SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-27 16:32:34 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Invalid hostname in iOS app #591

New Issue
Open
opened 2025-11-20 05:14:19 -05:00 by saavagebueno · 17 comments
saavagebueno commented 2025-11-20 05:14:19 -05:00
Owner
Copy Link

Originally created by @ydkn on GitHub (Jan 20, 2024).

Describe the problem
I trying to set a custom server in the iOS app with a .network domain is not possible because it thinks it is an invalid address.

To Reproduce
Steps to reproduce the behavior:

  1. Go to 'Change Server'
  2. Enter 'https://foobar.network' into the server input field
  3. See error 'Invalid server address'

Expected behavior
The server address is not assumed to be invalid and it is possible to save.

Version:
0.0.1

Screenshots
ios-dot-network

Originally created by @ydkn on GitHub (Jan 20, 2024). **Describe the problem** I trying to set a custom server in the iOS app with a `.network` domain is not possible because it thinks it is an invalid address. **To Reproduce** Steps to reproduce the behavior: 1. Go to 'Change Server' 2. Enter 'https://foobar.network' into the server input field 4. See error 'Invalid server address' **Expected behavior** The server address is not assumed to be invalid and it is possible to save. **Version:** 0.0.1 **Screenshots** ![ios-dot-network](https://github.com/netbirdio/netbird/assets/231497/826ac823-6269-4ab6-b251-6c5c9640e064)
saavagebueno added the bugmobileios labels 2025-11-20 05:14:19 -05:00
saavagebueno commented 2025-11-20 05:14:20 -05:00
Author
Owner
Copy Link

@pascal-fischer commented on GitHub (Jan 22, 2024):

Hi @ydkn,

thanks for reporting the issue. We are aware and have fixed it in our development version.
We will release a new version of the app pretty soon so I would kindly ask you to wait a bit more before the fix will be published.

@pascal-fischer commented on GitHub (Jan 22, 2024): Hi @ydkn, thanks for reporting the issue. We are aware and have fixed it in our development version. We will release a new version of the app pretty soon so I would kindly ask you to wait a bit more before the fix will be published.
saavagebueno commented 2025-11-20 05:14:20 -05:00
Author
Owner
Copy Link

@firestrife23 commented on GitHub (Jan 30, 2024):

Am I supposed to wait for it with bated breath? I can't contain my excitement!

@firestrife23 commented on GitHub (Jan 30, 2024): Am I supposed to wait for it with bated breath? I can't contain my excitement!
saavagebueno commented 2025-11-20 05:14:20 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jan 31, 2024):

Hello @ydkn @firestrife23 the version with fix is waiting for review now and we expect to be released soon.

@mlsmaycon commented on GitHub (Jan 31, 2024): Hello @ydkn @firestrife23 the version with fix is waiting for review now and we expect to be released soon.
saavagebueno commented 2025-11-20 05:14:21 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jan 31, 2024):

Hey @ydkn @firestrife23 the new version is now available. Please let us know if the issue persists.

@mlsmaycon commented on GitHub (Jan 31, 2024): Hey @ydkn @firestrife23 the new version is now available. Please let us know if the issue persists.
saavagebueno commented 2025-11-20 05:14:21 -05:00
Author
Owner
Copy Link

@firestrife23 commented on GitHub (Jan 31, 2024):

The issue persists. My domain's TLD is .casa and I don't know if that's helpful.

@firestrife23 commented on GitHub (Jan 31, 2024): The issue persists. My domain's TLD is `.casa` and I don't know if that's helpful.
saavagebueno commented 2025-11-20 05:14:21 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Feb 3, 2024):

@firestrife23 what is your app version?

@mlsmaycon commented on GitHub (Feb 3, 2024): @firestrife23 what is your app version?
saavagebueno commented 2025-11-20 05:14:21 -05:00
Author
Owner
Copy Link

@firestrife23 commented on GitHub (Feb 3, 2024):

0.0.2, using self-hosted with Keycloak as ID provider.

