Miniflux is a self-hosted, lightweight RSS reader replacing Feedly with single-binary Go performance, PostgreSQL storage, and zero subscription paywalls.
Miniflux is a minimalist, opinionated RSS and Atom feed reader compiled as a single Go binary. It discards algorithmic recommendations, social widgets, and excess interface layers to focus strictly on fast text delivery backed by PostgreSQL. Readers get complete ownership over content sanitization, tracker removal, and background polling on their own hardware.
Why Miniflux instead of Feedly
Feedly operates on a commercial freemium model that caps feed counts on basic accounts and gates essential reading tools behind monthly subscriptions. Features like custom polling intervals, full-text search, and newsletter integration require recurring fees of six to twelve dollars per month. Miniflux eliminates subscription tiers entirely. A homelab administrator can run Miniflux on a modest VPS or local server, polling thousands of feeds with zero recurring license costs and zero artificial feature gates.
The tradeoff lies in infrastructure ownership. Feedly provides a hosted cloud platform with native mobile apps and automated discovery. Miniflux offloads discovery to the user, lacks official mobile apps, and requires a dedicated PostgreSQL database. However, Miniflux includes standard Google Reader and Fever API endpoints, allowing readers to sync third-party clients like Reeder or NetNewsWire without paying Feedly for API access. Moving from Feedly requires only an OPML import.
What it does well
Resource-conscious runtime: Compiles to a single static Go binary with embedded assets, consuming roughly 20 megabytes of RAM under active workloads.
Built-in content sanitization: Strips tracking pixels, removes marketing query parameters like utm_source, and proxies remote media to prevent referrer leaks.
Automated full-text extraction: Uses an internal readability parser and custom CSS scraper rules to fetch full articles from summary-only feeds.
Native sync protocol emulation: Implements Google Reader and Fever APIs to synchronize read status across independent mobile and desktop clients.
Granular feed filtering: Supports regex inclusion and exclusion rules, custom user-agent headers, and URL rewrite patterns.
Direct bookmarking integrations: Dispatches articles directly to self-hosted tools like Linkding, Wallabag, Shiori, and Ntfy.
Limitations
Strict PostgreSQL dependency: Miniflux requires PostgreSQL and explicitly refuses to support SQLite (GitHub issue #1925), adding database management overhead for single-user home servers.
Similar Open Source Tools
No cross-feed deduplication: Multiple feeds syndicating identical wire stories appear as duplicate unread entries (tracked in GitHub issue #797).
Global polling schedule: Background refresh intervals apply instance-wide rather than per individual feed (GitHub issue #412).
Progressive web app reliance: The project provides no official native mobile applications, relying instead on browser PWAs or independent third-party sync clients.
Who should use it
Homelab administrators who want an efficient feed backend that consumes minimal memory and sits cleanly behind a reverse proxy.
Privacy-focused readers looking to eliminate corporate telemetry, tracking scripts, and algorithmic sorting from their news flow.
Self-hosters who want a centralized sync engine for standalone reading apps like Reeder or NetNewsWire.
FAQ
Is Miniflux free to self-host?
Yes. Miniflux is open-source software with no paid feature tiers; you only pay for the compute and PostgreSQL storage used to run it.
Miniflux vs Feedly — which should you choose?
Choose Feedly for managed cloud hosting, automated content discovery, and team boards; choose Miniflux for complete data privacy, zero recurring subscriptions, and a distraction-free interface.
Can Miniflux run with SQLite instead of PostgreSQL?
No. The maintainers require PostgreSQL to avoid multi-database abstraction layers and ensure reliable query performance.
Verdict
Miniflux is the right choice for homelab operators and minimalists who want a dedicated RSS synchronization engine without recurring fees, provided they are comfortable running PostgreSQL. An Apache-2.0 license guarantees complete freedom to self-host or modify the codebase, while frequent releases and active commits through August 2026 ensure dependable long-term stability.
Install Miniflux
Verified install
Commands from the official package registries. Each package is matched to Miniflux through the registry's own link to its source code or website.
Homebrew
brew install miniflux
Homebrew
brew install miniflux
apt · Debian 13, Ubuntu 24.04
sudo apt install miniflux
pacman · Arch Linux
sudo pacman -S miniflux
We started this exact setup from scratch in a clean Linux machine on Nov 2, 2026 and checked it through Miniflux's own API: every check passed. Recipes are re-checked regularly and removed if they stop working.
security: feeds list requires auth — anonymous GET /v1/feeds → 401
security: users list requires auth — anonymous GET /v1/users → 401
security: open protocols — no unauthenticated Redis protocol on public ports
security: nuclei scan — no findings
services healthy
logs clean
Ubuntu 24.04 · Apple container, Docker 29.1.3, Compose 2.40.3+ds1-0ubuntu1~24.04.1. Images pulled in 18 s: postgres:17-alpine, miniflux/miniflux:2.3.5.
