When accessing password protected albums, the login dialog is shown instead of a password prompt

[Gendra13]

Lychee version

master (15c8908)

Which PHP version are you using?

PHP 8.3

Detailed description of the problem

When using the newest master-version (even after #2688 being applied), I am still experiencing problems accessing password-protected albums.
Even though no error 403 is shown anymore, when I am trying to open a password protected album without being logged in, I am getting the “normal” login prompt instead of a specific prompt only asking for the specified password. Therefore, it is not possible to open the album even when having to correct password but no user account. (I also tried just entering the password, but unsurprisingly it didn’t work).

Steps to reproduce the issue

1. Create a new album and upload some images
2. In album settings, enable Public access, check “Password protected” and set a password
3. Copy the link to the album
   -- Switch to a different device or log-out/continue in a private browser window --
4. Try to open the album with the copied link
5. Instead of a password prompt, only the login window is shown and you can’t access the album without a user account

Diagnostics [REQUIRED]

Errors
warning
/v**********************lic/sym/ has permissions 0755, but should have 2775
warning
/var/*****************torage/tmp/jobs/ has permissions 0755, but should have 2775
warning
/var/*****************torage/tmp/uploads/ has permissions 0755, but should have 2775
warning
Default timezone not properly set; you might experience strange results when importing photos without explicit EXIF timezone
info
Have you considered supporting Lychee? :)
Info

Lychee Version (git):                      master (15c8908) -- Up to date (15 minutes ago).
DB Version:                                6.0.1
composer install:                          --no-dev
APP_ENV:                                   production
APP_DEBUG:                                 false
APP_URL:                                   set
APP_DIR:                                   set
LOG_VIEWER_ENABLED:                        true
VUEJS_ENABLED:                             true
PHOTO_PIPES:                               true
System:                                    Linux
PHP Version:                               8.3.13
PHP User agent:                            Lychee/4 (https://lycheeorg.github.io/)
Timezone:                                  UTC
Max uploaded file size:                    512M
Max post size:                             512M
Chunk size:                                12.80 MB
Max execution time:                        300
MySQL Version:                             10.6.18-MariaDB-0ubuntu0.22.04.1
exec() Available:                          yes
Imagick Available:                         1
Imagick Enabled:                           1
Imagick Version:                           1691
GD Version:                                2.3.3
Number of foreign key:                     36 found.

		

