Verdaccio changing the response base href after a while #3684

Lasto13 · 2023-03-15T15:21:24Z

Lasto13
Mar 15, 2023

Hello,
Verdaccio latest:5.22.1 is deployed at EC2 with private IP 10.32.11.100, we have loadbalancer configured with certificates at https://npm.the_company.com/.

After it is started it returns index.html with basename like:

<base href="https://npm.the_company.com/">

but after cca one hour it starts to serve a different index.html

<base href="http://10.32.11.100/">

Thus browser is rightfully complaining about mixed content.

Verdaccio itself is configured with compose like this:

services:
  verdaccio:
    image: verdaccio/verdaccio
    container_name: 'verdaccio'
    restart: always
    networks:
      - node-network
    environment:
      - VERDACCIO_PORT=4873
      - VERDACCIO_PUBLIC_URL='https://npm.the_company.com'
    ports:
      - '80:4873'
    volumes:
      - './storage:/verdaccio/storage'
      - './config:/verdaccio/conf'
      - './plugins:/verdaccio/plugins'
networks:
  node-network:
    driver: bridge

and config.yml

storage: ../storage
auth:
  htpasswd:
    file: ./htpasswd
listen: 'http://npm.the_company.com'
uplinks:
  npmjs:
    url: https://registry.npmjs.org/
packages:
  '@*/*':
    access: $anonymous
    publish: $anonymous
    proxy: npmjs
  '**':
    access: $anonymous
    proxy: npmjs
log: { type: stdout, format: pretty, level: http }

After we start it we receive following index.html

    <!DOCTYPE html>
      <html lang="en-us"> 
      <head>
        <meta charset="utf-8">
        <base href="https://npm.the_company.com/">
        <title>Verdaccio</title>        
        <link rel="icon" href="https://npm.the_company.com/-/static/favicon.ico"/>
        <meta name="viewport" content="width=device-width, initial-scale=1" /> 
        <script>
            window.__VERDACCIO_BASENAME_UI_OPTIONS={"darkMode":false,"basename":"/","base":"https://npm.the_company.com/","primaryColor":"#4b5e40","logo":"","flags":{},"login":true,"pkgManagers":["yarn","pnpm","npm"],"title":"Verdaccio","scope":"","language":"es-US"}
        </script>
        
      </head>
      <body class="body">
      
        <div id="root"></div>
        <script defer="defer" src="https://npm.the_company.com/-/static/runtime.46bd00483c91daa50e74.js"></script><script defer="defer" src="https://npm.the_company.com/-/static/vendors.46bd00483c91daa50e74.js"></script><script defer="defer" src="https://npm.the_company.com/-/static/main.46bd00483c91daa50e74.js"></script>
        
      </body>
    </html>

And this is after one cca hour

<!DOCTYPE html>
      <html lang="en-us"> 
      <head>
        <meta charset="utf-8">
        <base href="http://10.32.11.100/">
        <title>Verdaccio</title>
        <link rel="icon" href="http://10.32.11.100/-/static/favicon.ico"/>
        <meta name="viewport" content="width=device-width, initial-scale=1" /> 
        <script>
            window.__VERDACCIO_BASENAME_UI_OPTIONS={"darkMode":false,"basename":"/","base":"http://10.32.11.100/","primaryColor":"#4b5e40","logo":"","flags":{},"login":true,"pkgManagers":["yarn","pnpm","npm"],"title":"Verdaccio","scope":"","language":"es-US"}
        </script>
        
      </head>    
      <body class="body">
      
        <div id="root"></div>
        <script defer="defer" src="http://10.32.11.100/-/static/runtime.46bd00483c91daa50e74.js"></script><script defer="defer" src="http://10.32.11.100/-/static/vendors.46bd00483c91daa50e74.js"></script><script defer="defer" src="http://10.32.11.100/-/static/main.46bd00483c91daa50e74.js"></script>
        
      </body>
    </html>

juanpicado · 2023-03-15T21:39:25Z

juanpicado
Mar 15, 2023
Maintainer

I don´t know but maybe you can increase logging https://github.com/verdaccio/verdaccio/wiki/Debugging-Verdaccio#debugging-with-debug and see if you get more info

0 replies

Mior · 2023-03-21T00:07:44Z

Mior
Mar 21, 2023

Hey, I'm colleague of @Lasto13, so, we increased logging level and monitored situation and this is observation.
Issue was with combination of health check from LoadBalancer and web cache of Verdaccio, maybe useful information for future readers.

We have Reverse Proxy LoadBalancer in front of Verdaccio, It was doing health check request every X seconds. This health check does not include "host" header - DNS record npm.the_company.com
As it appears, on startup Verdaccio web:render renders web UI and caches it for some time (~1h).
After caches is invalidated it re-renders page for next request and caches it again for next period.

