AllBugsFeaturesChangelogBountiesSearchNew post
Sign in with Fluxer
Bugs

Self Hosted SSO Fetch failing with PocketID provider

(#4478) Bug Closed: Answered security self-hosting
by sparajoy

Reproduction steps

  1. Configure PocketID as a self-hosted OIDC provider under a domain such as id.example.com
  2. Configure Fluxer as a self-hosted chat provider under a domain such as chat.example.com, on the same host machine as PocketID (sso allow private addresses enabled)
  3. Configure a custom reverse proxy instance for both services, including the reverse-proxy on setting for Fluxer.
  4. Configure the instance settings on PocketID and Fluxer for the redirect URLs, URI, auth secrets.
  5. Enable SSO on Fluxer, as well as Automatically provision new accounts
  6. Attempt to login on chat.example.com using PocketID
  7. Follow the redirect prompts from Fluxer and PocketID

Expected behaviour

SSO sign in succeeds and the user can claim an existing account or create a new account on the self hosted instance

Actual behaviour

SSO fails with response "Fetch failed". From the fluxer Login, "continue with pocketid" correctly directs to the id.example.com OIDC instance, which prompts for the auth login. Login succeeds on the PocketID page and redirects back to Fluxer, which then shows "completing sign on" for about 10-15 seconds before reporting "fetch failed".

Build information

Stable Web 2026.1029.135904, macOS 10.15 (arm64), Firefox 158.0, Locale en-US

Platform

Self-hosting

Evidence

The login page loads for about 10-15 seconds and then finally fails, only presenting the response "fetch failed". Also reproduced on: Chrome for MacOS, Firefox Mobile for IOS rexctl logs: api | {"level":"info","time":"2026-10-29T18:00:01.443Z","service":"fluxer-api","env":"production","method":"POST","path":"/v1/auth/sso/complete","status":400,"durationMs":10503,"msg":"Request completed"} (I failed to find any other helpful logs for the event, but if you point me to a good service to monitor I'm more than happy to fetch more) When inspecting the browser logs during the network transfers of the SSO fetch, the following errors are found: XHR Post https://chat.example.com/api/v1/auth/sso/complete HTTP/3 400 after 1059ms Response is: General error "fetch failed" Timing: waiting for 10.5 seconds This behavior always times out at the 10.5 seconds mark.
  1. Hampus changed the status from Needs triage to Answered

3 comments

Sign in with Fluxer to comment and vote.
Comment by Hampus
HampusStaff 1 vote 2 replies
This looks like the API container is unable to reach id.example.com from inside Docker. The browser can, but the token exchange happens on the server and times out. Since both run on the same host, try mapping the name to the host via rexctl config edit: 
services:
  api:
    extra_hosts:
      - "id.example.com:host-gateway"
You can confirm this first by running: 
docker exec <your api container> node -e "fetch('https://id.example.com/.well-known/openid-configuration').then(r=>console.log(r.status)).catch(e=>console.log(e.cause))"
If that hangs or errors, it would be a network issue. The next update here also will have a clearer error message for this stating that the provider didn't send a response!
Permalink
Comment by sparajoy
sparajoy OP1 vote 1 reply
This was exactly the problem, and it's fixed now! Thanks for the fast response!
Permalink
Comment by Hampus
HampusStaff 1 vote
cool! I'm adding a check for this to rexctl doctor as well
Permalink