unraid webui + traefik: once logged in, everyone on my network can reuse the login

Strange behavior which I can't really explain me.

My Unraid is not reachable from Internet. But I have Unraid with traefik running, so I have a valid Lets Encrypt Certificate.

Randomly I saw when once logged in on Unraid I can from my tablet / PC / Smartphone in Incognito mode reuse the login. When using logout I'm also thrown out on every device until I log in again.

The root user has a password.

Depends the login maybe on the IP address and not on some auth cookie? That would be my explanation that Unraid see the traefik IP address and so every client has access on it.

In attach my traefik docker setup:

# compose.yaml
services:
  traefik:
    # https://hub.docker.com/_/traefik
    image: traefik:3.4
    container_name: traefik
    restart: unless-stopped
    command: --providers.docker
    volumes:
      # docker mount
      - /var/run/docker.sock:/var/run/docker.sock

      # volume.git
      - ./volume.git/traefik.yml:/traefik.yml:ro
      - ./volume.git/dynamic_config.yml:/dynamic_config.yml:ro

      # volume permanent mount
      - ${VOL_DIR}/traefik/acme/:/acme/
    network_mode: host
    env_file: .env

# dynamic_config.yml

http:
  middlewares:
    https-redirect:
      redirectScheme:
        scheme: https

  routers:
    unraid:
      rule: 'Host(`unraid.example.org`)'
      entryPoints:
        - https
      service: unraid
      tls:
        certResolver: letsencrypt
        domains:
          - main: unraid.example.org
          - sans: '*.unraid.example.org'

  services:
    unraid:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:8080'

# https://docs.traefik.io/https/tls/#minimum-tls-version
tls:
  options:
    default:
      minVersion: VersionTLS12
      sniStrict: true
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

# traefik.yml

api:
  dashboard: true
entryPoints:
  http:
    address: ':80'
  https:
    address: ':443'
    asDefault: true

providers:
  docker:
    endpoint: 'unix:///var/run/docker.sock'
    exposedByDefault: false

  file:
    filename: /dynamic_config.yml
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /acme/acme.json
      dnsChallenge:
        provider: redacted
        resolvers:
          - '1.1.1.1:53'
          - '8.8.8.8:53'

Edited July 19, 2025Jul 19 by RogerSik