Which paths should be whitelisted to allow sharing?

[wsw70]

My Immich instance is behind a filtering reverse proxy (Authelia) and if I want to share something (/share/< token>, several entities are unreachable. Examples include

• /_app/immutable/chunks
• /custom.css
• /service-worker.js
• /_app/env.js
• /_app/immutable/assets

Is there a documented list of paths safe to whitelist?

[schuhbacca]

I don't think there's an official list. But basically I think most of the API needs exposing.
I have seen a lot of people that use this https://github.com/alangrainger/immich-public-proxy

[wsw70]

I added the paths above and it works. Most of the data is JS or fonts anyway so it does not matter

[timrettop]

I also added the above, but removed the subdirectory for /_app/immutable/ as there were other subdirs being requested, and also included /api/* and /share/* to get sharing to work.

[wsw70]

I also added the above, but removed the subdirectory for /_app/immutable/ as there were other subdirs being requested, and also included /api/* and /share/* to get sharing to work.

Ha, interesting. This is my final configuration and the sharing works fine for anybody

 - ^/_app/immutable/.*$
 - ^/custom.css$
 - ^/service-worker.js$
 - ^/_app/env.js$

Do you know what /api/* and /share/* is for?

[timrettop]

They are paths listed in Chrome DevTools when testing a share link generated from Immich.
/share/* specifically is the path for the share links unless you're using custom urls... I'd expect authelia would step in without that (and its subsequent use of /api/* path).

This is my full list (thumbnails less important)... maybe the /api/* elements aren't truly needed but I think the /share would be.

     resources:
        - "^/share/.*$"
        - "^/api/.*$"
        - "^/favicon-[0-9]+\\.png$"
        - "^/custom.css$"
        - "^/service-worker.js$"
        - "^/_app/env.js$"
        - "^/_app/immutable/.*$"