Acknowledging single alerts fails

[Twilek-de]

I have a strange bug/behaviour. Acknowledging single alerts fails. Acknowledging all works.

Bildschirmaufnahme.2026-01-03.130624.mp4

[pulse-triage]

Thanks for the video. I tested this on v5.0.10 and single acknowledge works correctly for me.

To help diagnose:

1. What Pulse version are you running? (Settings → About, or check the Docker image tag)
2. Can you open browser DevTools (F12), go to the Network tab, click the Acknowledge button, and share what request/response you see for the failing call?

The Network tab will show the exact URL being called and any error response from the server.

---

Posted by automated triage. Feel free to reopen if this needs further attention.

[Twilek-de]

1. 5.0.10 But the error was there long before that.
2. As the "Unacknowledge" doesn´t work as well, I give you that output:

XHRPOST
https://pulse.*redacted*.de/api/alerts/docker-container-state-docker:513745bf-7c5e-43f1-b8d2-2d3fd6wer2354c4/0077e7ab4f1be6167b84bd0e9987d3697b84624e3374decf7be331edcea50128/unacknowledge
[HTTP/2 400  2ms]

	
POST
	https://pulse.*redacted*.de/api/alerts/docker-container-state-docker%3A513745bf-7c5e-43f1-b8d2-2d3fd6235fwee4c4%2F0077e7ab4f1be6167b84bd0e9987d3697b84624e3374decf7be331edcea50128/unacknowledge
Status
400
VersionHTTP/2
Übertragen91 B (0 B Größe)
Referrer Policystrict-origin-when-cross-origin
Anfrage-PrioritätHighest
DNS-AuflösungSystem

    	
    content-length
    	0
    date
    	Sat, 03 Jan 2026 12:53:39 GMT
    X-Firefox-Spdy
    	h2
    	
    Accept
    	application/json
    Accept-Encoding
    	gzip, deflate, br, zstd
    Accept-Language
    	de,en-US;q=0.7,en;q=0.3
    Connection
    	keep-alive
    Content-Length
    	0
    Content-Type
    	application/json
    Cookie

ph_phc_VOdeYnlevc2T63m3myFGfgjeBlRcIusRgmhfx6XL5a1iz_posthog=%7B%22distinct_id%22%3A%22019adb70-8d5f-7b10-8933-8da30e713e5a%22%7D; refresh_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJ1cG4iOiJoZW5uaW5nQHJldHpnZW4uZGUiLCJzdWIiOiI5MzgwZTc3Zi0xNWUxLTQyZjUtYmM0OS1mMGFmNWYzMGU3Y2IiLCJncm91cHMiOlsifgVVNFUiJdLCJ0eXBlIjoicmVmcmVzaCIsInVzZXJJZCI6IjkzODBlNzdmLTE1ZTEtNDJmNS1iYzQ5LWYwYWY1ZjMwZTdjYiIsImlhdCI6MTc2NzQyODgzNSwiZXhwIjoxNzY4MDMzNjM1LCJqdGkiOfgiJhZjFkZGI0NS1kYzJhLTQ2MzAtOTI0Zi0xMWE3YjQ5MWQxNzMifQ.BiHmi3YsWt-SgVs3LTvBGRIeeDF4CWRHsCQt7HPtyBRgCyeJgGq_x-BchIb08wvIX-8TOI8ovUvb1_kVTjLJn0qmUsMhALTUaUFh9-TZRit2i7Il81VkkX2S6Jh9ym0EhuBxj34nrO4-UI0x1kF3c_9Zz9loHwa4WHXcxfm8Lo276o1hK9RFIVKqJi21Ok1j1eDJnnvL3uLQ8lBzOrxRm8uF1jfihzPLKevfKT5qF_9xVbzXNBrQcLT82Oi5tYrQvF3vGCWl_vOEhLrE_d8F7QyNO3N_lgfdq8pKCUG3cAs1ofybZd4TMTbf9nLQlQCAIaKHxWLo-zNvijxkvuQ1k2jw; pulse_session=35be35e26badcaf0e6cfcfga3cf76a39a372d2401975419db824112b841de31263; pulse_csrf=e49gaLTyXYCuFVFoHl8fggbz9diqZ9dFots4VcovIYBMY=
    Host
    	pulse.*redacted*.de
    Origin
    	https://pulse.*redacted*.de
    Priority
    	u=0
    Referer
    	https://pulse.*redacted*.de/alerts/overview
    Sec-Fetch-Dest
    	empty
    Sec-Fetch-Mode
    	cors
    Sec-Fetch-Site
    	same-origin
    TE
    	trailers
    User-Agent
    	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0
    X-CSRF-Token
    	e49gaLTyXYCuFVFoHl8gsdfsdbz9diqZ9dFots4VcovIYBMY=
    X-Requested-With
    	XMLHttpRequest

