Base href value in HTML of http://localhost:4873/ suddenly turns into https://ip.address.of.server/ #4086

sp00x · 2023-10-22T20:38:23Z

sp00x
Oct 22, 2023

Your Environment

verdaccio version: 5.27.0
node version: 18.13.0
package manager: npm 9
os: debian 12.2 (bookworm)
platform: npm

Describe the bug

Initially the base href and urls in the main HTML is returned as http://localhost:4873, e.g:

        <base href="http://localhost:4873/">
        <title>npm.xxxxxxxxxx</title>
        <link rel="icon" href="http://localhost:4873/-/static/favicon.ico"/>
        <meta name="viewport" content="width=device-width, initial-scale=1" />
        <script>
            window.__VERDACCIO_BASENAME_UI_OPTIONS={"darkMode":true,"url_prefix":"/","basename":"/","base":"http://localhost:4873/","primaryColor":"#4b5e40","version":"5.27.0","logo":"","flags":{"searchRemote":false,"changePassword":false},"login":true,"pkgManagers":["yarn","pnpm","npm"],"title":"npm.xxxxxxxxxxxx","scope":"","language":"es-US","hideDeprecatedVersions":false}
        </script>
...etc

..but after running for some time they suddenty turn into https://(ip address of machine)/

<html>
<body>
<!--StartFragment-->

<!DOCTYPE html>
--
   <html lang="en-us">
   <head>
   <meta charset="utf-8">
   <base href="https://xxxxxx/">
   <title>npm.xxxxxxxx</title>
   <link rel="icon" href="https://xxxxxxx/-/static/favicon.ico"/>
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <script>
   window.__VERDACCIO_BASENAME_UI_OPTIONS={"darkMode":true,"url_prefix":"/./","basename":"/","base":"https://xxxxxxx/","primaryColor":"#4b5e40","version":"5.27.0","logo":"","flags":{"searchRemote":false,"changePassword":false},"login":true,"pkgManagers":["yarn","pnpm","npm"],"title":"npm.xxxxxxx","scope":"","language":"es-US","hideDeprecatedVersions":false}
  | </script>

<!--EndFragment-->
</body>
</html>

This causes nginx rewrites to fail, and only a blank page is displayed since https://(ip address) is not considered valid/secure.

I don't really see the point of having this full URL here anyway, does it not suffice to load all resources relative to the base URL ?

( Setting env VERDACCIO_PUBLIC_URL to https://(fulldomain)/ before running the daemon apparently(?) makes it work? )

To Reproduce

Not sure what triggers it.. Happens after running for a while.

Expected behavior

Should not change from localhost to ip address in base href and other references in HTML.

Screenshots, server logs, package manager log

N/A

Configuration File (cat ~/.config/verdaccio/config.yaml)

mostly default config with

# ..
url_prefix: /
# ..

Environment information

  System:
    OS: Linux 6.1 Debian GNU/Linux 12 (bookworm) 12 (bookworm)
    CPU: (1) x64 Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz
  Binaries:
    npm: 9.2.0 - /usr/bin/npm
  npmGlobalPackages:
    verdaccio: 5.27.0

sp00x · 2023-10-22T20:47:17Z

sp00x
Oct 22, 2023
Author

Note: the HTML with the IP mentioned above is the output of curl http://localhost:4873 - not through nginx.

0 replies

sp00x · 2023-10-26T14:24:18Z

sp00x
Oct 26, 2023
Author

( I'm curious if this was related to verdaccio by default on this machine only binding to ipv6 (::1:4873) and not ipv4, as I ran into another issue with nginx failing to proxy after a while, where localhost was resolving to only 127.0.0.1. I reconfigured it with a listener list to listen to both ::1:4873 and 127.0.0.1 loopbacks. )

0 replies

Tobbe · 2024-04-29T10:38:57Z

Tobbe
Apr 29, 2024

I'm running into the same issue!

$ curl http://localhost:4873

    <!DOCTYPE html>
      <html lang="en-us">
      <head>
        <meta charset="utf-8">
        <base href="https://0.0.0.0/">
        <title>Verdaccio</title>
        <link rel="icon" href="https://0.0.0.0/-/static/favicon.ico"/>
        <meta name="viewport" content="width=device-width, initial-scale=1" />
        <script>
            window.__VERDACCIO_BASENAME_UI_OPTIONS={"darkMode":false,"basename":"/","base":"https://0.0.0.0/","primaryColor":"#4b5e40","version":"5.30.3","logo":"","flags":{"searchRemote":false,"changePassword":false},"login":true,"pkgManagers":["yarn","pnpm","npm"],"title":"Verdaccio","scope":"","language":"es-US","hideDeprecatedVersions":false}
        </script>

      </head>
      <body class="body">

        <div id="root"></div>
        <script defer="defer" src="https://0.0.0.0/-/static/runtime.6bb297bdcdacab53ef33.js"></script><script defer="defer" src="https://0.0.0.0/-/static/vendors.6bb297bdcdacab53ef33.js"></script><script defer="defer" src="https://0.0.0.0/-/static/main.6bb297bdcdacab53ef33.js"></script>

      </body>
    </html>

I used to get urls like https://10.0.0.1/-/static/runtime.hash.js in the response to my browser when I accessed https://sub.domain.tld. But now it's apparently 0.0.0.0 instead 🤷‍♂️

I'll see if I can find some setting to tweak to fix this

0 replies

Tobbe · 2024-04-29T12:25:11Z

Tobbe
Apr 29, 2024

Another thing to be aware of here is that Verdaccio by default caches the html template for an hour. So if you use curl http://127.0.0.1:4873 on the server to debug things, that's what'll get served to browsers etc as well when requesting the page for the next hour unless you restart Verdaccio.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Verdaccio

Base href value in HTML of http://localhost:4873/ suddenly turns into https://ip.address.of.server/ #4086

{{title}}

Replies: 4 comments

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Verdaccio

Base href value in HTML of http://localhost:4873/ suddenly turns into https://ip.address.of.server/ #4086

sp00x Oct 22, 2023

Replies: 4 comments

sp00x Oct 22, 2023 Author

sp00x Oct 26, 2023 Author

Tobbe Apr 29, 2024

Tobbe Apr 29, 2024

sp00x
Oct 22, 2023

sp00x
Oct 22, 2023
Author

sp00x
Oct 26, 2023
Author

Tobbe
Apr 29, 2024

Tobbe
Apr 29, 2024