GUI returning HTTP status 200 instead of 401 on failed login

[dzany]

Hi all, I hope I got to the correct subforum, and hello to all, this is my first post here :)

I have a reverse proxy in front of the Opnsense GUI for some specific reasons. I want to use fail2ban as an additional guard against failed logins to the Opnsense GUI because it needs to be accessible from the outside of the network, so the users can change their own VPN passwords and get their TOTP QRcode by themselves.

I have a problem that Opnsense GUI is actually returning HTTP status 200 instead of 401 when the username/password combination is incorrect. Is there any quick fix available, or could it be requested to get fixed in some next release?

Thank you!

[fabian]

OPNsense logs failed attempts to Syslog. You can use that to trigger a reaction.