Block access to certain paths when using Caddy as reverse proxy

[JamalS (Jamal Shaheed)]

1. Output of caddy version:

v2.6.2

2. How I run Caddy:

a. System environment:

Ubuntu 22.04
Systemd
Installed via APT

b. Command:

Paste command here.

c. Service/unit/compose file:

Paste full file contents here.
Make sure backticks stay on their own lines,
and the post looks nice in the preview pane. -->

d. My complete Caddy config:

gotify.******.com {
@notblacklisted {
not {
path */#/login
}
}

reverse_proxy @notblacklisted 10.0.0.20:8080

}

Paste your config here, replacing this text.
Use `caddy fmt` to make it readable.
DO NOT REDACT anything except credentials.
LEAVE DOMAIN NAMES INTACT.
Make sure the backticks stay on their own lines.

3. The problem I’m having:

Trying to block access to certain paths when using Caddy as a reverse proxy.
Gotify’s admin interface is mygotifydomain.com/#/login and I want to block/not proxy the path “/#/login” from the outside world. All other paths I want allowed to be accessed by the internet/proxied by Caddy.

I’ve tried following the “Blacklist” config here: V1: Block or allow certain paths to a backend, using Caddy proxy.

4. Error messages and/or full log output:

No Errors - Access to /#/login is still allowed

Paste logs/commands/output here.
USE THE PREVIEW PANE TO MAKE SURE IT LOOKS NICELY FORMATTED.

5. What I already tried:

V1: Block or allow certain paths to a backend, using Caddy proxy

1. My Caddy version (caddy version): Version 1 2. My Caddyfile server.company.com:443 { log ./logs/access.log #tls self_signed proxy / http://localhost:8888 { transparent websocket insecure_skip_verify } proxy /login 127.0.0.1:4200 { transparent } } 3. The problem I’m having: Okay, I’m trying to get my head around how the Caddyfile works. I’m trying to setup a reverse proxy, that either blocks certain paths, or preferably whitelists allowed paths. So that the Caddy pro…

6. Links to relevant resources:

V1: Block or allow certain paths to a backend, using Caddy proxy

1. My Caddy version (caddy version): Version 1 2. My Caddyfile server.company.com:443 { log ./logs/access.log #tls self_signed proxy / http://localhost:8888 { transparent websocket insecure_skip_verify } proxy /login 127.0.0.1:4200 { transparent } } 3. The problem I’m having: Okay, I’m trying to get my head around how the Caddyfile works. I’m trying to setup a reverse proxy, that either blocks certain paths, or preferably whitelists allowed paths. So that the Caddy pro…

[francislavoie]

@JamalS

Access to /#/login is still allowed

The part at and including # is called the “fragment” in the URI. That part is never sent to the server. That’s purely in the frontend. It’s not possible for the server to filter based on that.

[JamalS (Jamal Shaheed)]

Hi Francis, thanks for the response.

So is there no way I can restrict access using Caddy?

I guess the alternative is to go with a whitelist model and block all access and whitelist paths without that fragment?

Thanks

[francislavoie]

It’s impossible for the server to be aware of the fragment, because the browser never sends it to the server.

All Caddy will see is / and that’s it.

I’m not sure I understand what you’re trying to do. But it seems like you have a JS SPA which is a frontend router. With that setup, it’s not possible to block specific paths on the server, because it’s not the server that does the routing decisions.

You can probably block paths for your API though.

[JamalS (Jamal Shaheed)]

Fair enough, thank you for your help