 0;
}
server {
server_tokens off;
server_name ${domain};
@@ -348,16 +368,43 @@ server {
proxy_pass https://127.0.0.1:${panel_port};
}
# Diagnostics SSO bridge: valid panel session → diag cookie + redirect.
# auth_request runs in the access phase; plain "return" would skip it,
# hence the try_files → named-location hop.
location = /${panel_path}/diag {
auth_request /__diag_auth;
error_page 401 403 =302 /${panel_path}/;
try_files /__nonexistent @diag_sso_ok;
}
location @diag_sso_ok {
add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
return 302 ${diag_path};
}
location = /__diag_auth {
internal;
proxy_pass https://127.0.0.1:${panel_port}/${panel_path}/panel/;
proxy_http_version 1.1;
proxy_set_header Host \$host;
# 3x-ui answers AJAX requests with 401 instead of a login redirect
proxy_set_header X-Requested-With XMLHttpRequest;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_intercept_errors off;
}
location ^~ ${diag_path} {
if (\$diag_auth = 0) { return 404; }
limit_req zone=diag_page burst=10 nodelay;
limit_conn per_ip 5;
alias /var/www/diagnostics/;
index index.html;
try_files \$uri \$uri/ /index.html;
add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800" always;
add_header Cache-Control "no-store" always;
add_header X-Robots-Tag "noindex, nofollow" always;
}
location ^~ ${diag_path}api/mtr {
if (\$diag_auth = 0) { return 404; }
limit_req zone=diag_api burst=2 nodelay;
limit_conn per_ip 2;
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/mtr;
@@ -368,6 +415,7 @@ server {
proxy_send_timeout 120s;
}
location ^~ ${diag_path}api/st/up {
if (\$diag_auth = 0) { return 404; }
access_log off;
limit_conn per_ip 8;
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/st/up;
@@ -380,6 +428,7 @@ server {
add_header Cache-Control "no-store" always;
}
location = ${diag_path}api/st/ping {
if (\$diag_auth = 0) { return 404; }
access_log off;
limit_conn per_ip 8;
add_header Cache-Control "no-store" always;
@@ -387,12 +436,14 @@ server {
return 200 "";
}
location = ${diag_path}api/st/getip {
if (\$diag_auth = 0) { return 404; }
proxy_pass http://127.0.0.1:${mtr_backend_port}/api/st/getip;
proxy_http_version 1.1;
proxy_set_header X-Real-IP \$remote_addr;
add_header Cache-Control "no-store" always;
}
location ^~ ${diag_path}testfiles/ {
if (\$diag_auth = 0) { return 404; }
alias /var/www/diagnostics/testfiles/;
access_log off;
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
@@ -589,5 +640,5 @@ green "════════════════════════
green " Patch complete"
green "══════════════════════════════════════════════"
printf "\n Panel: https://%s/%s/\n" "$domain" "$panel_path"
printf " Diagnostics: https://%s%s\n" "$domain" "$diag_path"
printf " Diagnostics (panel login): https://%s/%s/diag\n" "$domain" "$panel_path"
echo