Space
Configuration

version:                                   060001
check_for_updates:                         1
sorting_photos_col:                        taken_at
sorting_photos_order:                      ASC
sorting_albums_col:                        max_taken_at
sorting_albums_order:                      ASC
imagick:                                   1
skip_duplicates:                           0
small_max_width:                           0
small_max_height:                          360
medium_max_width:                          1920
medium_max_height:                         1080
lang:                                      en
image_overlay_type:                        none
default_license:                           reserved
compression_quality:                       90
grants_full_photo_access:                  1
delete_imported:                           0
mod_frame_enabled:                         0
mod_frame_refresh:                         30
thumb_2x:                                  1
small_2x:                                  1
medium_2x:                                 1
landing_page_enable:                       0
force_migration_in_production:             0
search_public:                             0
hide_version_number:                       0
SL_enable:                                 0
SL_for_admin:                              0
recent_age:                                1
grants_download:                           0
photos_wraparound:                         1
map_display:                               1
zip64:                                     1
map_display_public:                        1
map_provider:                              OpenStreetMap.de
force_32bit_ids:                           0
map_include_subalbums:                     1
update_check_every_days:                   1
has_exiftool:                              0
share_button_visible:                      0
import_via_symlink:                        0
has_ffmpeg:                                0
location_decoding:                         1
location_decoding_timeout:                 30
location_show:                             1
location_show_public:                      1
rss_enable:                                0
rss_recent_days:                           7
rss_max_items:                             100
prefer_available_xmp_metadata:             0
editor_enabled:                            1
lossless_optimization:                     0
swipe_tolerance_x:                         150
swipe_tolerance_y:                         250
local_takestamp_video_formats:             .avi|.mov
log_max_num_line:                          1000
unlock_password_photos_with_url_param:     0
nsfw_visible:                              1
nsfw_blur:                                 0
nsfw_warning:                              0
nsfw_warning_admin:                        0
nsfw_banner_override:                      
map_display_direction:                     1
album_subtitle_type:                       takedate
upload_processing_limit:                   4
new_photos_notification:                   0
legacy_id_redirection:                     1
zip_deflate_level:                         6
default_album_protection:                  1
album_decoration:                          none
album_decoration_orientation:              row
allow_username_change:                     1
auto_fix_orientation:                      1
use_job_queues:                            1
random_album_id:                           starred
use_last_modified_date_when_no_exif_date:  0
layout:                                    justified
date_format_photo_thumb:                   D, d M Y H:i:s
date_format_photo_overlay:                 D, d M Y H:i:s
date_format_sidebar_uploaded:              D, d M Y H:i:s
date_format_sidebar_taken_at:              D, d M Y H:i:s
date_format_hero_min_max:                  F Y
date_format_hero_created_at:               M Y
date_format_album_thumb:                   M Y
upload_chunk_size:                         0
nsfw_banner_blur_backdrop:                 0
search_pagination_limit:                   1000
search_minimum_length_required:            4
photo_layout_justified_row_height:         320
photo_layout_masonry_column_width:         400
photo_layout_grid_column_width:            250
photo_layout_square_column_width:          180
photo_layout_gap:                          10
display_thumb_album_overlay:               always
display_thumb_photo_overlay:               hover
default_album_thumb_aspect_ratio:          1/1
use_album_compact_header:                  0
login_button_position:                     left
back_button_enabled:                       0
back_button_text:                          Return to Home
current_job_processing_visible:            0
SA_random_thumbs:                          0
job_processing_queue_visible:              1
login_required:                            0
enable_unsorted:                           0
enable_starred:                            0
enable_recent:                             0
enable_on_this_day:                        0
login_required_root_only:                  1
dark_mode_enabled:                         1
show_keybinding_help_popup:                0
show_keybinding_help_button:               1
disable_se_call_for_actions:               0
enable_se_preview:                         1
slideshow_timeout:                         5
keep_original_untouched:                   1
low_quality_image_placeholder:             1
timeline_photos_enabled:                   1
timeline_photos_public:                    0
timeline_photos_granularity:               day
timeline_photos_order:                     taken_at
timeline_photos_layout:                    square
timeline_photos_pagination_limit:          200
timeline_albums_enabled:                   1
timeline_albums_public:                    0
timeline_albums_granularity:               year
timeline_left_border_enabled:              1
timeline_photo_date_format_year:           Y
timeline_photo_date_format_month:          M Y
timeline_photo_date_format_day:            j M Y
timeline_photo_date_format_hour:           g:i
timeline_album_date_format_year:           Y
timeline_album_date_format_month:          M Y
timeline_album_date_format_day:            j M
hide_nsfw_in_smart_albums:                 1
hide_nsfw_in_frame:                        1
hide_nsfw_in_map:                          1
hide_nsfw_in_search:                       1
search_photos_layout:                      square
hide_nsfw_in_rss:                          1
hide_nsfw_in_timeline:                     1

Browser & System [REQUIRED]

Server:
Ubuntu 22.04 LTS (Linux 6.8.0-48)
php8.3.12
nginx/1.18.0

Client:
Windows 10
Firefox 132.0

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.

[ildyria]

Fixed.

[Gendra13]

Ok, that's odd.
It seems to be related to lychee being hosted in a sub-folder. When I test the same album without an APP_DIR it works indeed.
I will try to investigate more.

[Gendra13]

@ildyria
What I could find out so far:

The problem is definitely related to hosting lychee in a sub-folder.

When I open the gallery under http://mydomin.de/lychee/gallery/xxx then I get the wrong dialog:

However when I change my .env and open the exact same gallery under http://lychee.mydomin.de/gallery/xxx then it shows me the right dialog.

Unfortunately, I can’t see anything in the browser requests or lychee’s logfiles that look different between those two scenarios.
Can there be a problem in the way lychee processes the requests, so maybe it doesn’t find to correct album when the sub-folder is included in the request. Do you may have an idea or at least a hint where I can look further?

[ildyria]

Hummm can you open your dev tools and check which URL is being called as a GET request for the album ?
It should be something like this: https://lychee.test/api/v2/Album?album_id=Rst4eSHsA-rjz_Pt5Gobarab

That should give us a first hint of where to look at.

[Gendra13]

Puhhh, I could solve the issue, but the problem was really bizarre:
While testing a lot of things, I realized that I had configured my nginx to use custom pages for http errors (401, 404...) instead of the generic ones. Through some interference that is completely inexplicable to me, this created the problem.
The reason this affected only the sub-folder hosting was most likely because nginx uses a different configuration set for each subdomain, so the custom pages were only set for my main domain.
In the end I could fix it by adding fastcgi_intercept_errors off; to my nginx/lychee.conf which disabled that behavior and voila it works now.

Sorry for the inconvenience. 🙈
However, there were some other (small) things I stumbled accross during my testing (like #2757) but I will create a seperate discussion for those.