Based on the upstream setup. Official basic compose from contrib/docker-compose. Image pinned to 2.3.5 with postgres:17-alpine; database and admin passwords moved to .env; DEBUG removed; BASE_URL configured.
miniflux-1 | 2026-11-02T06:58:12.939510549Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:12.939580716Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:12.960175341Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:12.965569757Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:12.969271549Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:12.969282966Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 MarketGoo/2.1" response.status_code=400
miniflux-1 | 2026-11-02T06:58:13.951587758Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:13.952436341Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:13.963123966Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:13.965539341Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:13.965556716Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:13.965561299Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:13.965647383Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:13.968581674Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:14.956896300Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:14.957313758Z level=WARN msg="Invalid or missing CSRF token" url=/login
miniflux-1 | 2026-11-02T06:58:19.972154511Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:19.972202136Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:19.972308177Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:19.972331844Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15" response.status_code=400
miniflux-1 | 2026-11-02T06:58:19.973947469Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:19.973980969Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1" response.status_code=400
miniflux-1 | 2026-11-02T06:58:19.974182344Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:19.974184011Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:20.963218594Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:20.963235344Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:21.948893845Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:21.948923678Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.947629887Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.947649470Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950797012Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950826970Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950831220Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950833054Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Safari/605.1.15" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950843804Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950845345Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950847012Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950848054Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Gecko/20100101 Firefox/140.0.2 (x64 de)" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950849720Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950850845Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950852387Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950853429Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950854970Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950857054Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950858679Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950859679Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950861262Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950862345Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.1 Safari/605.1.15" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950863887Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950864929Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950866887Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950867970Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Safari/605.1.15" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950871845Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950873012Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.950874595Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.950875929Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.954007845Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.954096970Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:22.954197012Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:22.954235679Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:58:33.963360044Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:33.963376252Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.16" response.status_code=400
miniflux-1 | 2026-11-02T06:58:33.963429919Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:58:33.963512710Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.78.2 (KHTML, like Gecko) Version/7.0.6 Safari/537.78.2" response.status_code=400
miniflux-1 | 2026-11-02T06:58:35.946253795Z level=WARN msg="Invalid or missing CSRF token" url="/?s=index/index/index"
miniflux-1 | 2026-11-02T06:58:35.948456753Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri="/?s=index/index/index" request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0" response.status_code=400
miniflux-1 | 2026-11-02T06:58:35.949436711Z level=WARN msg="Invalid or missing CSRF token" url="/?s=index/index/index"
miniflux-1 | 2026-11-02T06:58:35.949443336Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri="/?s=index/index/index" request.user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.8" response.status_code=400
miniflux-1 | 2026-11-02T06:58:59.950199264Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" request_uri="/v1/folder?path=%2F"
miniflux-1 | 2026-11-02T06:58:59.950239014Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/folder?path=%2F" request.user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:58:59.950242598Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0" request_uri="/v1/folder?path=%2F"
miniflux-1 | 2026-11-02T06:58:59.950244806Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/folder?path=%2F" request.user_agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0" response.status_code=401
miniflux-1 | 2026-11-02T06:59:02.946440251Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Thunderbird/140.0" request_uri=/v1/submissions
miniflux-1 | 2026-11-02T06:59:02.947573084Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri=/v1/submissions request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Thunderbird/140.0" response.status_code=401
miniflux-1 | 2026-11-02T06:59:02.948629001Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36" request_uri=/v1/submissions
miniflux-1 | 2026-11-02T06:59:02.948761292Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri=/v1/submissions request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:09.955200504Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0" request_uri="/v1/auth/users?pageNo=1&pageSize=9"
miniflux-1 | 2026-11-02T06:59:09.955224504Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/auth/users?pageNo=1&pageSize=9" request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0" response.status_code=401
miniflux-1 | 2026-11-02T06:59:09.967046962Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" request_uri="/v1/auth/users?pageNo=1&pageSize=9"
