[6.9.2] Problem related to SecurePathController

[lilian-pouliquen]

Lychee version

6.9.2

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.4

Detailed description of the problem

I just updated to the latest version and encountered a problem related to the fix of path traversal attack (from 6.6.10)
I'm using docker with HAProxy like so: internet => Haproxy1 => HAProxy2 => Lychee
Also, I am behind Cloudflare and using the origin server certificate it provides me

The certificates I am using are different in each step:

• HAProxy1: Cloudflare origin server certificate
• HAProxy2: Internal certificate for HAProxy2 (CA from OpenSSL)
• Lychee: Internal certificate for Lychee (CA from OpenSSL)

No image are loading and I get a 404 error on each of them. When I check my logs I get the following:

App\Http\Controllers\SecurePathController::__invoke:49 Invalid signature

and

Invalid signature for secure path request. Verify that the url generated for the image match.

Context:

{
  "candidate url": "https://lychee.domain.tld/image/small2x/c4/74/05dfc6b901a55da0b4192f1fe307.JPG?/image/small2x/c4/74/05dfc6b901a55da0b4192f1fe307.JPG&expires=1761252096"
}

I do not know how to fix it, let me know

Steps to reproduce the issue

1. Connect to Lychee
2. Nothing is loading

Diagnostics [REQUIRED]

Auto-diagnostic
info    Full directory permission check is disabled
info    Found 57 medium that could be generated.
        You can use `php artisan lychee:generate_thumbs medium 57` to generate them.
info    Found 384 placeholders that could be generated.
        You can use `php artisan lychee:generate_thumbs placeholder 384` to generate them.
info    Have you considered supporting Lychee? :)

