Todo #6727
open
Apple TouchID/FaceID probes for site icon files that do not exist
100%
Description
I notice this occasionally in my log files after logging in via the web browser :-
Aug 18 19:50:38 pfsense.localdomain nginx: 2016/08/18 19:50:38 [error] 36942#100114: *10595 open() "/usr/local/www/apple-touch-icon-precomposed.png" failed (2: No such file or directory), client: 172.16.1.20, server: , request: "GET /apple-touch-icon-precomposed.png HTTP/1.1", host: "172.16.1.1"
[2.3.2-RELEASE][admin@pfsense.localdomain]/root: ls /usr/local/www/apple-touch-icon-precomposed.png
ls: /usr/local/www/apple-touch-icon-precomposed.png: No such file or directory
[2.3.2-RELEASE][admin@pfsense.localdomain]/root: ls /usr/local/www/*.png
/usr/local/www/apple-touch-icon.png/usr/local/www/logo.png
/usr/local/www/logo-black.png /usr/local/www/pfs-mini.png
[2.3.2-RELEASE][admin@pfsense.localdomain]/root:
Maybe its just worth doing a symbolic link in the next pfSense build.
Files
Updated by Allistah F over 2 years ago
I'm on v2.6.0 CE and I just got this error myself. Interesting. Seems like it would be an easy fix.
Updated by Jim Pingle 3 months ago
- File login-page-icons.diff added
- Subject changed from Missing file apple-touch-icon-precomposed.png ? to Apple TouchID/FaceID probes for site icon files that do not exist
- Assignee deleted (
Jared Dillard) - Start date deleted (
08/18/2016)
After some recent discussion this has come back up, and seems to be narrowed down to using Apple's TouchID or FaceID when logging in. The login page doesn't send the icon metadata, but the GUI does send it after login. Proper browsers wait and respect that, they don't probe for those files indiscriminately. It appears Apple's password manager doesn't work the same way as Safari there.
One potential way to address this is to send the icon metadata in the login page, but I don't have any devices with TouchID or FaceID to test against (which is also why I can't reproduce it).
If that doesn't work, we could maybe copy the icons to the hardcoded paths it's probing, but that's not an ideal solution.
Updated by Rob A 3 months ago
24 hours later and the error returned. No changes so no idea why or why it was over a minute after login.
2025-06-22 10:31:31.000000+01:00 nginx - 2025/06/22 10:31:31 [error] 24#100557: *13201 open() "/usr/local/www/apple-touch-icon.png" failed (2: No such file or directory), client: 2a02:, server: , request: "GET /apple-touch-icon.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443"
2025-06-22 10:31:31.000000+01:00 nginx - 2025/06/22 10:31:31 [error] 24#100557: *13201 open() "/usr/local/www/apple-touch-icon-precomposed.png" failed (2: No such file or directory), client: 2a02:, server: , request: "GET /apple-touch-icon-precomposed.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443"
2025-06-22 10:30:15.450108+01:00 php-fpm 6810 /index.php: Successful login for user 'admin' from: 2a02: (Local Database)
Updated by Jim Pingle about 2 months ago
- File icon-headers.diff icon-headers.diff added
- Status changed from New to In Progress
- Assignee set to Jim Pingle
- Target version changed from Future to 2.9.0
- Plus Target Version set to 25.11
MR with a more complete fix: https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/1240
Attached is a diff of the changes for testing.
Tried to minimize repetition while including the icon headers on most pages that didn't have them already (login, various error pages, etc.)
Updated by Jim Pingle about 2 months ago
I tested it on a few more devices (CE and Plus) and it seems to be working OK. Good enough to merge in for the next dev builds for wider testing.
Updated by Jim Pingle about 2 months ago
- Status changed from In Progress to Feedback
- % Done changed from 0 to 100
Applied in changeset 80a9bb2ea1b0b4bd03960b10ad7784710ad76e9c.
Updated by Jim Pingle about 1 month ago
As far as I can tell with the code currently committed it appears to be OK everywhere by inspecting the headers (even on the CSRF error page), but I would like someone who could reproduce the original problem on macOS/iOS to check and see if they can reproduce it now.