Repository navigation
Browser scene creation returns 503 behind reverse proxy #878
Description
Browser scene creation returns 503 on reverse-proxied self-hosted editor
Reproduction
- Deploy Pascal Editor behind a reverse proxy at
https://pascal.example.com. - Set
PASCAL_SCENE_API_ORIGINS=https://pascal.example.com. - Leave
PASCAL_SCENE_API_TOKENunset. - Open
/scenesand click Create new scene.
The browser POST to /api/scenes fails with:
{"error":"scene_api_token_required"}The UI displays Failed to create scene (503).
Root cause
scene-api-security.ts correctly validates the configured browser origin, but validateAuth() then requires a token for every non-loopback request. A same-origin browser request arriving through the reverse proxy is not identified as loopback. The frontend does not send Authorization or X-Pascal-Scene-Token, so scene creation cannot work with the documented public-origin configuration.
Expected behavior
A browser request from an origin listed in PASCAL_SCENE_API_ORIGINS should be accepted without an API token, while non-browser/API clients should continue to require token authentication.
Environment
- Pascal Editor deployed with Docker/Openship
- Public origin configured with
PASCAL_SCENE_API_ORIGINS - Reverse proxy terminates TLS
Activity
Aymericr commentedon Sep 28, 2026
Thanks for the reproducible proxy configuration. The browser flow needs to work, and #880 is the relevant proposed fix. My review found that the current patch can also bypass an explicitly configured API token when request headers match the allowed origin. That boundary needs to be preserved before the fix lands.
Keeping this issue open. A configured origin controls which browser origins are accepted; it should not itself become proof that a caller is authenticated.
chbndrhnns commentedon Sep 29, 2026
Thanks for the review and for pointing out that boundary.
I updated #880 in
9e7bad6:if (!token).PASCAL_SCENE_API_TOKENis configured, a matchingOriginor forwarded header no longer bypasses the token under any circumstance. Callers must supply a validAuthorization: BearerorX-Pascal-Scene-Token.PASCAL_SCENE_API_ORIGINS.PASCAL_SCENE_API_TOKENis configured, genuine same-origin requests through a proxy still receive401 {"error":"unauthorized"}unless the token is provided.