Configuration
version:                                   060902
check_for_updates:                         0
sorting_photos_col:                        title
sorting_photos_order:                      ASC
sorting_albums_col:                        title
sorting_albums_order:                      ASC
imagick:                                   1
skip_duplicates:                           0
small_max_width:                           0
small_max_height:                          360
medium_max_width:                          1920
medium_max_height:                         1080
lang:                                      fr
image_overlay_type:                        desc
default_license:                           reserved
compression_quality:                       90
grants_full_photo_access:                  1
delete_imported:                           0
mod_frame_enabled:                         1
mod_frame_refresh:                         30
thumb_2x:                                  1
small_2x:                                  1
medium_2x:                                 1
landing_page_enable:                       1
search_public:                             0
hide_version_number:                       1
recent_age:                                1
grants_download:                           1
photos_wraparound:                         1
map_display:                               0
zip64:                                     1
map_display_public:                        0
map_provider:                              Wikimedia
map_include_subalbums:                     0
update_check_every_days:                   3
has_exiftool:                              1
share_button_visible:                      1
import_via_symlink:                        0
has_ffmpeg:                                1
location_decoding:                         0
location_decoding_timeout:                 30
location_show:                             1
location_show_public:                      0
rss_enable:                                0
rss_recent_days:                           7
rss_max_items:                             100
prefer_available_xmp_metadata:             0
editor_enabled:                            1
lossless_optimization:                     0
local_takestamp_video_formats:             .avi|.mov
log_max_num_line:                          1000
unlock_password_photos_with_url_param:     0
nsfw_visible:                              1
nsfw_blur:                                 0
nsfw_warning:                              0
nsfw_warning_admin:                        0
nsfw_banner_override:                      
map_display_direction:                     1
album_subtitle_type:                       oldstyle
upload_processing_limit:                   4
new_photos_notification:                   0
zip_deflate_level:                         6
default_album_protection:                  1
album_decoration:                          layers
album_decoration_orientation:              row
allow_username_change:                     0
auto_fix_orientation:                      1
random_album_id:                           starred
use_last_modified_date_when_no_exif_date:  0
layout:                                    justified
date_format_photo_thumb:                   M j, Y, g:i:s A e
date_format_photo_overlay:                 M j, Y, g:i:s A e
date_format_sidebar_uploaded:              M j, Y, g:i:s A e
date_format_sidebar_taken_at:              M j, Y, g:i:s A e
date_format_hero_min_max:                  F Y
date_format_hero_created_at:               M j, Y, g:i:s A T
date_format_album_thumb:                   M Y
upload_chunk_size:                         0
nsfw_banner_blur_backdrop:                 0
search_pagination_limit:                   300
search_minimum_length_required:            4
photo_layout_justified_row_height:         320
photo_layout_masonry_column_width:         300
photo_layout_grid_column_width:            250
photo_layout_square_column_width:          200
photo_layout_gap:                          12
display_thumb_album_overlay:               always
display_thumb_photo_overlay:               hover
default_album_thumb_aspect_ratio:          1/1
use_album_compact_header:                  0
back_button_enabled:                       0
back_button_text:                          Return to Home
SA_random_thumbs:                          0
login_required:                            1
enable_unsorted:                           1
enable_starred:                            1
enable_recent:                             1
enable_on_this_day:                        1
login_required_root_only:                  1
dark_mode_enabled:                         1
low_quality_image_placeholder:             1
show_keybinding_help_popup:                0
show_keybinding_help_button:               1
disable_se_call_for_actions:               0
enable_se_preview:                         0
slideshow_timeout:                         5
keep_original_untouched:                   1
timeline_photos_enabled:                   1
timeline_photos_public:                    0
timeline_photos_granularity:               day
timeline_photos_order:                     taken_at
timeline_photos_layout:                    square
timeline_photos_pagination_limit:          200
timeline_albums_enabled:                   1
timeline_albums_public:                    0
timeline_albums_granularity:               year
timeline_left_border_enabled:              1
timeline_photo_date_format_year:           Y
timeline_photo_date_format_month:          M Y
timeline_photo_date_format_day:            j M Y
timeline_photo_date_format_hour:           g:i
timeline_album_date_format_year:           Y
timeline_album_date_format_month:          M Y
timeline_album_date_format_day:            j M
hide_nsfw_in_smart_albums:                 1
hide_nsfw_in_frame:                        1
hide_nsfw_in_map:                          1
hide_nsfw_in_search:                       1
search_photos_layout:                      square
hide_nsfw_in_rss:                          1
hide_nsfw_in_timeline:                     1
number_albums_per_row_mobile:              3
cache_enabled:                             0
cache_ttl:                                 86400
low_number_of_shoots_per_day:              10
medium_number_of_shoots_per_day:           50
high_number_of_shoots_per_day:             100
maintenance_processing_limit:              5000
disable_recursive_permission_check:        1
exif_disabled_for_all:                     0
file_name_hidden:                          0
default_old_settings:                      0
default_expert_settings:                   0
default_all_settings:                      0
client_side_favourite_enabled:             0
disable_thumb_download:                    1
disable_thumb2x_download:                  1
disable_small_download:                    0
disable_small2x_download:                  0
disable_medium_download:                   0
disable_medium2x_download:                 0
temporary_image_link_enabled:              1
temporary_image_link_when_logged_in:       1
temporary_image_link_when_admin:           1
temporary_image_link_life_in_seconds:      86400
secure_image_link_enabled:                 0
SA_override_visibility:                    0
TA_override_visibility:                    0
enable_colour_extractions:                 0
colour_extraction_driver:                  farzai
home_page_default:                         gallery
timeline_page_enabled:                     1
timeline_quick_access_date_format_year:    Y
timeline_quick_access_date_format_month:   M
timeline_quick_access_date_format_day:     j M
timeline_quick_access_date_format_hour:    h M, g:i
flow_enabled:                              1
flow_public:                               0
flow_base:                                 
flow_max_items:                            10
flow_strategy:                             auto
flow_include_sub_albums:                   0
flow_include_photos_from_children:         0
flow_open_album_on_click:                  0
flow_display_open_album_button:            0
flow_highlight_first_picture:              1
flow_min_max_enabled:                      1
flow_display_statistics:                   1
flow_compact_mode_enabled:                 1
flow_image_header_enabled:                 1
flow_image_header_cover:                   cover
flow_image_header_height:                  24
flow_carousel_enabled:                     1
flow_carousel_height:                      6
date_format_flow_published:                M j, Y, g:i:s A e
date_format_flow_min_max:                  F Y
flow_blur_nsfw_enabled:                    1
hide_nsfw_in_flow:                         1
skip_duplicates_early:                     1
sync_delete_missing_photos:                0
sync_delete_missing_albums:                0
sync_dry_run:                              1
gallery_header_enabled:                    0
gallery_header_logged_in_enabled:          0
gallery_header:                            
gallery_header_bar_transparent:            1
gallery_header_bar_gradient:               1
import_via_url_forbidden_localhost:        1
import_via_url_forbidden_local_ip:         1
import_via_url_require_https:              1
import_via_url_forbidden_ports:            1
details_links_enabled:                     0
details_links_public:                      0
is_scroll_to_navigate_photos_enabled:      1
is_swipe_vertically_to_go_back_enabled:    1
photo_thumb_tags_enabled:                  0
hide_nsfw_in_tag_albums:                   1
hide_nsfw_in_tag_listing:                  1
sorting_pinned_albums_col:                 created_at
sorting_pinned_albums_order:               DESC
copyright_text:                            
watermark_enabled:                         0
watermark_photo_id:                        
watermark_public:                          1
watermark_logged_in_users_enabled:         0
renamer_enabled:                           0
renamer_enforced:                          0
renamer_enforced_before:                   0
renamer_enforced_after:                    0
renamer_photo_title_enabled:               1
renamer_album_title_enabled:               1
extract_zip_on_upload:                     1

