Feature/reverse proxy web auth

[Meganitrospeed]

Summary

This PR adds support for Grocy instances protected by an interactive reverse proxy, such as Authentik.

Currently, when Grocy Android checks /api/system/info, the reverse proxy can return its HTML login page instead of the expected Grocy JSON response. The app then displays “Target is not a Grocy instance.”

My Grocy installation uses the following configuration:

- GROCY_AUTH_CLASS=Grocy\Middleware\ReverseProxyAuthMiddleware
- GROCY_REVERSE_PROXY_AUTH_HEADER=X-Authentik-Username
- GROCY_REVERSE_PROXY_AUTH_USE_ENV=false

Changes

• Detects when the initial API response appears to be an interactive authentication page.
• Opens the configured server in an embedded WebView so the user can complete authentication.
• Makes the resulting session cookies available to Volley/HttpURLConnection.
• Includes the session cookies in authenticated Glide requests.
• Retries onboarding after authentication succeeds.
• Detects authentication pages returned after a proxy session expires and opens the login flow again.
• Continues using the existing GROCY-API-KEY header for Grocy API authentication.

This does not implement OAuth/OIDC directly. The WebView establishes the reverse proxy’s existing browser session, after which the app continues using the normal Grocy API.

Security considerations

• The app does not create or send X-Authentik-Username; the trusted reverse proxy remains responsible for injecting that header.
• Authentication responses are only handled for the configured Grocy origin.
• Scheme, hostname and effective port are checked before triggering reauthentication.
• File access, content access and mixed-content loading are disabled in the WebView.
• The Grocy API key is still sent as before.

Automated tests

Unit tests were added for:

• HTML and Authentik login-page detection.
• Avoiding false detection for valid Grocy JSON.
• Same-origin matching.
• Scheme, hostname and port mismatches.
• Authentik outpost and authentication-flow paths.

Testing performed

I tested the implementation with an Authentik-protected Grocy installation using the reverse-proxy middleware configuration shown above.

Additional testing of other identity providers and reverse-proxy configurations would be appreciated.

[Meganitrospeed]

Would Fix #829
@patzly if you want an instance to test against I can gladly offer mine

[patzly]

Thank you very much for your contribution! I think if this works for you I will simply merge it and other users can then request improvements if required.

[Meganitrospeed]

H I just fixed 3 Edge cases GPT found, nothing too serious, but from the testing I've done I havent seen any issues so far, if a request suddenly presents a proxy/Authentik http It opens the WebView in the pic and asks to be reauthed before continuing the request through the API, tested without issues on the initial onboarding, when consuming, etc on Authentik 2026.5.6

[Meganitrospeed]

Any feedback so far?

[patzly]

Hi, I'm now working on a complete rewrite for the Grocy app with modern best practices because this project uses many deprecated dependencies and technologies and is just too messy to further maintain. I hope you understand and I will try to implement your approach in the new project.

[Meganitrospeed]

Hi, I'm now working on a complete rewrite for the Grocy app with modern best practices because this project uses many deprecated dependencies and technologies and is just too messy to further maintain. I hope you understand and I will try to implement your approach in the new project.

Is the new repo public ? Can I contribute in some form?

[patzly]

No sadly not, it's still in early development but I try my best to get things done fast in my (not that much) free time.