# \[Mobilizon\] re-enable protect\_against\_basic\_auth\_spoofing in package?
**URL:** https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059
**Category:** Support apps
**Tags:** mobilizon, english
**Created:** [September 23, 2026, 5:17pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059 "2026-09-23T17:17:59Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 23, 2026, 5:17pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/1 "2026-09-23T17:17:59Z")
### I have searched the forum for similar issues
on
### This category is for issues regarding specific apps, _NOT_ general issues with YunoHost.
on
### This form is written in English but feel free to write in French if you’re more comfortable!
on
### What app is this about, and its version
5.2.4~ynh1
### What YunoHost version are you running
12.1.41.2 (stable)
### What type of hardware are you using
Virtual machine
### Describe your issue
Checking out a mobilizon test install I found the package disables `protect_against_basic_auth_spoofing`.
This is **“a huge security hole and ultimately should never be done…”** according to the sources ([SSOwat/access.lua at a59b558bbbcaeb00199a19ce952bf3c75ce78bef · YunoHost/SSOwat · GitHub](https://github.com/YunoHost/SSOwat/blob/a59b558bbbcaeb00199a19ce952bf3c75ce78bef/access.lua#L265)).
I don’t really understand why it was disabled (from the french [[Mobilizon] Souci pour se connecter](https://forum.yunohost.org/t/mobilizon-souci-pour-se-connecter/37315)), but at least I don’t see any such errors in the log even after manually re-enabling the protection with:
```auto
sudo yunohost app setting mobilizon protect_against_basic_auth_spoofing -v true
sudo yunohost app ssowatconf
```
Shouldn’t the package rather re-anable it, by now?
At least the remaining problem with mobilizon logins not working while logged into the yunohost SSO was not fixed by opening that security hole (it still works/don’t works the same).
### Share relevant logs or error messages
no problems found
---
### Author:  [@otm33](https://forum.yunohost.org/u/otm33)
#### Post date: [September 23, 2026, 8:01pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/2 "2026-09-23T20:01:42Z")
Removing auth headers seems to fix both issues.
Could you try this branch ?
`https://github.com/YunoHost-Apps/mobilizon_ynh/tree/test_spoof`
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 23, 2026, 9:31pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/3 "2026-09-23T21:31:20Z")
positive!
But couldn’t test upgrading:
```auto
ERROR Could not find https://github.com/YunoHost-Apps/mobilizon_ynh/tree/test_spoof in the list of installed apps:
- mobilizon
```
Guess upgrading would probably need to actively switch the protection ‘true’, though, or ideally do some kind of “migration” to unset the setting (`yunohost app setting mobilizon protect_against_basic_auth_spoofing -d`) if it currently is ‘false’ (e.g. from an override by previous packages) to use the defaut ‘true’.
---
### Author:  [@otm33](https://forum.yunohost.org/u/otm33)
#### Post date: [September 23, 2026, 9:35pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/4 "2026-09-23T21:35:09Z")
> [@tmb](#):
>
> `ERROR Could not find https://github.com/YunoHost-Apps/mobilizon_ynh/tree/test`
🤔 Was this the output when you ran
```auto
yunohost app upgrade mobilizon -u https://github.com/YunoHost-Apps/mobilizon_ynh/tree/test_spoof
```
?
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 24, 2026, 9:11am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/5 "2026-09-24T09:11:04Z")
Thanks! I had attempted to use `yunohost upgrade` in the same way as `install` and thus without the `mobilizon -u` part.
Today, with your fourth commit, the upgrade did switch the `yunohost app setting mobilizon protect_against_basic_auth_spoofing` from `false` to “forced” `true`. Maybe just simply deleting any override (-d on the CLI) could also work for the upgrade.
Found another source location that seems to suggest the `protection` setting is a bit of a misnomer, it’t seems not just about spoofing but simply disables all basic auth usage, and thus actually has to be set to ‘false’ to enable basic auth for apps that need it, e.g. for webdav or webcal clients connecting to “apps\_that\_need\_external\_auth\_maybe” ([yunohost/src/app.py at fc1e312f61cd4a4f416e9c0f08c2dbf6686d5cf0 · YunoHost/yunohost · GitHub](https://github.com/YunoHost/yunohost/blob/fc1e312f61cd4a4f416e9c0f08c2dbf6686d5cf0/src/app.py#L2096)).
Guess Mobilizon does not require basic auth, as it provides just simple ICS/WebCal downloads?
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 24, 2026, 9:15am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/6 "2026-09-24T09:15:09Z")
> [@tmb](#):
>
> Guess Mobilizon does not require basic auth, as it provides just simple ICS/WebCal downloads?
Or does it allow for non-public calendar sharing and could need basic auth for clients there?
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 24, 2026, 9:38am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/7 "2026-09-24T09:38:53Z")
Seems apps that could need it should be added to above `apps_that_need_external_auth_maybe` to get a reasonable default for them and define an explicit [install question in the manifest](https://doc.yunohost.org/en/dev/packaging/manifest/#install-questions) to disallow basic auth clients.
EDIT: But then, why this central override list complication?
Can’t just app config questions cover this?
Or was the intention to centrally generate a config question?
