rclone gui ignores or overwrites explicit --rc-allow-origin

[m-thomson]

Category

Functional — something doesn't work as expected

Description

• rclone gui ignores or overwrites explicit --rc-allow-origin.
• It derives RC CORS from the GUI bind address.
• When the GUI binds to :4001, rclone normalizes that to http://[::]:4001.
• But http://[::]:4001 and http://localhost:4001 are different origins, so login from http://localhost:4001 to http://localhost:4000 fails.

Steps to reproduce

docker run -d --rm \
  --name rclone-gui-cors-repro \
  -p 4001:4001 \
  -p 4000:4000 \
  rclone/rclone:latest \
  --rc-allow-origin=http://localhost:4001 \
  gui \
  --addr=:4001 \
  --api-addr=:4000 \
  --user=gui \
  --pass=change-me \
  --no-open-browser

curl -i -X OPTIONS 'http://localhost:4000/rc/noopauth' \
  -H 'Origin: http://localhost:4001' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: authorization'

This will show:

Access-Control-Allow-Origin: http://[::]:4001

When it should be:

Access-Control-Allow-Origin: http://localhost:4001

Expected behavior

Access-Control-Allow-Origin should be what is specified with --rc-allow-origin not http://[::]:NNNN

Screenshots

No response

Environment

rclone v1.74.3

• os/version: darwin 15.7.7 (64 bit)
• os/kernel: 24.6.0 (arm64)
• os/type: darwin
• os/arch: arm64 (ARMv8 compatible)
• go/version: go1.26.4
• go/linking: dynamic
• go/tags: none

[FTCHD]

Hello!

--rc-allow-origin is not a valid flag for the rclone gui command, see all the options here: https://rclone.org/gui/#options

You have a few options, depending on your end goal:

• Run it in a docker container and expose what you want, on any origins.
• Set the address specifically, with localhost prefix.
• Run a separate RC server and use that for the Web UI (set it using URL params on the /login page: ?url=.....). See: https://github.com/rclone/rclone-web/blob/main/src/pages/Login.tsx#L35

[m-thomson]

Hi,

Thanks for the reply.

• --rc-allow-origin is documented as a global rclone flag "available to every rclone command" at https://rclone.org/flags/
• The example I provided already uses Docker with published ports. Docker port publishing does not change the browser's CORS origin. If I access the GUI at http://localhost:4001, the browser sends Origin: http://localhost:4001. A response header of Access-Control-Allow-Origin: http://[::]:4001 does not match, so the browser rejects it.
• As I understand it, [::] is the IPv6 unspecified address. It is useful as a server bind/listen address meaning roughly "all IPv6 interfaces", but it is not the same host as localhost to a browser. So using the GUI bind address as the CORS allow-origin breaks when the browser-visible URL is localhost.

This tests the suggested workaround of setting --addr and --api-addr with a localhost prefix. With normal Docker -p HOST:CONTAINER port publishing, this makes rclone bind to the container's own loopback address, so the published host ports are not usable from the host/browser.

docker run -d --rm \
  --name rclone-gui-localhost-bind-repro \
  -p 4001:4001 \
  -p 4000:4000 \
  rclone/rclone:latest \
  gui \
  --addr=localhost:4001 \
  --api-addr=localhost:4000 \
  --user=gui \
  --pass=change-me \
  --no-open-browser

curl -i -X OPTIONS 'http://localhost:4000/rc/noopauth' \
  -H 'Origin: http://localhost:4001' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: authorization'

On my setup this fails before CORS, for example:

curl: (52) Empty reply from server

The GUI port is also not usable from the host/browser:

curl -i 'http://localhost:4001/'

Gets me

curl: (52) Empty reply from server

Apologies if I'm misunderstanding something. I appreciate your time.

[FTCHD]

Gotcha, try this:

services:
  rclone-gui:
    image: rclone/rclone:latest
    container_name: rclone-gui
    restart: unless-stopped
    ports:
      - "5522:5522"
      - "5533:5533"
    command:
      - gui
      - --addr=0.0.0.0:5522
      - --api-addr=0.0.0.0:5533
      - --user=gui-user
      - --pass=change-this-password

Then make sure you open the following url in your browser: http://GUI_URL/login?url=API_URL

With the setup above, this would be http://localhost:5522/login?url=localhost:5533 (if localhost does not work, try 127.0.0.1)

To clarify, you open the address of the GUI and pass it the address of the RC API using the url query param.

The GUI's api/rc endpoint is separate from RC, it doesn't get controlled by other flags. You can start a separate RC process if you need further customization outside of the GUI.

[m-thomson]

Thanks. That allows me to reach the endpoints again but the RC service is still requiring a CORS header matching [::]. That's the underlying problem.

Something I missed before that may be part of our disconnect: the logs suggest a URL like http://[::]:5522/... for accessing the GUI. If I load the GUI with that URL, rather than localhost, it appears to work in Chromium-based browsers because the browser origin then matches the RC service's Access-Control-Allow-Origin.

But Firefox and Safari choke on http://[::] entirely for me on macOS. The URLs below just don't load.

Looking at the rclone source, I think the issue is here:

https://github.com/rclone/rclone/blob/master/cmd/gui/gui.go#L146

// CORS: allow the GUI origin to make cross-port API requests.
opt.HTTP.AllowOrigin = guiOrigin

But guiOrigin is derived from the GUI server URL:
https://github.com/rclone/rclone/blob/master/cmd/gui/gui.go#L131

When the GUI server is bound to a wildcard address, that can become http://[::]:5522. The RC API then returns:

Access-Control-Allow-Origin: http://[::]:5522

That only matches if the browser actually loaded the GUI from http://[::]:5522. It does not match when the GUI is loaded from http://localhost:5522 or http://127.0.0.1:5522, which are the browser-visible URLs used with normal Docker port publishing.

I hope that helps. Networking stuff is a little out of my wheelhouse....

[FTCHD]

Are you able to ask Claude to apply this patch locally and re-compile rclone, then test if it works with your setup?

diff --git a/cmd/gui/gui.go b/cmd/gui/gui.go
index 03417cc8e..4f678983e 100644
--- a/cmd/gui/gui.go
+++ b/cmd/gui/gui.go
@@ -8,6 +8,7 @@ import (
 	_ "embed"
 	"fmt"
 	iofs "io/fs"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
@@ -143,9 +144,6 @@ For more help see [the GUI docs](/gui/).
 			opt.HTTP.ListenAddr = []string{"localhost:0"}
 		}
 
-		// CORS: allow the GUI origin to make cross-port API requests.
-		opt.HTTP.AllowOrigin = guiOrigin
-
 		// Forward metrics flag to the RC server.
 		if command.Flags().Changed("enable-metrics") {
 			opt.EnableMetrics = enableMetrics
@@ -177,6 +175,17 @@ For more help see [the GUI docs](/gui/).
 			}
 		}
 
+		// CORS: allow the GUI origin to make cross-port API requests.
+		switch addr, _ := guiServer.Addr().(*net.TCPAddr); {
+		case addr == nil || !addr.IP.IsUnspecified():
+			opt.HTTP.AllowOrigin = guiOrigin
+		case !opt.NoAuth:
+			opt.HTTP.AllowOrigin = "*"
+		default:
+			opt.HTTP.AllowOrigin = guiOrigin
+			fs.Logf(nil, "GUI bound to a wildcard address with --no-auth: browsers can only use the API from %s. Enable auth or bind --addr to a specific host.", guiOrigin)
+		}
+
 		// Start the RC server (unchanged rcserver.Start)
 		rcServer, err := rcserver.Start(ctx, &opt)
 		if err != nil || rcServer == nil {