@firestrife23 commented on GitHub (Feb 3, 2024): 0.0.2, using self-hosted with Keycloak as ID provider.
saavagebueno commented 2025-11-20 05:14:21 -05:00
Author
Owner
Copy Link

@pascal-fischer commented on GitHub (Feb 6, 2024):

Can you share your full domain or a similar one that is failing for you? I tried to reproduce but I did not encounter any issues.
One thing I could imagine is that you have a space at the end? Now I added trimming to the text boxes to ignore spaces.

@pascal-fischer commented on GitHub (Feb 6, 2024): Can you share your full domain or a similar one that is failing for you? I tried to reproduce but I did not encounter any issues. One thing I could imagine is that you have a space at the end? Now I added trimming to the text boxes to ignore spaces. <img src="https://github.com/netbirdio/netbird/assets/32096965/38e7b48b-697a-4141-bd5a-161763966fba" width="300">
saavagebueno commented 2025-11-20 05:14:21 -05:00
Author
Owner
Copy Link

@firestrife23 commented on GitHub (Feb 6, 2024):

https://n0where.casa

@firestrife23 commented on GitHub (Feb 6, 2024): https://n0where.casa
saavagebueno commented 2025-11-20 05:14:21 -05:00
Author
Owner
Copy Link

@pascal-fischer commented on GitHub (Feb 6, 2024):

I checked the domain and it is not the initial URL validation but the SSO lookup. The iOS app is not able to detect what authentication flow is used by the server. I checked the Android client and it is not able to detect it either. Can you check your management configuration for DeviceAuthorizationFlow and/or PKCEAuthorizationFlow. When you connect a desktop client do you use the user login or only setup-keys?

@pascal-fischer commented on GitHub (Feb 6, 2024): I checked the domain and it is not the initial URL validation but the SSO lookup. The iOS app is not able to detect what authentication flow is used by the server. I checked the Android client and it is not able to detect it either. Can you check your management configuration for `DeviceAuthorizationFlow` and/or `PKCEAuthorizationFlow`. When you connect a desktop client do you use the user login or only setup-keys?
saavagebueno commented 2025-11-20 05:14:22 -05:00
Author
Owner
Copy Link

@firestrife23 commented on GitHub (Feb 6, 2024):

I use only setup-keys for desktop clients.

    },
    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
            "ClientID": "netbird-client",
            "ClientSecret": "",
            "Domain": "REDACTED",
            "Audience": "netbird-client",
            "TokenEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/token",
            "DeviceAuthEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/auth/device",
            "AuthorizationEndpoint": "",
            "Scope": "openid",
            "UseIDToken": false,
            "RedirectURLs": null
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "netbird-client",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "netbird-client",
            "TokenEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/auth",
            "Scope": "openid profile email offline_access api",
            "UseIDToken": false,
            "RedirectURLs": [
                "http://localhost:53000"
            ]
	}
    },
@firestrife23 commented on GitHub (Feb 6, 2024): I use only setup-keys for desktop clients. ``` }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "REDACTED", "Audience": "netbird-client", "TokenEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/token", "DeviceAuthEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/auth/device", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "", "Audience": "netbird-client", "TokenEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://REDACTED/realms/REDACTED/protocol/openid-connect/auth", "Scope": "openid profile email offline_access api", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000" ] } }, ```
saavagebueno commented 2025-11-20 05:14:22 -05:00
Author
Owner
Copy Link

@pascal-fischer commented on GitHub (Feb 7, 2024):

It looks like your auth flow configurations are incomplete, which is why the app can not connect.
So now you have 2 options:

  • remove the auth flow configurations completely (this will force the app to fall back to setup keys) but then you will only be able to add clients via setup keys and not SSO
  • fix the configuration following the docs
@pascal-fischer commented on GitHub (Feb 7, 2024): It looks like your auth flow configurations are incomplete, which is why the app can not connect. So now you have 2 options: - remove the auth flow configurations completely (this will force the app to fall back to setup keys) but then you will only be able to add clients via setup keys and not SSO - fix the configuration following the [docs](https://docs.netbird.io/selfhosted/identity-providers#keycloak)
saavagebueno commented 2025-11-20 05:14:22 -05:00
Author
Owner
Copy Link

@firestrife23 commented on GitHub (Feb 10, 2024):

I decided to create a backup of my initial setup and start fresh to determine if the issue can be reproducible. I followed your documentation on the advanced guide and Keycloak idP for self-hosted. However, I'm still experiencing difficulty logging in with the iOS app.