Browser & System [REQUIRED]

Client:

• Librewolf 144.0-1 (firefox 144)
• Fedora 42

Server:

• Alpine Linux 3.21
• Docker 27.3.1
• Image lycheeorg/lychee:v6.9.2

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[ildyria]

So, I do not know what is going on with your url
https://lychee.domain.tld/image/small2x/c4/74/05dfc6b901a55da0b4192f1fe307.JPG?/image/small2x/c4/74/05dfc6b901a55da0b4192f1fe307.JPG&expires=1761252096
But that should have been https://lychee.domain.tld/image/small2x/c4/74/05dfc6b901a55da0b4192f1fe307.JPG?expires=1761252096

So something is going on in the rewrites between your different layers.

[lilian-pouliquen]

Thanks for your answer, I noticed the URL was a bot weird while pasting it here

I restored the service waiting for your answer and I'm not home until monday 27th.
I'll try it again to provide more info then

[lilian-pouliquen]

Hello!
Here are more pieces of information, I hope it will help. To test the differencies, I opened a photo in an album at the gallery's root (/album/photo) before and after upgrading to 6.9.2.

Headers are from Firefox developer tools > Network tab. I took the lines corresponding to the current page and to the image I should see.

Before upgrading to 6.9.2

URL : https://lychee.domain.tld/gallery/IwpNP0Ubpak-eNp3oC6EJXi_/OC8vIkwtpX9NMS6xbH0d_OGz

Headers current page:

scheme: https
host: lychee.domain.tld
filename: /gallery/IwpNP0Ubpak-eNp3oC6EJXi_/OC8vIkwtpX9NMS6xbH0d_OGz
Address: ****:443

Status: 200
Version: HTTP/3
Transferred: 23.30 kB (72.43 kB size)
Referrer: Policyno-referrer
Request: PriorityHighest
DNS: ResolutionSystem

Headers photo:

scheme: https
host: lychee.domain.tld
filename: /image/small/[email protected]
expires: 1761854739
signature: 7480baf930f06e9a64ac78e2659254980cfccbec3dd529ef70c655fe474bc0f8
Address: *****:443
Status 200
Version: HTTP/3
Transferred: 155.77 kB (152.03 kB size)
Referrer: Policyno-referrer
Request: PriorityLow
DNS: ResolutionSystem

After upgrading to 6.9.2

URL: https://lychee.domain.tld/gallery/IwpNP0Ubpak-eNp3oC6EJXi_/OC8vIkwtpX9NMS6xbH0d_OGz

Headers current page:

scheme: https
host: lychee.domain.tld
filename: /gallery/IwpNP0Ubpak-eNp3oC6EJXi_/OC8vIkwtpX9NMS6xbH0d_OGz
Address: *****:443
Status: 200
Version: HTTP/3
Transferred: 23.33 kB (72.80 kB size)
Referrer: Policyno-referrer
Request: PriorityHighest
DNS: ResolutionSystem

Headers photo:

scheme: https
host: lychee.domain.tld
filename: /image/small/[email protected]
expires: 1761854982
signature: ad740cf4ee515409010c05e7af162eb870b581336a56a4118318f336a7b3d79d
Address: *****:443
Status: 403
Version: HTTP/3
Transferred: 4.43 kB (1.81 kB size)
Referrer: Policyno-referrer
Request: PriorityLow
DNS: ResolutionSystem

[ildyria]

What version are you using "before 6.9.2" ? Like 6.9.1 ? older?
So I assume that 6.9.2 is breaking. But can it be breaking before?

