iOS & macOS clients + SnapPDF don't work with IN behind proxy Cloudflare

Self-Hosted | v5
1

Version ie <v5.10.30>

Version v5.12.40

Environment <Docker/Shared Hosting/Zip/Other>

Shared Hosting

Checklist

  • Can you replicate the issue on our v5 demo site https://demo.invoiceninja.com or Invoice Ninja? - Not applicable
  • Have you searched existing issues? - YES, no help
  • Have you inspected the logs in storage/logs/laravel.log for any errors? - YES, see screenshot below.

Describe the bug

When the domain that IN uses is proxied in Cloudlfare (setup to use Full Strict SSL with Origin Certifcate) the only way to access IN is via a web browser and answer the “Verify you are human” Cloudflare challenge by checking a box.
This in turn prevents BOTH the iOS and MacOS IN apps from being able to access the IN interface!
The SnapPDF generator / viewer is also not working and not rendering invoices!
See screenshots below…

Steps To Reproduce

Place the domain record (“A” or “CNAME”) that IN uses (i.e: invoice.doman.com) in proxy mode in Cloudlfare, enable Strict Full SSL, and use a Cloudflare Origin Certificate on the hosting platform.

Expected Behavior

iOS and MacOS Apps need to add support for Cloudflare “human” prompt!

Additional context

I have already added the line below to .env but it made no difference:
TRUSTED_PROXIES=*

Screenshots

IN health & config info: Invoice Ninja | About - TechSmith Screencast
IN when accessed via Web: Invoice Ninja | Cloudflare | Web Human Validation - TechSmith Screencast
IN iOS App trying to connect: Invoice Ninja | iOS App - TechSmith Screencast
IN MacOS App trying to connect: Invoice Ninja | MacOS App - TechSmith Screencast
IN DNS record config (sanitized): DNS | Records | Cloudflare | Proxied - TechSmith Screencast
IN Laravel logs (sanitized): Invoice Ninja | laravel log - TechSmith Screencast

Also added this on Github here: iOS & macOS clients + SnapPDF don’t work with IN behind proxy Cloudflare · Issue #741 · invoiceninja/admin-portal · GitHub

2

Hi,

Thanks for creating the issue on GitHub to track this, we’ll look into it with the next release.

3

Thanks Hillel,

Since this is a common self-hosted setup (Placing IN behind the Cloudflare Proxy) I am hoping the fixes to the iOS and macOS Apps can be deployed quickly.

If there is any other workaround meantime, kindly advise…

Will wait to hear back from you on this…

Thank you.
SemoTech.

4

This is the first time I’ve heard of this issue, I’m not certain this can be solved in the app.

5

I dont doubt it, but as security becomes more important more and more self-hosting is done behind proxying, and Cloudflare is one of the biggest providers so apps will need support for it.

Untill that happens, I did some research and found that one could use WAF Custom Rules to Skip challenges on API paths. Bot Fight Mode sometimes respects path-based skips for API traffic, especially if the challenge is triggered later.

  • Example rule (priority high):
    • Expression: (http.request.uri.path contains “/api/v1/”)
    • Action: Skip → Choose “Managed Rules”, “Bot Fight Mode” (if listed), and other relevant components.
  • And add another for auth/login if needed: (http.request.uri.path contains “/login”)
  • This should allow app API calls through, while challenging web UI traffic.

The concern with all that is properly matching onto the request formats of the iOS and macOS apps, which are not obvious without access to the code base.

Could you provide the correct syntax that matches your apps for both request and auth/login so I can try this?

Thank you

6

Maybe you can exclude /api/v1

7

OK, so you confirm that the the expression: (http.request.uri.path contains “/api/v1/”) matches your apps? What about the syntax of the auth/login (http.request.uri.path contains “/login”) ?

Thanks.

8

All API routes start with /api/v1 including the login route.

9

No luck, apps wont load tho the log show a Skip on matching regex.
I will now look into scripting an IP access rule but this is still not very practical and I am hoping you can eventually add the bot challenge response capability in the IOS and macOS Apps…

Thank you.