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 24, 2026, 9:43am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/8 "2026-09-24T09:43:43Z")
BTW: 🙂 Congratulations, think you can remove this now:
> all users (including the administrator) must first log out of the user portal (SSO)
---
### Author:  [@otm33](https://forum.yunohost.org/u/otm33)
#### Post date: [September 24, 2026, 2:00pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/9 "2026-09-24T14:00:14Z")
Hmm… I 'm not familiar with this app and don’t have time to dig into this, so I’d rather leave it up to its maintainer, @rodinux, to decide 😉
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 25, 2026, 7:37pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/10 "2026-09-25T19:37:42Z")
What let you to [Add auth\_header permission to manifest](https://github.com/YunoHost-Apps/mobilizon_ynh/commit/9feffdeaf075e4c1fa2e035fbca5bac260b0d816) ?
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [September 26, 2026, 9:47am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/11 "2026-09-26T09:47:54Z")
not sure if this would work in the manifest.toml:
(if mobilizon really has a need? webdav?)
```toml
[install.protect_against_basic_auth_spoofing]
ask.en = "Block all basic auth comming from clients (not SSO generated) ?"
help.en = "May have to be disabled for WebDav/CalDav clients, not for "randomized" ICS/webcal download links."
type = "bool"
default = nil
```
And for making the SSO work: [SSO: still default pw injection & apps that use email as login broken?](https://forum.yunohost.org/t/sso-still-default-pw-injection-apps-that-use-email-as-login-broken/43075)
---
### Author:  [@otm33](https://forum.yunohost.org/u/otm33)
#### Post date: [September 26, 2026, 1:50pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/12 "2026-09-26T13:50:41Z")
Afaiu, mobilizon generates a bearer token header which is overriden by sso (no matter what auth header is injected).
---
### Author:  [@rodinux](https://forum.yunohost.org/u/rodinux)
#### Post date: [September 26, 2026, 10:13pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/13 "2026-09-26T22:13:47Z")
Hello, I am sorry, just reading all yours suggestions…
So It’s not easy for me understand all, I have try upgrade my mobilizon with this suggestions and something really better it resolve this
> all users (including the administrator) must first log out of the user portal (SSO)
I approve so merge the PR, I am not sure of all the impacts but it seems better do like this for now…
---
### Author:  [@rodinux](https://forum.yunohost.org/u/rodinux)
#### Post date: [September 26, 2026, 10:50pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/14 "2026-09-26T22:50:38Z")
I have others problems with Mobilizon, other users from the LDAP are not recognized and the federation also not seems works since few versions…
On a fresh install it’s OK, users from LDAP can connect to mobilizon. Perhaps I have something wrong in my mobilizon since a while…
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [October 1, 2026, 6:40am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/15 "2026-10-01T06:40:40Z")
> [@rodinux](#):
>
> I have others problems with Mobilizon, other users from the LDAP are not recognized and the federation also not seems works since few versions…
May that also work now with the `main.auth_header = false` (disabled basic auth SSO)?
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [October 1, 2026, 7:18am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/16 "2026-10-01T07:18:38Z")
> [@rodinux](#):
>
> I am not sure of all the impacts but it seems better do like this for now…
I think just stoping to set the override with the packages scripts _and_ deleting any current override with the upgrade script _for a while_ (to rely on the default “true”), would better avoid conflicts with any later custom admin settings (after removing the override delete from the upgrade script one or two upgrades later):
```auto
sudo yunohost app setting mobilizon protect_against_basic_auth_spoofing -d
sudo yunohost app ssowatconf
```
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [October 2, 2026, 9:26am UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/17 "2026-10-02T09:26:58Z")
Hm, I have searched for how the nicely numbered yunohost migration scripts are handled but found only upgrade instructions…
Thought maybe apps can store and run and archive such one-time config change “mirgration” snippets in a simmilar way.
[Keeping such config change snippets seems needed to allow upgrading installations that were disabled/isolated or not booted for longer times.]
---
### Author:  [@rodinux](https://forum.yunohost.org/u/rodinux)
#### Post date: [October 9, 2026, 12:37pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/18 "2026-10-09T12:37:40Z")
Ok, have to see how do this with helpers later… I think it will be something like `ynh_app_setting_delete --key=protect_against_basic_spoofing`
Why wait one or two upgrades ?
Do you agree with the actual changes on testing branch ?
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [October 9, 2026, 4:11pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/19 "2026-10-09T16:11:46Z")
Well the current changes force-set `protect_against_basic_auth_spoofing` to true, instead of “just” (see below) removing the setting.
I also think it may not be disirable to just (silently) remove the `# Migrate data to data_dir` code within:
>
And isn’t that rather doing “removing the not yet functioning SSO”, not fixing any auth?
Same as with removing the old `protect_against_basic_auth_spoofing` change, all machines that are off/offline for longer and only upgraded or restored later will still be in need of that change. (It needlessly breaks the upgrade path.)
So, therefore also the my question above if apps do also have some migration helpers. Otherwise maybe just keep migration code in a separate file to run from upgrade and restore?
The problem I thought of when deleting the current `protect_against_basic_auth_spoofing` setting is that the app shouldn’t just keep deleting it on every update/restore, because that would prevent admins to keep the settings configured as desired with their local override.
That was the reason for the idea to only let the app actively remove the setting (that it once forced) for a short time, and then stop that as well. But another, better idea may be to just “touch” a file within the app dir to “take note” after successfully removing the setting, and not remove it a second time if the file is present.
---
### Author:  [@tmb](https://forum.yunohost.org/u/tmb)
#### Post date: [October 9, 2026, 4:33pm UTC](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059/20 "2026-10-09T16:33:01Z")
Why did you also change to proxy\_params\_no\_auth ?
Is nginx config adaption a redundant legacy way to the ssowat app settings?
[Next page](https://forum.yunohost.org/t/mobilizon-re-enable-protect-against-basic-auth-spoofing-in-package/43059.md?page=2)