[lilian-pouliquen]

I currently use the 6.6.5 version
According to the error messages I get, I'm assuming the issue is due to the secutity changes from 6.6.10

I'll try upgrading version by version to confirm, if it is relevant

[lilian-pouliquen]

I just upgraded to 6.6.6 and I already encounter the issue
I get the same errors in the log viewer as in the issue description

[lilian-pouliquen]

Errors in log viewer:

---
Error - 2025-11-19 20:18:45 - production - Invalid signature for secure path request. Verify that the url generated for the image match.
---
Invalid signature for secure path request. Verify that the url generated for the image match.

Context:

{
  "candidate url": "https://lychee.domain.tld/image/small/84/05/821125a1eece82f2c060ac1fa254.jpg?/image/small/84/05/821125a1eece82f2c060ac1fa254.jpg&expires=1763666024"
}

And

---
Error - 2025-11-19 20:18:45 - production - App\Http\Controllers\SecurePathController::__invoke:46 Invalid signature
--- 
App\Http\Controllers\SecurePathController::__invoke:46 Invalid signature

[ildyria]

/image/small/84/05/821125a1eece82f2c060ac1fa254.jpg& that part should not be in the URL (in the query string).

[lilian-pouliquen]

I should check the configurations of lychee, lychee's nginx and haproxy

[ildyria]

I will double check if they are working properly on my end too.

[lilian-pouliquen]

Config overview

Hello @ildyria, sorry for the late reply.

I took a look at my config and I think it might come from HAProxy as I use several type of set-header and I don't realy understand all of that.

Here are my configuration files

First HAProxy

haproxy.cfg (truncated to lychee's scope)

global
    ssl-server-verify none
    log stdout format raw local0
    maxconn 4000
    daemon

defaults
    mode http
    log global
    option dontlognull
    option http-server-close
    option httpclose
    option redispatch
    retries 3
    timeout queue     90s
    timeout connect   90s
    timeout client    90s
    timeout server    90s
    timeout tunnel  3600s
    maxconn 8000

frontend docker_frontend
    bind 0.0.0.0:80
    bind 0.0.0.0:443 ssl crt /etc/ssl/cloudflare_cert.pem
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Real-IP %[src]
    redirect scheme https unless { ssl_fc }
    option forwardfor header X-Real-IP
    option httplog
    acl host_haproxy2 hdr(host) lychee.domain.tld 
    use_backend haproxy2_backend if host_haproxy2

backend haproxy2_backend
    balance source
    option  forwardfor
    option  ssl-hello-chk
    server  haproxy2 haproxy2_container:443 ssl

Second HAProxy

haproxy.cfg (truncated to lychee's scope)

global
    ssl-server-verify none
    log stdout format raw local0
    maxconn 4000
    daemon

defaults
    mode http
    log global
    option dontlognull
    option http-server-close
    option httpclose
    option redispatch
    retries 3
    timeout queue     90s
    timeout connect   90s
    timeout client    90s
    timeout server    90s
    timeout tunnel  3600s
    maxconn 8000

frontend docker_frontend
    bind 0.0.0.0:80
    bind 0.0.0.0:443 ssl crt /etc/ssl/haproxy2_internal_cert.pem
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Real-IP %[src]
    redirect scheme https unless { ssl_fc }
    option forwardfor header X-Real-IP
    option httplog
    acl host_lychee hdr(host) lychee.domain.tld
    use_backend lychee_backend if host_lychee

backend lychee_backend
    balance source
    option  forwardfor
    option  ssl-hello-chk
    server  lychee lychee_container:443 ssl

Lychee Nginx

Here is a diff between the original nginx.conf and mine

diff nginx.conf.original lychee_nginx.conf 
51,53c51,56
<         listen       80;
<         server_name  localhost;
<         client_max_body_size 100M;
---
>       listen 443 ssl;
>         server_name lychee.domain.tld;
>         client_max_body_size 1G;
>         
>         ssl_certificate /etc/ssl/lychee_internal_cert.pem;
>         ssl_certificate_key /etc/ssl/lychee_internal_cert.key;
92,95c95,98
<             fastcgi_param PHP_VALUE "post_max_size=100M
<                 max_execution_time=3600
<                 upload_max_filesize=100M
<                 memory_limit=256M";
---
>             fastcgi_param PHP_VALUE "max_execution_time=3600
>                 memory_limit=512M
>                 post_max_size=500M
>               upload_max_filesize=500M";