I am experiencing a persistent authentication failure on Ghost 6.x running in a Docker container on Unraid with a MariaDB backend.

Developer help
1

I am experiencing a persistent authentication failure on Ghost 6.x running in a Docker container on Unraid with a MariaDB backend.

  • Setup: Self-hosted Ghost 6.x container (ghost) connected to MariaDB (dbFEMC).

  • Symptom: Submitting valid admin credentials on the /ghost/#/signin page fails to complete sign-in. Inspecting the network requests shows 403 Forbidden / 400 Bad Request on POST /ghost/api/admin/authentication/session/.

  • Configuration:

    • config.production.json has url configured.

    • Attempted accessing via both reverse proxy (NGINX Proxy Manager over HTTPS) and direct local IP access ([``http://192.168.1.6:2310``](``http://192.168.1.6:2310``)).

    • Database records for users and api_keys are intact.

  • Goal: Understand why Ghost 6.x is rejecting session authentication and dropping/rejecting the ghost-admin-api-session cookie during POST authentication.

2

That 403 on the session POST is Ghost checking the Origin header against the url in your config. If they don’t match exactly (scheme, host, port), sign-in is refused. So logging in via 192.168.1.6:2310 will never work when url is set to your public https address, and vice versa.

For the proxy route, check that NPM passes X-Forwarded-Proto: https and the original Host header. If Ghost thinks it’s on plain http while url says https, the session cookie gets flagged Secure and dropped, which is where the 400 usually comes from.

Also worth knowing: Ghost 6 only supports MySQL 8, MariaDB isn’t tested. Not the cause of this one, but it will bite you later.

What is the exact url value in your config, and what does the Origin header show in that failing request?