[BUG] Cannot disable HTTP Basic auth without also disabling RPC auth

[rlue]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

If no USER and PASS env vars are provided, then settings.json automatically resets rpc-authentication-required to false on container startup.

Expected Behavior

RPC and HTTP Basic authentication should be separately configured. Specifically, it should be possible to require RPC authentication without requiring HTTP Basic authentication. (In my case, I am running a third-party web UI for Transmission which must be configured with the RPC username and password, so disabling HTTP Basic auth does not create a security vulnerability to my knowledge.)

Steps To Reproduce

• Launch container with configuration provided in README. Do not define USER or PASS env vars.
• Stop container.
• Edit settings.json to enable rpc-authentication-required.
• Restart container—rpc-authentication-required will be reset to false.

Or,

• Launch container with configuration provided in README. Provide USER or PASS env vars.
• Load web UI in browser—HTTP Basic authentication will be required.

Environment

* OS: Debian 12 (bookworm)
* How docker service was installed: apt

CPU architecture

arm64

Docker creation

services:
  transmission:
    image: lscr.io/linuxserver/transmission:latest
    container_name: transmission
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - USER= #optional
      - PASS= #optional
    volumes:
      - /path/to/transmission/data:/config
      - /path/to/downloads:/downloads #optional
      - /path/to/watch/folder:/watch #optional
    ports:
      - 9091:9091
      - 51413:51413
      - 51413:51413/udp
    restart: unless-stopped

Container logs

$ docker container logs -f transmission
[migrations] started
[migrations] no migrations found
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    0
User GID:    0
───────────────────────────────────────
Linuxserver.io version: 4.0.6-r4-ls292
Build-date: 2025-05-06T10:43:15+00:00
───────────────────────────────────────

[custom-init] No custom files found, skipping...
Connection to localhost (127.0.0.1) 9091 port [tcp/*] succeeded!
[ls.io-init] done.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[aptalca]

The container stops the transmission process via rpc so we need the credentials for both to be set via the same vars.

Splitting them up would provide little benefit at a great development and support cost.

[rlue]

Okay, how about a boolean flag like ENABLE_HTTP_BASIC which defaults to true, and disables web ui authentication if it's false?

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[rlue]

Hi stale bot! I still consider this a bug. Is the assumption that there would be recent activity from someone on the team if they deemed my concern valid?

IMO there should be an option to disable HTTP Basic auth, given that Transmission supports alternate web frontends, some of which manage authentication on their own.

[rlue]

After digging into this a bit, I am understanding that this is more an upstream limitation in transmission-daemon than of this container image specifically. Not going to bother filing a ticket with the Transmission project; I can find a workaround here.

Thanks for your time, and sorry for the trouble.