Mealie - Cannot Login

[myopenflixr]

When adding Mealie to Muximux, I cannot get past the login screen. I've tried both enabling built-in proxy as well as disabling built-in proxy.

Here's the error I receive when trying to login. This same error occurs if I enable or disable Skip TLS verification as well if I enable or disable built-in proxy.

[mescon]

This looks like a Mealie-specific issue rather than a Muximux bug. Mealie has some known requirements and gotchas when running behind a reverse proxy:

1. Mealie does not support subdirectory paths -- it must be accessed via a subdomain (e.g. mealie.example.com), not a subdirectory path (e.g. example.com/mealie). See mealie-recipes/mealie#695.

2. HTTPS is required for iframe embedding -- Mealie's login uses JWT tokens stored in cookies/localStorage, which modern browsers restrict in non-secure contexts. If your Muximux instance isn't served over HTTPS, auth will fail silently. See mealie-recipes/mealie#5690.

3. Set the correct BASE_URL in Mealie -- Mealie needs its BASE_URL environment variable to match the URL users access it from (the external/proxied URL, not the internal Docker URL).

4. Update Mealie -- Several iframe-related auth bugs were fixed in recent Mealie releases (PRs #6128, #6383, #6601). If you're running an older version, updating may resolve the login issue.

Recommended Muximux setup for Mealie:

• Set the app URL to Mealie's internal Docker address (e.g. http://mealie:9000)
• Enable the built-in proxy
• Make sure Muximux itself is served over HTTPS

Could you share which Mealie version you're running and whether Muximux is served over HTTPS? That would help narrow things down.

[myopenflixr]

I am running Mealie v3.12.0 and it is served over https via Nginx reverse proxy. Here's my config for Nginx.

server {
  listen 80;
  server_name www.url.net url.net;
  return 301 https://www.$host$request_uri;
}

server {
listen 443 ssl;
http2 on;
  server_name url.net;
  include /etc/nginx/snippets/strong-ssl.conf;
  ssl_certificate /etc/letsencrypt/live/url.net/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/url.net/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/url.net/cert.pem;
  return 301 https://www.$host$request_uri;
}

server {
listen 443 ssl;
http2 on;
  server_name www.url.net;
  include /etc/nginx/snippets/strong-ssl.conf;
  ssl_certificate /etc/letsencrypt/live/url.net/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/url.net/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/url.net/cert.pem;
  client_max_body_size 100M;

location ~ /\.ht {
  deny all;
}

location / {
  proxy_pass http://172.16.0.35:9925;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #NEW
  proxy_set_header X-Forwarded-Proto $scheme; #NEW
  proxy_buffering off; # Important for websockets/streaming
  proxy_set_header use_x_forwarded_for true;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_redirect off;
 }

location /api {
  proxy_pass http://172.16.0.35:9925/api;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #NEW
  proxy_set_header X-Forwarded-Proto $scheme; #NEW
  proxy_buffering off; # Important for websockets/streaming
  proxy_set_header use_x_forwarded_for true;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_redirect off;
 }
}

Should we chalk this up to a Mealie issue?

[myopenflixr]

So, I got it working. I added the following Environment Variable to my Mealie docker compose file:

- FORWARDED_ALLOW_IPS=IP_ADDRESS_OF_MUXIMUX_SERVER

In addition, I checked "Use reverse proxy" and "Skip TLS verification" in Muximux settings.

[myopenflixr]

I thought everything was working, but I discovered a new issue after refreshing the browser.

I'm now confronted with the following 404 error:

But, when I click on "Go back home", everything works as expected.

Here's the error message in the browser console:

Any ideas on how to get rid of this 404?

[mescon]

Good find with FORWARDED_ALLOW_IPS -- that's Mealie's Uvicorn server rejecting forwarded headers from untrusted IPs, which breaks auth when requests come through Muximux's proxy.

The 404-on-refresh is actually a bug on our side. The proxy interceptor wasn't patching history.pushState/replaceState, so when Mealie's Vue Router navigates client-side (e.g. to /recipes), the browser's URL for the iframe loses the proxy prefix. On refresh, the SPA router sees the proxy-prefixed path (/proxy/mealie/) instead of / and doesn't recognise it -- showing Mealie's 404.

Fix is in the next release -- the interceptor now:

• Strips the proxy prefix from location.pathname on initial load (before the SPA router reads it)
• Patches pushState/replaceState to maintain the correct proxy prefix in the browser history
• Strips the prefix again on back/forward (popstate) so the router always sees clean paths

This should fix the 404-on-refresh for Mealie and any other SPA that uses client-side routing behind the proxy.

[mescon]

v3.0.14 is out with the fix for the 404-on-refresh. Please update and let me know if Mealie (and the back/forward buttons) work correctly now.

[myopenflixr]

Still getting the the 404 error after updating to V3.0.14

[mescon]

v3.0.15 is out with a more thorough fix for the 404-on-refresh.

The v3.0.14 approach (stripping the proxy prefix via replaceState) had a side effect -- it broke relative URL resolution for apps that use relative paths (like qBittorrent), and for Mealie specifically, the Nuxt 3 SSR payload contained the original path ("fullPath":"/recipe/123") which got rewritten by the proxy to include the prefix, causing a hydration route mismatch on the client side.

v3.0.15 replaces replaceState stripping with Location.prototype getter patches. The browser URL keeps the real proxy prefix (so F5 refresh works), while location.pathname/location.href/location.toString() transparently return clean paths to the app's JavaScript. SSR payload paths are also left untouched now.

Additionally, localStorage and sessionStorage are now isolated per proxied app, so Mealie's auth tokens won't collide with other apps sharing the same origin.

Please update and let me know if the 404 on refresh is resolved.

[myopenflixr]

Updated to v3.0.15 and unfortunately still seeing 404 error.

[mescon]

I've made some more updates to the built-in reverse proxy. Please try with 3.0.16 and let me know if that changes anything. Thanks!

[myopenflixr]

404 error still persists.