[BUG] Memory route tracks/photos differ when opening the same memory from an external Wiki.js link

[racheljwood]

Describe the bug
When I open a Reitti memory directly, the tracks and photos load correctly.

When I open the same memory from an external link in Wiki.js, the memory page itself loads, but:

• route tracks are missing
• photos are blank

This happens even when the final URL in the browser is the same
To Reproduce

Reitti version

v3.4.1

Setup

• Reitti is hosted behind Cloudflare Access
• Wiki.js is on a separate site/app
• I am logged into Reitti in the browser
• Wiki.js contains a normal HTML link to the memory

Example link used in Wiki.js:

<a href="https://reitti.xxxxxxxx.dk/memories/3?timezone=Europe/Copenhagen" target="_blank" rel="noopener">
  The Route
</a>

I also tested with a fresh magic link (?mt=...) generated from the Share dialog. Same result.

Steps to reproduce the behavior:
1 Create/open a memory that normally shows tracks and photos

2 Open the memory directly in the browser

3 Confirm tracks and photos appear

4 Put a normal link to the same memory into Wiki.js

5 Click the link from Wiki.js

6 Observe that the memory page opens, but tracks are missing and photos are blank

**Expected behavior**

The same memory should load the same tracks and photos regardless of whether it is opened directly or via an external link.

**Actual behavior**

Opening directly:
page opens
tracks load
photos load

Opening from Wiki.js:
page opens
tracks do not load
photos are blank

**Debugging details**

I compared the raw-location-points request in both cases.

The request URL is the same in both cases:

/api/v1/raw-location-points?startDate=2025-05-09T05:57:10&endDate=2025-05-09T18:21&timezone=Europe/Copenhagen&zoom=19

The referer is also the same in both cases:

https://reitti.xxxxxxxx.dk/memories/3?timezone=Europe/Copenhagen

But the responses differ:

Direct open

Response contains segments with points, for example:

{
  "segments": [
    {
      "points": [...]
    }
  ],
  "latest": {...}
}
Opened from Wiki.js

Response contains no segments:

{
  "segments": [],
  "latest": {...}
}

I also checked cookies in DevTools:

the direct case sends JSESSIONID

the Wiki.js-opened raw-location-points request did not send JSESSIONID

in the Wiki.js-opened tab, JSESSIONID does exist in browser storage

This suggests the memory page is opened, but the follow-up requests for route/photo data are not using the same effective session/auth context when the navigation starts from Wiki.js.
**Screenshots**
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**
 - OS: MacOS Tahoo 26.2
 - Browser chrome
 - Version 145.0.7632.160

**Smartphone (please complete the following information):**
 - N/A

**Additional context**
I also observed that when using a magic link with ?mt=...&timezone=Europe/Copenhagen, Reitti responds with a 302 redirect to:

/memories/3

So the initial parameters appear to be stripped by the redirect, but even after ending up on:

/memories/3?timezone=Europe/Copenhagen

the behavior still differs between direct open and opening from Wiki.js.

<img width="1047" height="543" alt="Image" src="https://github.com/user-attachments/assets/a563c07e-7cec-4cb3-9ccb-7b5a5c6629f1" />
<img width="1049" height="543" alt="Image" src="https://github.com/user-attachments/assets/38b19248-e9a4-4935-8013-875844c4f1ce" />

I can provide screenshots and full request/response headers if needed.

[dgraf-gh]

Hi @racheljwood,

That is an interesting find, and thank you for your analysis of the session stuff.

This suggests the memory page is opened, but the follow-up requests for route/photo data are not using the same effective session/auth context when the navigation starts from Wiki.js.

It looks like it, but then the API endpoint for the raw location points should answer with a redirect to the login page instead of returning an empty result.

Two questions:

• Are there multiple users involved? But this should answer with a 404 if you are logged in as User A and want to open the memory of User B.
• Is there any error in the log of Reitti when opening the link?

[racheljwood]

Hi, There weren't two users involved as I only have one user configured. I can try that tonight and also check the log. Many thanks for the response Regards

…

On 19/03/2026 06.10, Daniel Graf wrote: *dgraf-gh* left a comment (dedicatedcode/reitti#813) <#813 (comment)> Hi @racheljwood <https://github.com/racheljwood>, that is an interesting find and thank you for your analysis of the session stuff. This suggests the memory page is opened, but the follow-up requests for route/photo data are not using the same effective session/auth context when the navigation starts from Wiki.js. It looks like it, but then the api endpoint for the raw location points should answer with a redirect to the login page instead of return an empty result. Two questions: * are there multiple users involved? But this should answer with a 404 if ypu are logged in as User A and want to open the memory of user B * Is there any error in the log of reitti when opening the link? — Reply to this email directly, view it on GitHub <#813 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AX6MMDFFJIGBLD6WE5DSRW34RN6MBAVCNFSM6AAAAACWXA4NXOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DAOBXHA2TANRXGQ>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[racheljwood]

Hi, I may have to do some more investigation. As I logged on to wiki today and went to the link to the memory, Reitti displayed the memory and it showed the tracks! It did not however show the pictures. I hadn't changed anything since the previous investigations, so I think i have some more deducting to do. Due to a holiday, I won't be able to investigate until April but thank you for a lovely product. Rachel

…

On 19/03/2026 12.40, Rachel Wood wrote: Hi, There weren't two users involved as I only have one user configured. I can try that tonight and also check the log. Many thanks for the response Regards On 19/03/2026 06.10, Daniel Graf wrote: > *dgraf-gh* left a comment (dedicatedcode/reitti#813) > <#813 (comment)> > > Hi @racheljwood <https://github.com/racheljwood>, > > that is an interesting find and thank you for your analysis of the > session stuff. > > This suggests the memory page is opened, but the follow-up > requests for route/photo data are not using the same effective > session/auth context when the navigation starts from Wiki.js. > > It looks like it, but then the api endpoint for the raw location > points should answer with a redirect to the login page instead of > return an empty result. > > Two questions: > > * are there multiple users involved? But this should answer with a > 404 if ypu are logged in as User A and want to open the memory of > user B > * Is there any error in the log of reitti when opening the link? > > — > Reply to this email directly, view it on GitHub > <#813 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AX6MMDFFJIGBLD6WE5DSRW34RN6MBAVCNFSM6AAAAACWXA4NXOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DAOBXHA2TANRXGQ>. > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[dgraf-gh]

Thank you for your effort. I will try to reproduce it in the meantime.