Called by reverse proxy, cannot removed base prefix '/radicale' from path: xxx as not matching

[ckujau]

Upgraded from Radicale 3.3.3 to 3.5.1 yesterday and the log is now full with:

[1977223/Thread-172 (process_request_thread)] [WARNING] Called by reverse proxy, 
  cannot removed base prefix '/radicale' from path: '/ck/d987826a-d12e-4935-bb33-c636c9a275d' as not matching

Both the CalDAV and CardDAV still appear to work, but these warnings are new. Radicale is running on localhost:5232 behind an Apache reverse proxy, and I tried to follow the documentation where user accounts are managed on the web server level.

I've now added script_name = /radicale to the Radicale configuration as well, but that does not change anything.

Apparently this was introduced via 280968e with comment "remove base prefix from path (required for proper handling if called by reverse proxy)" but the reverse proxy setup worked just fine before :-)

Does anyone know what this warning is about?

Thanks.

[pbiering]

According to the log entry you do not require any script_name settings because your reverse proxy is forwarding /* directly to radicale.

[pbiering]

check your reverse proxy settings for RequestHeader set X-Script-Name /radicale and remove that line, as not needed in your case.

[ckujau]

Thanks for responding. So, I added the script_name to my configuration to try to make the warning go away, but no dice, and I've removed that option again:

$ cat ~radicale/.config/radicale/config 
[server]
hosts = localhost:5232
max_connections = 20
max_content_length = 100000000
timeout = 30
# script_name = /radicale

[auth]
type = http_x_remote_user
delay = 1
[...]

In my Apache configuration I have the following:

        RewriteRule ^/radicale$ /radicale/ [R,L]
        <Location "/radicale/">
                AuthType         Basic
                AuthName         "Radicale - Password Required"
                AuthUserFile     /etc/apache2/htpasswd.radicale
                Require          valid-user

                ProxyPass        http://localhost:5232/ retry=0
                ProxyPassReverse http://localhost:5232/
                RequestHeader    set X-Script-Name /radicale
                RequestHeader    set X-Remote-User expr=%{REMOTE_USER}
        </Location>

Removing the X-Script-Name line made the warning go away but then I could no longer access the little Radicale collection management at /radicale/.web/ and my contacts disappeared (and my DAVx⁵ Android app is now seeing two address books and needs some reconfiguration, whoops), so I went back with putting X-Script-Name back into the configuration file for now.

I feel like my Radicale configuration may need some updating though. I've installed Radicale some years ago and must admint that I haven't paid much attention to the version change logs and maybe my configuration needs to be updated to match its current documentation. I'll look into that, and maybe set it up from scratch even, I just felt I needed to bring attention to that "new" warning message[0].

Thanks for trying to help here.

[0] nit: s/cannot removed base/cannot remove base/, but that's not the point of this discussion here of course :)

[pbiering]

[0] fixed by e907e90

[pbiering]

In your case script_name is not required as it overwrites what is provided by Apache reverse proxy RequestHeader set X-Script-Name /radicale .

Current reference configuration for Apache reverse proxy is shown here:
https://github.com/Kozea/Radicale/blob/master/contrib/apache/radicale.conf

Which version of Apache are you using and which modules are active?

And can you paste debug log part incl. part of the request header, interesting would be like e.g.

                                               'HTTP_X_SCRIPT_NAME': '/radicale',
                                               'PATH_INFO': '/radicale/test/testcal/',

BTW: related code starts here:

Radicale/radicale/app/__init__.py

Line 250 in e907e90

# Sanitize request URI (a WSGI server indicates with an empty path,

[ckujau]

Sorry for the late response. So, I looked at contrib/apache/radicale.conf and admittedly it looked somewhat different to what I had for some years now. The webserver is an Apache 2.4.62 from Debian, with the usual modules loaded, including mod_ssl and mod_fcgid, but nothing exotic.

