From c53342f2e8800876453b0768a0cabd5801942a37 Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Wed, 12 Aug 2026 09:33:27 +0200 Subject: [PATCH] fix(komga): rewrite the cookie path onto the ingress entry (#2964) Komga scopes its cookies to its servlet context path, so the browser never sent them back from the ingress url and every request after a successful login was anonymous (401). Co-authored-by: Claude Opus 5 --- komga/CHANGELOG.md | 4 ++++ komga/config.yaml | 2 +- komga/rootfs/etc/nginx/servers/ingress.conf | 7 +++++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/komga/CHANGELOG.md b/komga/CHANGELOG.md index d995cecfa8..fd7a840b88 100644 --- a/komga/CHANGELOG.md +++ b/komga/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.26.1.3 (2026-08-12) + +- Fix : 401 errors after a successful login through ingress. Komga scopes its session cookies to its servlet context path (`Path=/komga`), which the browser never sends back from the ingress url, so every request after the login was anonymous. Nginx now rewrites the cookie path onto the ingress entry + ## 1.26.1.2 (2026-08-12) - Fix : local disks (`localdisks`) and SMB shares failed to mount with `cannot mount /dev/sdX read-only`. Without an `apparmor.txt` the add-on ran under Docker's default AppArmor profile, which denies `mount` and raw block device access. Ships the same profile as the other add-ons that mount disks diff --git a/komga/config.yaml b/komga/config.yaml index 6d047ac161..fe934a8d51 100644 --- a/komga/config.yaml +++ b/komga/config.yaml @@ -101,4 +101,4 @@ schema: slug: komga udev: true url: https://github.com/alexbelgium/hassio-addons/tree/master/komga -version: "1.26.1.2" +version: "1.26.1.3" diff --git a/komga/rootfs/etc/nginx/servers/ingress.conf b/komga/rootfs/etc/nginx/servers/ingress.conf index 53c36d9189..8a3d6d4b88 100644 --- a/komga/rootfs/etc/nginx/servers/ingress.conf +++ b/komga/rootfs/etc/nginx/servers/ingress.conf @@ -33,6 +33,13 @@ server { proxy_redirect http://127.0.0.1:25600/ %%ingress_entry%%/; proxy_redirect / %%ingress_entry%%/; + # Komga scopes its cookies to the servlet context path + # (Set-Cookie: ...; Path=/komga). The browser lives under the ingress + # entry, so such a cookie is never sent back : login succeeds, then + # every following request arrives anonymous and Komga answers 401. + proxy_cookie_path /komga %%ingress_entry%%/komga; + proxy_cookie_path / %%ingress_entry%%/; + # Komga renders its index page with Thymeleaf @{...} link expressions, # so every asset url and window.resourceBaseUrl carry the context path # (/komga). Ingress strips its own prefix before forwarding, so the