Possible for caddy reverse proxy to restrict javascript single page app access?

1. The problem I’m having:

Hi, I setup caddy as a reverse proxy to a a web application that is running on lan in a docker container. The web application, GitHub - blakeblackshear/frigate: NVR with realtime local object detection for IP cameras , appears to be a single page app that uses javascript to load and route pages and I am trying to configure caddy to block certain paths to pages.
Caddy configured with the config later below is only able to successfully block the /config path when the users browser performs an actual page load or refresh page. When using the single page web app and clicking on the menu links on the webpage the web app is able to route and load the /config page circumventing the caddy block.
Some javascript lines from the web app code files show ie
const ConfigEditor = lazy(() => import("@/pages/ConfigEditor"));

<Route path="/config" element={<ConfigEditor />} />

Are there any caddy configs that could block javascript from loading page routes?

2. Error messages and/or full log output:

PASTE OVER THIS, BETWEEN THE ``` LINES.
Please use the preview pane to ensure it looks nice.

3. Caddy version: v2.6.2 h1:wKoFIxpmOJLGl3QXoo6PNbYvGW4xLEgo32GPBEjWL8o=

4. How I installed and ran Caddy: apt

a. System environment: Debian LXC on Debian

b. Command:

PASTE OVER THIS, BETWEEN THE ``` LINES.
Please use the preview pane to ensure it looks nice.

c. Service/unit/compose file:

PASTE OVER THIS, BETWEEN THE ``` LINES.
Please use the preview pane to ensure it looks nice.

d. My complete Caddy config:

sub.domain.com:443 {
        @blocked {
                path /config /config/*
        }
        respond @blocked 403
        reverse_proxy 192.168.1.2:8971
        tls {
                dns cloudflare apikey
                resolvers 1.1.1.1
        }
}

5. Links to relevant resources:

1 Like

That’s a very old Caddy version. Make sure to use the latest, v2.8.4.

No, it’s not possibly for Caddy to control what the frontend JS code does. You’ll need to get help from the authors of that app to have configuration to block certain pages, or whatever. That’s an application-layer problem, not a webserver-layer problem.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.