miniflux-1 | 2026-11-02T06:59:09.967087087Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/auth/users?pageNo=1&pageSize=9" request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:12.946623297Z level=WARN msg="Not Found" client_ip=192.168.65.122 request.method=GET request.uri="/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+547653*865674+as+id" request.user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.8" response.status_code=404
miniflux-1 | 2026-11-02T06:59:12.960161172Z level=WARN msg="Not Found" client_ip=192.168.65.122 request.method=GET request.uri="/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+547653*865674+as+id" request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15" response.status_code=404
miniflux-1 | 2026-11-02T06:59:13.940420464Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0" request_uri="/v1/folder?path=%2F"
miniflux-1 | 2026-11-02T06:59:13.940437714Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/folder?path=%2F" request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0" response.status_code=401
miniflux-1 | 2026-11-02T06:59:13.940807631Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" request_uri="/v1/folder?path=%2F"
miniflux-1 | 2026-11-02T06:59:13.941510464Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/folder?path=%2F" request.user_agent="Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:19.964788051Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Safari/605.1.15" request_uri="/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g"
miniflux-1 | 2026-11-02T06:59:19.964811801Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36" request_uri="/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g"
miniflux-1 | 2026-11-02T06:59:19.964813551Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g" request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Safari/605.1.15" response.status_code=401
miniflux-1 | 2026-11-02T06:59:19.964814634Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/auth/users?pageNo=1&pageSize=10&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OTl9.-isk56R8NfioHVYmpj4oz92nUteNBCN3HRd0-Hfk76g" request.user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:21.936979051Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" request_uri="/v1/users/image?path=/var/lib/casaos/1/app_order.json"
miniflux-1 | 2026-11-02T06:59:21.937120593Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/users/image?path=/var/lib/casaos/1/app_order.json" request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:21.937618676Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16" request_uri="/v1/users/image?path=/var/lib/casaos/1/app_order.json"
miniflux-1 | 2026-11-02T06:59:21.937775843Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/users/image?path=/var/lib/casaos/1/app_order.json" request.user_agent="Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16" response.status_code=401
miniflux-1 | 2026-11-02T06:59:21.945011135Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" request_uri="/v1/users/image?path=/var/lib/casaos/1/system.json"
miniflux-1 | 2026-11-02T06:59:21.945037468Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/users/image?path=/var/lib/casaos/1/system.json" request.user_agent="Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:21.948388260Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0" request_uri="/v1/users/image?path=/var/lib/casaos/1/system.json"
miniflux-1 | 2026-11-02T06:59:21.948401593Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/users/image?path=/var/lib/casaos/1/system.json" request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0" response.status_code=401
miniflux-1 | 2026-11-02T06:59:24.937887303Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" request_uri="/v1/cs/configs?export=true&group&tenant&appName&ids&dataId"
miniflux-1 | 2026-11-02T06:59:24.938008845Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/cs/configs?export=true&group&tenant&appName&ids&dataId" request.user_agent="Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:24.939882511Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9" request_uri="/v1/cs/configs?export=true&group&tenant&appName&ids&dataId"
miniflux-1 | 2026-11-02T06:59:24.939977136Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri="/v1/cs/configs?export=true&group&tenant&appName&ids&dataId" request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9" response.status_code=401
miniflux-1 | 2026-11-02T06:59:24.947344136Z level=WARN msg="Invalid or missing CSRF token" url="/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D"
miniflux-1 | 2026-11-02T06:59:24.947381511Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri="/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D" request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0" response.status_code=400
miniflux-1 | 2026-11-02T06:59:24.959441595Z level=WARN msg="Invalid or missing CSRF token" url="/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D"
miniflux-1 | 2026-11-02T06:59:24.959833886Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri="/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D" request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15" response.status_code=400
miniflux-1 | 2026-11-02T06:59:24.962651261Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:59:24.962802970Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" response.status_code=400
miniflux-1 | 2026-11-02T06:59:24.963018386Z level=WARN msg="Invalid or missing CSRF token" url=/
miniflux-1 | 2026-11-02T06:59:24.963522970Z level=WARN msg="Bad Request" error="invalid or missing CSRF" client_ip=192.168.65.122 request.method=POST request.uri=/ request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/536.15 (KHTML like Gecko) Version/6.0 Safari/536.16" response.status_code=400
miniflux-1 | 2026-11-02T06:59:25.960011428Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.12" request_uri=/v1/health/service/consul
miniflux-1 | 2026-11-02T06:59:25.960023595Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri=/v1/health/service/consul request.user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.12" response.status_code=401
miniflux-1 | 2026-11-02T06:59:25.964625637Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0" request_uri=/v1/health/service/consul
miniflux-1 | 2026-11-02T06:59:25.964637053Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri=/v1/health/service/consul request.user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0" response.status_code=401
miniflux-1 | 2026-11-02T06:59:27.970959471Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1" request_uri=/v1/models
miniflux-1 | 2026-11-02T06:59:27.970969471Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri=/v1/models request.user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1" response.status_code=401
miniflux-1 | 2026-11-02T06:59:27.972997721Z level=WARN msg="[API] No Basic HTTP Authentication header sent with the request" authentication_failed=true client_ip=192.168.65.122 user_agent="Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" request_uri=/v1/models
miniflux-1 | 2026-11-02T06:59:27.973061179Z level=WARN msg=Unauthorized client_ip=192.168.65.122 request.method=GET request.uri=/v1/models request.user_agent="Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" response.status_code=401
miniflux-1 | 2026-11-02T06:59:33.957405417Z level=WARN msg="Not Found" client_ip=192.168.65.122 request.method=GET request.uri=/js/..%2f%2f/wizard.htm request.user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.5" response.status_code=404
miniflux-1 | 2026-11-02T06:59:33.957824667Z level=WARN msg="Not Found" client_ip=192.168.65.122 request.method=GET request.uri=/js/..%2f%2f/wizard.htm request.user_agent="Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" response.status_code=404
