Summary
When ViniPlay is deployed behind an authenticating reverse proxy (e.g. oauth2-proxy, Authelia, Authentik, Traefik forward-auth), users must log in twice: once at the proxy (SSO/OIDC), then again at ViniPlay's own username/password form. It would be great if ViniPlay could optionally trust an identity header set by the proxy and log the user in automatically, so the built-in login form is bypassed when a trusted upstream has already authenticated the request.
Environment / current behavior
ViniPlay v0.11.0, running behind oauth2-proxy in front of Nextcloud OIDC.
ViniPlay currently reads only x-forwarded-for (for client-IP logging) and honors no authentication header; it does not call app.set('trust proxy', …).
Result: the proxy authenticates the user (group-restricted SSO), but ViniPlay still shows its own separate login, and admins must maintain a parallel set of ViniPlay accounts.
Proposed feature
An opt-in "reverse-proxy authentication" mode, configured via environment variables, that:
Reads the authenticated username/email from a configurable header (e.g. X-Auth-Request-User / X-Auth-Request-Email / X-Forwarded-Preferred-Username — proxies vary, so make it configurable, with a sensible default).
Auto-provisions a ViniPlay user on first sight of a new identity (and logs it in), so no parallel account management is needed.
Skips the built-in login form entirely while the mode is active and a valid header is present.
Suggested config (names illustrative):
PROXY_AUTH_ENABLED=true (default false)
PROXY_AUTH_HEADER=X-Auth-Request-Email
PROXY_AUTH_TRUSTED_IPS=127.0.0.1/32 (or the proxy's source IP/CIDR)
optional PROXY_AUTH_ADMIN_USERS=… / first-provisioned-user-is-admin
Security consideration (important)
Header-based auth must be off by default and must only trust the identity header when the request originates from a configured, trusted proxy IP/CIDR. Otherwise any direct client could spoof the header and bypass authentication entirely. Please gate it behind both an explicit enable flag and a trusted-source-IP check (mirroring oauth2-proxy's own --trusted-proxy-ips), and ignore the header for any request not coming from that source.
Why not just use the built-in login?
For homelab/SSO setups the whole point of the fronting proxy is a single identity source (OIDC group membership, MFA, etc.). A second, independent ViniPlay password defeats that and creates a separate credential to manage and secure.
Willing to help test any preview build behind oauth2-proxy.
Summary
When ViniPlay is deployed behind an authenticating reverse proxy (e.g. oauth2-proxy, Authelia, Authentik, Traefik forward-auth), users must log in twice: once at the proxy (SSO/OIDC), then again at ViniPlay's own username/password form. It would be great if ViniPlay could optionally trust an identity header set by the proxy and log the user in automatically, so the built-in login form is bypassed when a trusted upstream has already authenticated the request.
Environment / current behavior
ViniPlay v0.11.0, running behind oauth2-proxy in front of Nextcloud OIDC.
ViniPlay currently reads only x-forwarded-for (for client-IP logging) and honors no authentication header; it does not call app.set('trust proxy', …).
Result: the proxy authenticates the user (group-restricted SSO), but ViniPlay still shows its own separate login, and admins must maintain a parallel set of ViniPlay accounts.
Proposed feature
An opt-in "reverse-proxy authentication" mode, configured via environment variables, that:
Reads the authenticated username/email from a configurable header (e.g. X-Auth-Request-User / X-Auth-Request-Email / X-Forwarded-Preferred-Username — proxies vary, so make it configurable, with a sensible default).
Auto-provisions a ViniPlay user on first sight of a new identity (and logs it in), so no parallel account management is needed.
Skips the built-in login form entirely while the mode is active and a valid header is present.
Suggested config (names illustrative):
PROXY_AUTH_ENABLED=true (default false)
PROXY_AUTH_HEADER=X-Auth-Request-Email
PROXY_AUTH_TRUSTED_IPS=127.0.0.1/32 (or the proxy's source IP/CIDR)
optional PROXY_AUTH_ADMIN_USERS=… / first-provisioned-user-is-admin
Security consideration (important)
Header-based auth must be off by default and must only trust the identity header when the request originates from a configured, trusted proxy IP/CIDR. Otherwise any direct client could spoof the header and bypass authentication entirely. Please gate it behind both an explicit enable flag and a trusted-source-IP check (mirroring oauth2-proxy's own --trusted-proxy-ips), and ignore the header for any request not coming from that source.
Why not just use the built-in login?
For homelab/SSO setups the whole point of the fronting proxy is a single identity source (OIDC group membership, MFA, etc.). A second, independent ViniPlay password defeats that and creates a separate credential to manage and secure.
Willing to help test any preview build behind oauth2-proxy.