So, I copied the part from contrib/apache/radicale.conf now:

        RewriteEngine On
        RewriteRule ^/radicale$ /radicale/ [R,L]
        RewriteCond %{REQUEST_METHOD} GET
        RewriteRule ^/radicale/$ /radicale/.web/ [R,L]

        <LocationMatch "^/radicale/\.web.*>
                # Internal WebUI does not need authentication at all
        #       RequestHeader    set X-Script-Name /radicale

                RequestHeader    set X-Forwarded-Port "%{SERVER_PORT}s"
                RequestHeader    set X-Forwarded-Proto expr=%{REQUEST_SCHEME}

                ProxyPass        http://localhost:5232/ retry=0
                ProxyPassReverse http://localhost:5232/

                Require local
                <IfDefine RADICALE_PERMIT_PUBLIC_ACCESS>
                Require all granted
                </IfDefine>
        </LocationMatch>

        <LocationMatch "^/radicale(?!/\.web)">
        #       RequestHeader    set X-Script-Name /radicale

                RequestHeader    set X-Forwarded-Port "%{SERVER_PORT}s"
                RequestHeader    set X-Forwarded-Proto expr=%{REQUEST_SCHEME}

                ProxyPass        http://localhost:5232/ retry=0
                ProxyPassReverse http://localhost:5232/

                AuthType         Basic
                AuthName         "Radicale - Password Required"
                AuthUserFile     /etc/apache2/htpasswd.radicale
                Require          valid-user
        </LocationMatch>

And in ~radicale/.config/radicale/config:

[server]
hosts = localhost:5232
max_connections = 20
max_content_length = 100000000
timeout = 30
script_name = /radicale

[auth]
type = http_x_remote_user
delay = 1

[rights]
file = /home/radicale/.config/radicale/rights

[logging]
level = debug
response_content_on_debug = true
request_header_on_debug = true

Restarted both Apache and Radicale, but trying to access that CardDAV collection now gives:

$ curl -s --user ${cred} https://trent/radicale/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/
Access to the requested resource forbidden

And in the logs:

$ tail -f ...
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [INFO] GET request for '/radicale/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/' received from ::1 (forwarded for '2a03:3680:0:3::67') using 'curl/8.12.1'
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [DEBUG] Request header:#012{'CONTENT_LENGTH': '',#012 'CONTENT_TYPE': 'text/plain',#012 'GATEWAY_INTERFACE': 'CGI/1.1',#012 'HTTP_ACCEPT': '*/*',#012 'HTTP_AUTHORIZATION': 'Basic **masked**',#012 'HTTP_CONNECTION': 'Keep-Alive',#012 'HTTP_HOST': 'localhost:5232',#012 'HTTP_USER_AGENT': 'curl/8.12.1',#012 'HTTP_X_FORWARDED_FOR': 'xxxx',#012 'HTTP_X_FORWARDED_HOST': 'xxxx',#012 'HTTP_X_FORWARDED_PORT': '443',#012 'HTTP_X_FORWARDED_PROTO': 'https',#012 'HTTP_X_FORWARDED_SERVER': 'xxxx',#012 'PATH_INFO': '/radicale/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/',#012 'QUERY_STRING': '',#012 'REMOTE_ADDR': '::1',#012 'REMOTE_HOST': '',#012 'REQUEST_METHOD': 'GET',#012 'SCRIPT_NAME': '',#012 'SERVER_NAME': 'localhost',#012 'SERVER_PORT': '5232',#012 'SERVER_PROTOCOL': 'HTTP/1.1',#012 'SERVER_SOFTWARE': 'WSGIServer/0.2',#012 'wsgi.errors': <_io.TextIOWrapper name='<stderr>' mode='w' encoding='utf-8'>,#012 'wsgi.file_wrapper': <class 'wsgiref.util.FileWrapper'>,#012 'wsgi.input': <_io.BufferedReader name=8>,#012 'wsgi.multiprocess': False,#012 'wsgi.multithread': True,#012 'wsgi.run_once': False,#012 'wsgi.url_scheme': 'http',#012 'wsgi.version': (1, 0)}
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [DEBUG] Base prefix (from config): '/radicale'
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [DEBUG] Sanitized path: '/radicale/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/'
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [DEBUG] Called by reverse proxy, remove base prefix '/radicale' from path: '/radicale/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/' => '/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/'
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [INFO] Access to '/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/' denied for anonymous user
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [DEBUG] Response content:#012Access to the requested resource forbidden.
Apr 13 00:32:01 trent radicale[1257395]: [1257395/Thread-1 (process_request_thread)] [INFO] GET response status for '/radicale/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/' in 0.001 seconds: 403 Forbidden