XHRPOST
https://pulse.*redacted*.de/api/alerts/docker-container-state-docker:513745bf-7c5e-43f1-b8d2-2d3fd62354c4/0077e7ab4f1be6167b84bd0e9987d3697b84624e3374decf7be331edcea50128/unacknowledge
[HTTP/2 400  2ms]

[ERROR] Failed to unacknowledge alert: Error: Request failed with status 400
    fetchJSON https://pulse.*redacted*.de/assets/index-BnD8k9cZ.js:2
    de https://pulse.*redacted*.de/assets/index-BnD8k9cZ.js:2
    unacknowledge https://pulse.*redacted*.de/assets/index-BnD8k9cZ.js:7
    Wc/get children/get children/children/P.$$click https://pulse.*redacted*.de/assets/Alerts-CsXTSB8_.js:85
    a https://pulse.*redacted*.de/assets/index-BnD8k9cZ.js:2
    ol https://pulse.*redacted*.de/assets/index-BnD8k9cZ.js:2
index-BnD8k9cZ.js:2:46876

[pulse-triage]

The alert ID contains a forward slash (/) which the frontend URL-encodes as %2F. Looking at your response headers, the content-length: 0 with 400 status suggests the request is being rejected before it reaches Pulse - likely by Caddy.

Caddy (and many reverse proxies) reject paths containing %2F by default as a security measure against path traversal.

To confirm:

1. Can you try accessing Pulse directly (not through Caddy) and see if single acknowledge works?
2. If you're using Caddy, check if there's a uri directive or try adding this to your Caddyfile:

   uri path_regexp %2[fF] /
   

   This tells Caddy to decode %2F before proxying.

Alternatively, share your Caddyfile (redact any secrets) and I can suggest the specific fix.

---

Automated triage.

[Twilek-de]

I use traefik. When I connect directly to the container it works. I have no traefik middleware configured that would touch the URL. The only thing is a middleware which adds hsts headers.

This is my compose file for pulse with the traefik labels:

services:
  pulse:
    image: rcourtman/pulse:latest
    container_name: pulse
    volumes:
      - ./pulse_data:/data
    restart: unless-stopped
    ports:
      - 7655:7655
    labels:
      - traefik.enable=true
      - traefik.http.routers.pulse.entrypoints=http
      - traefik.http.routers.pulse.rule=Host(`pulse.*redacted*.de`) || Host(`*redacted*.de`)
      - traefik.http.routers.pulse.middlewares=https-redirect@file
      - traefik.http.routers.pulse-secure.entrypoints=https
      - traefik.http.routers.pulse-secure.rule=Host(`pulse.*redacted*.de`) || Host(`*redacted*.de`)
      - traefik.http.routers.pulse-secure.middlewares=hsts@file
      - traefik.http.routers.pulse-secure.tls=true
      - traefik.http.routers.pulse-secure.tls.certresolver=*redacted*
      - traefik.http.routers.pulse-secure.tls.domains[0].main=*redacted*.de
      - traefik.http.routers.pulse-secure.tls.domains[0].sans=*.*redacted*.de
      - traefik.http.routers.pulse-secure.service=pulse
      - traefik.http.services.pulse.loadbalancer.server.port=7655
      - traefik.docker.network=proxy


networks:
  default:
    name: proxy
    external: true

Traefik config.yml

http:
  middlewares:
    https-redirect:
      redirectScheme:
        scheme: https

    hsts:
      headers:
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true
        forceSTSHeader: true
        sslRedirect: true
        stsPreload: true
        stsSeconds: 315360000
        stsIncludeSubdomains: true
        customFrameOptionsValue: "SAMEORIGIN"


tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

Traefik traefik.yml

api:
  dashboard: true

entryPoints:
  http:
    address: ":80"
    http:
  https:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: 30m
    http:

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: /config.yml

certificatesResolvers:
  http:
    acme:
      email: xxx@xxx.de
      storage: acme.json
      httpChallenge:
        entryPoint: http
  netcup:
    acme:
      email: xxx@xxx.de
      storage: acme.json
      dnsChallenge:
        provider: redacted
        delayBeforeCheck: 1800
        resolvers:
          - "redacted.net"
          - "redacted.net"
          - "redacted.net"
log:
  level: "INFO"
  filePath: "/var/log/traefik/traefik.log"

I don´t see any problematic entries

[rcourtman]

Thanks for the config - that confirmed it's a Traefik URL normalization issue.

Rather than requiring reverse proxy config changes, pushed a fix (cf8145e) that changes how the frontend calls the API. Alert IDs are now sent in the request body instead of the URL path, avoiding the %2F encoding issue entirely.

This should work with Traefik, Caddy, nginx, and any other reverse proxy without configuration changes. Would appreciate confirmation once you can test the next release.

[pulse-triage]

The fix from cf8145e is included in the latest version. The API endpoints for acknowledge/unacknowledge now accept alert IDs in the request body instead of the URL path, avoiding reverse proxy encoding issues.

Please update and verify the fix works for you.

---

Closed by automated triage. Feel free to reopen if this needs further attention.

[Twilek-de]

Just updated. Seems do work.