From f86486450174823aaa1d0472f77edb57d8265445 Mon Sep 17 00:00:00 2001
From: Ivan Razin <i.razin@rnet.ru>
Date: Fri, 3 Jul 2026 16:10:11 +0300
Subject: [PATCH] Fix diagnostics SSO deny path returning a 302 with no
 Location
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bridge used `error_page 401 403 =302 /<panel>/`, which does an
nginx internal redirect: it serves the panel login page body with a
302 status but sends NO Location header. Browsers (and curl) can't
follow that, so an unauthenticated or expired-session visit to the
diag link rendered a blank page ("doesn't load").

Route the deny path through a named location that does a real
`return 302 /<panel>/`, so the client gets a proper Location and
lands on the panel login. The authorized path (auth_request 200 →
@diag_sso_ok → 302 + diag cookie) is unchanged.

Verified with nginx + a TLS mock panel: unauthenticated hit now
redirects to the panel login; logged-in hit (browser-like cookie
handling) resolves to the diag page in 1-2 redirects, no loop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 x-ui-latest.sh | 7 ++++++-
 x-ui-patch.sh  | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/x-ui-latest.sh b/x-ui-latest.sh
index 7583779..e8c11c7 100644
--- a/x-ui-latest.sh
+++ b/x-ui-latest.sh
@@ -505,9 +505,14 @@ server {
     # skip it (rewrite phase), hence the try_files → named-location hop.
     location = /${panel_path}/diag {
         auth_request /__diag_auth;
-        error_page 401 403 =302 /${panel_path}/;
+        # Named location (not "=302 /uri") so the deny path emits a real Location
+        # header; an internal-redirect error_page returns a 302 with no Location.
+        error_page 401 403 = @diag_login;
         try_files /__nonexistent @diag_sso_ok;
     }
+    location @diag_login {
+        return 302 /${panel_path}/;
+    }
     location @diag_sso_ok {
         add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
         return 302 ${diag_path};
diff --git a/x-ui-patch.sh b/x-ui-patch.sh
index c2a0f3b..bf7d72e 100644
--- a/x-ui-patch.sh
+++ b/x-ui-patch.sh
@@ -373,9 +373,14 @@ server {
     # hence the try_files → named-location hop.
     location = /${panel_path}/diag {
         auth_request /__diag_auth;
-        error_page 401 403 =302 /${panel_path}/;
+        # Named location (not "=302 /uri") so the deny path emits a real Location
+        # header; an internal-redirect error_page returns a 302 with no Location.
+        error_page 401 403 = @diag_login;
         try_files /__nonexistent @diag_sso_ok;
     }
+    location @diag_login {
+        return 302 /${panel_path}/;
+    }
     location @diag_sso_ok {
         add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
         return 302 ${diag_path};