==> ../apache/access.log <==
2a03:3680:0:3::67 - ck [13/Apr/2025:00:32:01 +0200] "GET /radicale/ck/33561ef5-daad-e8fc-2850-3e7c86027d7c/ HTTP/2.0" 403 298 "-" "curl/8.12.1"

So, the good news is, that the "Called by reverse proxy,..." message is gone :-)

But now I cannot access my collections anymore. So, I'll go back to my old configuration for now, and ignore that warning for a while. And maybe tinker around with my configuration, I could imagine one of the LocationMatch or RewriteRule directives to cause this, but I'm out of time to debug further today.

[pbiering]

are you using mod_fcgid currently? Try to disable, afair there was a strangeness detected by me in a local setup, when active, the PATH_INFO misses the the base path part somehow...not further investigated why this happend.

[ckujau]

Tried to disable mod_fcgid, but this did not change anything. I went ahead and tried to recreate all this on a pristine Debian 12 system (VM), installed Apache and Radicale, followed that nice Simple 5-minute setup and worked my way up to the reverse proxy configuration. As this is the discussion forum, and not the bug tracker, I may as well paste my configuration and long debug logs here, to document what I've done:

$ sudo apt install apache2
$ sudo a2enmod headers rewrite proxy proxy_http

$ sudo useradd -m -U radicale 
$ sudo -u radicale -i
$ pipx install https://github.com/Kozea/Radicale/archive/master.tar.gz

And some configuration too:

$ cat ~radicale/.config/radicale/config 
[server]
hosts = localhost:5232
# script_name = /radicale

[auth]
type = htpasswd
htpasswd_filename = /home/radicale/.config/radicale/users
htpasswd_encryption = sha512

[storage]
filesystem_folder = /home/radicale/.var/lib/radicale/collections

[logging]
# level = debug
response_content_on_debug = true
request_header_on_debug = true
request_content_on_debug = true

Web server configuration:

$ cat /etc/apache2/sites-enabled/*.conf 
ServerName debian

<VirtualHost *:1080>
        ServerName      debian 
        DocumentRoot    /var/www/html

        ErrorLog        ${APACHE_LOG_DIR}/error.log
        CustomLog       ${APACHE_LOG_DIR}/access.log combined

        RewriteEngine On
        RewriteRule ^/radicale$ /radicale/ [R,L]

        <Location "/radicale/">
                ProxyPass        http://localhost:5232/ retry=0
                ProxyPassReverse http://localhost:5232/
                RequestHeader    set X-Script-Name /radicale
                RequestHeader    set X-Forwarded-Port "%{SERVER_PORT}s"
                RequestHeader    set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
        </Location>
</VirtualHost>

So, X-Script-Name is again set at the web server, and script_name is unset in Radicale. And with that:

radicale@debian$ radicale --logging-level debug
[....]
[2025-04-13 23:17:51 +0200] [9952] [INFO] Loaded config file '/home/radicale/.config/radicale/config'
[2025-04-13 23:17:51 +0200] [9952] [INFO] Default script name to strip from URI if called by reverse proxy is taken from HTTP_X_SCRIPT_NAME or SCRIPT_NAME

I've added a single VCF file to the CardDAV collection, this seems to work:

$ curl --user foo:bar -sL http://debian:1080/radicale/foo/appleseedcard-de/ | file -
/dev/stdin: vCard visiting card, version 3.0

But Radicale prints:

[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [INFO] GET request for '/foo/appleseedcard-de/' received from ::1 (forwarded for '192.168.65.1') using 'curl/8.7.1'
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [DEBUG] Request header:
{'CONTENT_LENGTH': '',
 'CONTENT_TYPE': 'text/plain',
 'GATEWAY_INTERFACE': 'CGI/1.1',
 'HTTP_ACCEPT': '*/*',
 'HTTP_AUTHORIZATION': 'Basic **masked**',
 'HTTP_CONNECTION': 'Keep-Alive',
 'HTTP_HOST': 'localhost:5232',
 'HTTP_USER_AGENT': 'curl/8.7.1',
 'HTTP_X_FORWARDED_FOR': '192.168.65.1',
 'HTTP_X_FORWARDED_HOST': 'debian:1080',
 'HTTP_X_FORWARDED_PORT': '(null)',
 'HTTP_X_FORWARDED_PROTO': 'http',
 'HTTP_X_FORWARDED_SERVER': 'debian',
 'HTTP_X_SCRIPT_NAME': '/radicale',
 'PATH_INFO': '/foo/appleseedcard-de/',
 'QUERY_STRING': '',
 'REMOTE_ADDR': '::1',
 'REMOTE_HOST': '',
 'REQUEST_METHOD': 'GET',
 'SCRIPT_NAME': '',
 'SERVER_NAME': 'localhost',
 'SERVER_PORT': '5232',
 'SERVER_PROTOCOL': 'HTTP/1.1',
 'SERVER_SOFTWARE': 'WSGIServer/0.2',
 'wsgi.errors': <_io.TextIOWrapper name='<stderr>' mode='w' encoding='utf-8'>,
 'wsgi.file_wrapper': <class 'wsgiref.util.FileWrapper'>,
 'wsgi.input': <_io.BufferedReader name=7>,
 'wsgi.multiprocess': False,
 'wsgi.multithread': True,
 'wsgi.run_once': False,
 'wsgi.url_scheme': 'http',
 'wsgi.version': (1, 0)}
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [DEBUG] Base prefix (from HTTP_X_SCRIPT_NAME): '/radicale'
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [DEBUG] Sanitized path: '/foo/appleseedcard-de/'
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [WARNING] Called by reverse proxy, cannot remove base prefix '/radicale' from path: '/foo/appleseedcard-de/' as not matching
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [DEBUG] Read content of htpasswd file start: '/home/radicale/.config/radicale/users'
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [DEBUG] Read content of htpasswd file done: '/home/radicale/.config/radicale/users' (entries: 1, duplicates: 0, errors: 0)
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [DEBUG] Login verification successful for user: 'foo' (htpasswd/sha512/SHA-512)
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [INFO] Successful login: 'foo' (htpasswd)
[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [DEBUG] Response content:
BEGIN:VCARD
VERSION:3.0
[...]

[2025-04-13 23:18:45 +0200] [9952/Thread-1 (process_request_thread)] [INFO] GET response status for '/foo/appleseedcard-de/' in 0.012 seconds: 200 OK

Disabling (not setting) X-Script-Name again in the Apache configuration and setting script_name = /radicale in Radicale gives:

[2025-04-13 23:22:28 +0200] [10034] [INFO] Provided script name to strip from URI if called by reverse proxy: '/radicale'
[...]
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [INFO] GET request for '/foo/appleseedcard-de/' received from ::1 (forwarded for '192.168.65.1') using 'curl/8.7.1'
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [DEBUG] Request header:
{'CONTENT_LENGTH': '',
 'CONTENT_TYPE': 'text/plain',
 'GATEWAY_INTERFACE': 'CGI/1.1',
 'HTTP_ACCEPT': '*/*',
 'HTTP_AUTHORIZATION': 'Basic **masked**',
 'HTTP_CONNECTION': 'Keep-Alive',
 'HTTP_HOST': 'localhost:5232',
 'HTTP_USER_AGENT': 'curl/8.7.1',
 'HTTP_X_FORWARDED_FOR': '192.168.65.1',
 'HTTP_X_FORWARDED_HOST': 'debian:1080',
 'HTTP_X_FORWARDED_PORT': '(null)',
 'HTTP_X_FORWARDED_PROTO': 'http',
 'HTTP_X_FORWARDED_SERVER': 'debian',
 'PATH_INFO': '/foo/appleseedcard-de/',
 'QUERY_STRING': '',
 'REMOTE_ADDR': '::1',
 'REMOTE_HOST': '',
 'REQUEST_METHOD': 'GET',
 'SCRIPT_NAME': '',
 'SERVER_NAME': 'localhost',
 'SERVER_PORT': '5232',
 'SERVER_PROTOCOL': 'HTTP/1.1',
 'SERVER_SOFTWARE': 'WSGIServer/0.2',
 'wsgi.errors': <_io.TextIOWrapper name='<stderr>' mode='w' encoding='utf-8'>,
 'wsgi.file_wrapper': <class 'wsgiref.util.FileWrapper'>,
 'wsgi.input': <_io.BufferedReader name=7>,
 'wsgi.multiprocess': False,
 'wsgi.multithread': True,
 'wsgi.run_once': False,
 'wsgi.url_scheme': 'http',
 'wsgi.version': (1, 0)}
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [DEBUG] Base prefix (from config): '/radicale'
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [DEBUG] Sanitized path: '/foo/appleseedcard-de/'
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [WARNING] Called by reverse proxy, cannot remove base prefix '/radicale' from path: '/foo/appleseedcard-de/' as not matching
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [DEBUG] Read content of htpasswd file start: '/home/radicale/.config/radicale/users'
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [DEBUG] Read content of htpasswd file done: '/home/radicale/.config/radicale/users' (entries: 1, duplicates: 0, errors: 0)
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [DEBUG] Login verification successful for user: 'foo' (htpasswd/sha512/SHA-512)
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [INFO] Successful login: 'foo' (htpasswd)
[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [DEBUG] Response content:
BEGIN:VCARD
VERSION:3.0
[...]

[2025-04-13 23:22:49 +0200] [10034/Thread-1 (process_request_thread)] [INFO] GET response status for '/foo/appleseedcard-de/' in 0.008 seconds: 200 OK

So, this appears to work too, but the WARNING is still printed. 😑

[ckujau]

Interesting, this just reproduced on Nginx too:

$ sudo apt install nginx
$ cat /etc/nginx/sites-enabled/* 
server {
        listen 2080 default_server;
        listen [::]:2080 default_server;

        root /var/www/html;
        index index-nginx.html;
        server_name debian;

        location / {
                try_files $uri $uri/ =404;
        }

        location /radicale/ { # The trailing / is important!
            proxy_pass        http://localhost:5232/; # The / is important!
            proxy_set_header  X-Script-Name /radicale;
            proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header  X-Forwarded-Host $host;
            proxy_set_header  X-Forwarded-Port $server_port;
            proxy_set_header  X-Forwarded-Proto $scheme;
            proxy_set_header  Host $http_host;
            proxy_pass_header Authorization;
        }
}

Again, X-Script-Name is set, and script_name is not:

$ curl --user foo:bar -sL http://debian:2080/radicale/foo/appleseedcard-de/ | file -
/dev/stdin: vCard visiting card, version 3.0