By the way the screenshots on your documents is slightly different from more recent version of Keycloak.

@firestrife23 commented on GitHub (Feb 10, 2024): I decided to create a backup of my initial setup and start fresh to determine if the issue can be reproducible. I followed your documentation on the advanced guide and Keycloak idP for self-hosted. However, I'm still experiencing difficulty logging in with the iOS app. By the way the screenshots on your documents is slightly different from more recent version of Keycloak.
saavagebueno commented 2025-11-20 05:14:22 -05:00
Author
Owner
Copy Link

@sleb23 commented on GitHub (Mar 5, 2025):

Hi @mlsmaycon @pascal-fischer

I'm having this same issue.

I've just recently set up a self-hosted server using SWAG/Nginx as my proxy (with ':latest' docker images) and Entra as my IdP. I can connect successfully from Windows, Mac, and Android, but I've had two of my colleagues try from their iPhone 13 Pro's (version 18.3.1) - they both get "Invalid server address". They're on the latest Netbird version 0.0.9. I've had them try from wifi & cellular, and I've also had them try variations of the server address (https://, http://, no https, Https://).

I have a meeting with Mikhail on Friday to discuss getting access to the MSP portal, and I was really looking forward to transitioning from our legacy vpn solution... but this is a big obstacle for us that would need to be addressed first. I hope you can provide some assistance. Let me know if you need to see any other specific config files.