As loadbalancer is doing frequent requests (without host header) it is therefore likely to hit just on cache invalidation and render is done for loadbalancer health check (without host header), rendered page is therefore cached with IP instead of domain name like in original post ( <script src=http://10.32.11.100/-/static/runtime.46bd00483c91daa50e74.js"> ) (see below logs)
This is triggering either Mixed content errors (if Verdaccio is on HTTP) or CORS errors (if Verdaccio is on HTTPS).

What is candidate for Issue is that it was rendering with IP despite we had configuration set with

config.yml: with
listen: 'https://npm.the_company.com'

docker-compose.yml: with

environment:
      - VERDACCIO_PUBLIC_URL='https://npm.the_company.com'

How did we fix it?

we disable web cache in Verdaccio configuration sacrificing little performance.
we updated healthcheck endpoint to use /-/ping which is not going through web:render

Logs:
This is usual "cached" request

info <-- 10.38.45.30 requested 'GET /'
http <-- 200, user: null(10.38.45.30), req: 'GET /', bytes: 0/0
http <-- 200, user: null(10.38.45.30), req: 'GET /', bytes: 0/1113
verdaccio:logger http (25) was changed to http (25)
verdaccio:core:url req protocol: undefined
verdaccio:core:url combined protocol 'https'
verdaccio:core:url combined host '10.32.11.100'
verdaccio:core:url combined prefix ''
verdaccio:core:url combined url 'https://10.32.11.100/'
verdaccio:core:url public url by request 'https://10.32.11.100/'
verdaccio:web:middlwares invalid primary color undefined
verdaccio:web:render reuse template cache
verdaccio:web:render web rendered
verdaccio:web:render render root

This is request on cache invalidation

info <-- 10.38.45.30 requested 'GET /'
http <-- 200, user: null(10.38.45.30), req: 'GET /', bytes: 0/0
http <-- 200, user: null(10.38.45.30), req: 'GET /', bytes: 0/1113
verdaccio:logger http (25) was changed to http (25)
verdaccio:core:url req protocol: undefined
verdaccio:core:url combined protocol 'https'
verdaccio:core:url combined host '10.32.11.100'
verdaccio:core:url combined prefix ''
verdaccio:core:url combined url 'https://10.32.11.100/'
verdaccio:core:url public url by request 'https://10.32.11.100/'
verdaccio:web:middlwares invalid primary color undefined
verdaccio:web:render:template template { manifest: { js: [ 'runtime.js', 'vendors.js', 'main.js' ] }, options: { showInfo: undefined, showSettings: undefined, showThemeSwitch: undefined, showFooter: undefined, showSearch: undefined, showDownloadTarball: undefined, darkMode: false, url_prefix: undefined, basename: '/', base: 'https://10.32.11.100/', primaryColor: '#4b5e40', version: undefined, logo: '', flags: {}, login: true, pkgManagers: [ 'yarn', 'pnpm', 'npm' ], title: 'Verdaccio', scope: '', language: 'es-US' }, scriptsBodyAfter: [], metaScripts: [], scriptsbodyBefore: undefined }
verdaccio:web:render:template manifest { 'main.js': '-/static/main.46bd00483c91daa50e74.js', 'runtime.js': '-/static/runtime.46bd00483c91daa50e74.js', 'Version.js': '-/static/Version.46bd00483c91daa50e74.js', 'Home.js': '-/static/Home.46bd00483c91daa50e74.js', 'vendors.js': '-/static/vendors.46bd00483c91daa50e74.js', 'favicon.ico': '-/static/favicon.ico', 'index.html': '-/static/index.html' }
verdaccio:web:render:manifest resolve item 'runtime.js'
verdaccio:web:render:manifest resolved item 'https://10.32.11.100/-/static/runtime.46bd00483c91daa50e74.js'
verdaccio:web:render:manifest resolve item 'vendors.js'
verdaccio:web:render:manifest resolved item 'https://10.32.11.100/-/static/vendors.46bd00483c91daa50e74.js'
verdaccio:web:render:manifest resolve item 'main.js'
verdaccio:web:render:manifest resolved item 'https://10.32.11.100/-/static/main.46bd00483c91daa50e74.js'
verdaccio:web:render set template cache
verdaccio:web:render web rendered
verdaccio:web:render render root

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Verdaccio

Verdaccio changing the response base href after a while #3684

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Verdaccio

Verdaccio changing the response base href after a while #3684

Lasto13 Mar 15, 2023

Replies: 2 comments

juanpicado Mar 15, 2023 Maintainer

Mior Mar 21, 2023

Lasto13
Mar 15, 2023

juanpicado
Mar 15, 2023
Maintainer

Mior
Mar 21, 2023