=> OK

[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [INFO] GET request for '/foo/appleseedcard-de/' received from ::1 (forwarded for '192.168.65.1') using 'curl/8.7.1'
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [DEBUG] Request header:
{'CONTENT_LENGTH': '',
 'CONTENT_TYPE': 'text/plain',
 'GATEWAY_INTERFACE': 'CGI/1.1',
 'HTTP_ACCEPT': '*/*',
 'HTTP_AUTHORIZATION': 'Basic **masked**',
 'HTTP_CONNECTION': 'close',
 'HTTP_HOST': 'debian:2080',
 'HTTP_USER_AGENT': 'curl/8.7.1',
 'HTTP_X_FORWARDED_FOR': '192.168.65.1',
 'HTTP_X_FORWARDED_HOST': 'debian',
 'HTTP_X_FORWARDED_PORT': '2080',
 'HTTP_X_FORWARDED_PROTO': 'http',
 'HTTP_X_SCRIPT_NAME': '/radicale',
 'PATH_INFO': '/foo/appleseedcard-de/',
 'QUERY_STRING': '',
 'REMOTE_ADDR': '::1',
 'REMOTE_HOST': '',
 'REQUEST_METHOD': 'GET',
 'SCRIPT_NAME': '',
 'SERVER_NAME': 'localhost',
 'SERVER_PORT': '5232',
 'SERVER_PROTOCOL': 'HTTP/1.0',
 'SERVER_SOFTWARE': 'WSGIServer/0.2',
 'wsgi.errors': <_io.TextIOWrapper name='<stderr>' mode='w' encoding='utf-8'>,
 'wsgi.file_wrapper': <class 'wsgiref.util.FileWrapper'>,
 'wsgi.input': <_io.BufferedReader name=7>,
 'wsgi.multiprocess': False,
 'wsgi.multithread': True,
 'wsgi.run_once': False,
 'wsgi.url_scheme': 'http',
 'wsgi.version': (1, 0)}
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [DEBUG] Base prefix (from HTTP_X_SCRIPT_NAME): '/radicale'
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [DEBUG] Sanitized path: '/foo/appleseedcard-de/'
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [WARNING] Called by reverse proxy, cannot remove base prefix '/radicale' from path: '/foo/appleseedcard-de/' as not matching
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [DEBUG] Read content of htpasswd file start: '/home/radicale/.config/radicale/users'
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [DEBUG] Read content of htpasswd file done: '/home/radicale/.config/radicale/users' (entries: 1, duplicates: 0, errors: 0)
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [DEBUG] Login verification successful for user: 'foo' (htpasswd/sha512/SHA-512)
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [INFO] Successful login: 'foo' (htpasswd)
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [DEBUG] Response content:
BEGIN:VCARD
[...]
[2025-04-13 23:43:02 +0200] [11331/Thread-1 (process_request_thread)] [INFO] GET response status for '/foo/appleseedcard-de/' in 0.010 seconds: 200 OK

Unsetting X-Script-Name in Nginx and setting script_name = /radicale makes no difference, the warning is still there.

Again, for me this is just a cosmetic issue (albeit a new one since 3.5.1) and Radicale continues to work. If you feel like debugging further but can't reproduce this on your end I could probably setup a remote login for you to fiddle around some more. But as nobody else whines about this, and Radicale continues to work, I worry that you invest too much time to debug this and that it could turn out to be PEBKAC on my end after all :-(

[ArchangeGabriel]

And what about nginx? As I have the same issue with nginx since some radicale upgrade (Called by reverse proxy, cannot remove base prefix '/radicale' from path…)

[ArchangeGabriel]

nginx config relevant excerpt:

    location /radicale/ {
        proxy_pass_header Authorization;
        proxy_set_header X-Script-Name /radicale;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_pass http://localhost:5232/;
    }

[pbiering]

can you try what happens if you are using similar directive using

location ~ ... like LocationMatch does in Apache? See also https://github.com/Kozea/Radicale/blob/master/contrib/apache/radicale.conf

[corsac-s]

I had the same issue with the same nginx configuration as above. I tried using location ~ ^/radicale/ { and I got a warning from nginx saying:

2025/08/28 08:13:32 [emerg] 77#77: "proxy_pass" cannot have URI part in location given by regular expression, or inside named location, or inside "if" statement, or inside "limit_except" block in /etc/nginx/sites-enabled/sync:24

The "URI" part of proxy_pass is pretty small but it did have a trailing / which I tried to remove, and suddenly the path passed to radicale had the /radicale/ added and matching the X_SCRIPT_NAME so the warning disappeared.

On a hunch, I reverted to using:

location /radicale/ {
        proxy_pass_header Authorization;
        proxy_set_header X-Script-Name /radicale;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_pass http://localhost:5232; # NO TRAILING /
    }

and it seems to work as well.

So I think the trailing / should be removed from the proxy_pass directive in the documentation.

[ArchangeGabriel]

@corsac-s Thanks a lot, that solved it for me too. I can indeed see that no other config file I have in my nginx had a trailing / in the proxy_pass directive. So opened #1866 with your suggestion.

