diff --git a/docs/troubleshooting.mdx b/docs/troubleshooting.mdx index cd3da32946..8e1cca7b7c 100644 --- a/docs/troubleshooting.mdx +++ b/docs/troubleshooting.mdx @@ -164,3 +164,44 @@ When these environment variables are set, the API will use them directly instead A fix addressing this permission issue is being evaluated in [PR #9953](https://github.com/prowler-cloud/prowler/pull/9953). + +### SAML/OAuth ACS URL Incorrect When Running Behind a Proxy or Load Balancer + +See [GitHub Issue #9724](https://github.com/prowler-cloud/prowler/issues/9724) for more details. + +When running Prowler behind a reverse proxy (nginx, Traefik, etc.) or load balancer, the SAML ACS (Assertion Consumer Service) URL or OAuth callback URLs may be incorrectly generated using the internal container hostname (e.g., `http://prowler-api:8080/...`) instead of your external domain URL (e.g., `https://prowler.example.com/...`). + +**Root Cause:** + +Next.js environment variables prefixed with `NEXT_PUBLIC_` are **bundled at build time**, not runtime. The pre-built Docker images from Docker Hub (`prowlercloud/prowler-ui:stable`) are built with default internal URLs. Simply setting `NEXT_PUBLIC_API_BASE_URL` in your `.env` file or environment variables and restarting the container will **NOT** work because these values are already compiled into the JavaScript bundle. + +**Solution:** + +You must **rebuild** the UI Docker image with your external URL: + +```bash +# Clone the repository (if you haven't already) +git clone https://github.com/prowler-cloud/prowler.git +cd prowler/ui + +# Build with your external URL as a build argument +docker build \ + --build-arg NEXT_PUBLIC_API_BASE_URL=https://prowler.example.com/api/v1 \ + --build-arg NEXT_PUBLIC_API_DOCS_URL=https://prowler.example.com/api/v1/docs \ + -t prowler-ui-custom:latest \ + --target prod \ + . +``` + +Then update your `docker-compose.yml` to use your custom image instead of the pre-built one: + +```yaml +services: + ui: + image: prowler-ui-custom:latest # Use your custom-built image + # ... rest of configuration +``` + + +The `NEXT_PUBLIC_` prefix is a Next.js convention that exposes environment variables to the browser. Since the browser bundle is compiled during `docker build`, these variables must be provided as build arguments, not runtime environment variables. +