management.json 
{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.REDACTED.com:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.REDACTED.com:3478",
                "Username": "self",
                "Password": "REDACTED"
            }
        ]
    },
    "Relay": {
        "Addresses": [
            "rels://netbird.REDACTED.com:443"
        ],
        "CredentialsTTL": "24h0m0s",
        "Secret": "REDACTED"
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird.REDACTED.com:443",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "REDACTED",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "REDACTED",
        "AuthIssuer": "https://login.microsoftonline.com/REDACTED/v2.0",
        "AuthUserIDClaim": "oid",
        "AuthKeysLocation": "https://login.microsoftonline.com/REDACTED/discovery/v2.0/keys",
        "OIDCConfigEndpoint": "https://login.microsoftonline.com/REDACTED/v2.0/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "azure",
        "ClientConfig": {
            "Issuer": "https://login.microsoftonline.com/REDACTED/v2.0",
            "TokenEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/token",
            "ClientID": "REDACTED",
            "ClientSecret": "REDACTED",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "GraphApiEndpoint": "https://graph.microsoft.com/v1.0",
            "ObjectId": "REDACTED"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "azure",
        "ProviderConfig": {
            "ClientID": "REDACTED",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "REDACTED",
            "TokenEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/token",
            "DeviceAuthEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/devicecode",
            "AuthorizationEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/authorize",
            "Scope": "openid profile email offline_access User.Read api://REDACTED/api",
            "UseIDToken": true,
            "RedirectURLs": ["https://netbird.REDACTED.com/auth"]
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "REDACTED",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "REDACTED",
            "TokenEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/authorize",
            "Scope": "openid profile email offline_access User.Read api://REDACTED/api",
            "UseIDToken": true,
            "RedirectURLs": [
                "http://localhost:53000"
            ]
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}
@sleb23 commented on GitHub (Mar 5, 2025): Hi @mlsmaycon @pascal-fischer I'm having this same issue. I've just recently set up a self-hosted server using SWAG/Nginx as my proxy (with ':latest' docker images) and Entra as my IdP. I can connect successfully from Windows, Mac, and Android, but I've had two of my colleagues try from their iPhone 13 Pro's (version 18.3.1) - they both get "Invalid server address". They're on the latest Netbird version 0.0.9. I've had them try from wifi & cellular, and I've also had them try variations of the server address (https://, http://, no https, Https://). I have a meeting with Mikhail on Friday to discuss getting access to the MSP portal, and I was really looking forward to transitioning from our legacy vpn solution... but this is a big obstacle for us that would need to be addressed first. I hope you can provide some assistance. Let me know if you need to see any other specific config files. <details> <summary>management.json</summary> ```json { "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.REDACTED.com:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:netbird.REDACTED.com:3478", "Username": "self", "Password": "REDACTED" } ] }, "Relay": { "Addresses": [ "rels://netbird.REDACTED.com:443" ], "CredentialsTTL": "24h0m0s", "Secret": "REDACTED" }, "Signal": { "Proto": "https", "URI": "netbird.REDACTED.com:443", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "REDACTED", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "", "CertKey": "", "AuthAudience": "REDACTED", "AuthIssuer": "https://login.microsoftonline.com/REDACTED/v2.0", "AuthUserIDClaim": "oid", "AuthKeysLocation": "https://login.microsoftonline.com/REDACTED/discovery/v2.0/keys", "OIDCConfigEndpoint": "https://login.microsoftonline.com/REDACTED/v2.0/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false, "ExtraAuthAudience": "" }, "IdpManagerConfig": { "ManagerType": "azure", "ClientConfig": { "Issuer": "https://login.microsoftonline.com/REDACTED/v2.0", "TokenEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/token", "ClientID": "REDACTED", "ClientSecret": "REDACTED", "GrantType": "client_credentials" }, "ExtraConfig": { "GraphApiEndpoint": "https://graph.microsoft.com/v1.0", "ObjectId": "REDACTED" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "azure", "ProviderConfig": { "ClientID": "REDACTED", "ClientSecret": "", "Domain": "", "Audience": "REDACTED", "TokenEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/token", "DeviceAuthEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/devicecode", "AuthorizationEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/authorize", "Scope": "openid profile email offline_access User.Read api://REDACTED/api", "UseIDToken": true, "RedirectURLs": ["https://netbird.REDACTED.com/auth"] } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "REDACTED", "ClientSecret": "", "Domain": "", "Audience": "REDACTED", "TokenEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://login.microsoftonline.com/REDACTED/oauth2/v2.0/authorize", "Scope": "openid profile email offline_access User.Read api://REDACTED/api", "UseIDToken": true, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } } ``` </details>
saavagebueno commented 2025-11-20 05:14:22 -05:00
Author
Owner
Copy Link

@pascal-fischer commented on GitHub (Mar 6, 2025):

Hi @sleb23,

to help you with this and fix the issue, it's crucial for us to know the original server address.
To not share it publicly you can send it to me via Slack or email to pascal@netbird.io.

Thanks!

@pascal-fischer commented on GitHub (Mar 6, 2025): Hi @sleb23, to help you with this and fix the issue, it's crucial for us to know the original server address. To not share it publicly you can send it to me via Slack or email to pascal@netbird.io. Thanks!
saavagebueno commented 2025-11-20 05:14:22 -05:00
Author
Owner
Copy Link

@firestrife23 commented on GitHub (Mar 6, 2025):

I forgot about this issue. I can't remember what or how I got this fixed... I think it had something to do with passing headers between the reverse proxy and NetBird... it's been a while.

@firestrife23 commented on GitHub (Mar 6, 2025): I forgot about this issue. I can't remember what or how I got this fixed... I think it had something to do with passing headers between the reverse proxy and NetBird... it's been a while.
saavagebueno commented 2025-11-20 05:14:23 -05:00
Author
Owner
Copy Link

@sleb23 commented on GitHub (Mar 6, 2025):

Thanks again @pascal-fischer for the solution.

For anyone else having the same issue:
Under DeviceAuthorizationFlow, I had to change the provider from azure to "hosted"

    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
@sleb23 commented on GitHub (Mar 6, 2025): Thanks again @pascal-fischer for the solution. For anyone else having the same issue: Under DeviceAuthorizationFlow, I had to change the provider from azure to "hosted" ``` "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label bug ios mobile
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#591
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?