[DadiBit]

I have some input on a similar issue with Caddy.

Caddyfile (stripped from other services)

{$DOMAIN} {
  encode zstd gzip
  reverse_proxy /radicale/* 127.0.0.1:5232
}

config

[server]
hosts = 127.0.0.1:5232
script_name = /radicale

[auth]
type = htpasswd
htpasswd_filename = /config/users

[storage]
type = multifilesystem_nolock
filesystem_folder = /data/collections

This works fine (note that adding header_up X-Script-Name /radicale and removing the script_name entry from the config had the same result), as opposed to pre-strip with uri strip_prefix /radicale (which otherwise would allow me to auth but would yell when trying to upload my contacts). With this said I still face a "warning":

[2025-07-31 20:48:12 +0000] [2/Thread-1 (process_request_thread)] [INFO] GET request for '/radicale/.web/' received from 127.0.0.1 (forwarded for '10.88.0.1') using 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
[2025-07-31 20:48:12 +0000] [2/Thread-1 (process_request_thread)] [INFO] Successful login: 'davide' (htpasswd)
[2025-07-31 20:48:12 +0000] [2/Thread-1 (process_request_thread)] [INFO] GET response status for '/radicale/.web/' in 0.048 seconds: 200 OK
[2025-07-31 20:48:19 +0000] [2/Thread-2 (process_request_thread)] [INFO] PROPFIND request for '/radicale/' received from 127.0.0.1 (forwarded for '10.88.0.1') using 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
[2025-07-31 20:48:19 +0000] [2/Thread-2 (process_request_thread)] [INFO] Access to '/' denied for anonymous user
[2025-07-31 20:48:19 +0000] [2/Thread-2 (process_request_thread)] [INFO] PROPFIND response status for '/radicale/' in 0.003 seconds: 401 Unauthorized
[2025-07-31 20:48:19 +0000] [2/Thread-3 (process_request_thread)] [INFO] PROPFIND request for '/radicale/' received from 127.0.0.1 (forwarded for '10.88.0.1') using 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
[2025-07-31 20:48:19 +0000] [2/Thread-3 (process_request_thread)] [INFO] Successful login: 'davide' (htpasswd)
[2025-07-31 20:48:19 +0000] [2/Thread-3 (process_request_thread)] [INFO] PROPFIND response status for '/radicale/' in 0.032 seconds: 207 Multi-Status
[2025-07-31 20:48:19 +0000] [2/Thread-4 (process_request_thread)] [INFO] PROPFIND request for '/radicale/davide/' with depth '1' received from 127.0.0.1 (forwarded for '10.88.0.1') using 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
[2025-07-31 20:48:19 +0000] [2/Thread-4 (process_request_thread)] [INFO] Access to '/davide/' denied for anonymous user
[2025-07-31 20:48:19 +0000] [2/Thread-4 (process_request_thread)] [INFO] PROPFIND response status for '/radicale/davide/' with depth '1' in 0.002 seconds: 401 Unauthorized
[2025-07-31 20:48:19 +0000] [2/Thread-5 (process_request_thread)] [INFO] PROPFIND request for '/radicale/davide/' with depth '1' received from 127.0.0.1 (forwarded for '10.88.0.1') using 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
[2025-07-31 20:48:19 +0000] [2/Thread-5 (process_request_thread)] [INFO] Successful login: 'davide' (htpasswd)
[2025-07-31 20:48:19 +0000] [2/Thread-5 (process_request_thread)] [INFO] PROPFIND response status for '/radicale/davide/' with depth '1' in 0.048 seconds: 207 Multi-Status

I am running radicale as a podman rootful container, btw.

Please note that using handle_path already strips the path.
Stripping the base path beforehand, either way, makes uploading unusable: NEVER strip the prefix with the proxy, even if it looks ok initially when authenticating.

EDIT

The 207 multi-status responses always respond with the 200 OK status and 404 Not Found status, for both /radicale/ and /radicale/davide: any idea of why this is happening? It looks fine, however I don't get why I get both an OK and a Not Found, they contradict each other.