From 2e5005d7dfb2ee751d59c939b98a3c76d244bfa3 Mon Sep 17 00:00:00 2001
From: Stanislav Chzhen <s.chzhen@adguard.com>
Date: Thu, 28 Aug 2025 19:32:53 +0300
Subject: [PATCH] Pull request 2457: 7987-fix-ratelimiter

Updates #7987.

Squashed commit of the following:

commit ea0c8137bec2cbe0f8c8de8818f325c3d1c4fce7
Merge: 00e992b17 146b6dd09
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Thu Aug 28 19:21:19 2025 +0300

    Merge branch 'master' into 7987-fix-ratelimiter

commit 00e992b175f72d5ed70adc5e00a40c64e1b73ae3
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Tue Aug 26 15:31:31 2025 +0300

    home: imp code

commit 2fdb14b57918948a2b63501b7cc74970f7e72f03
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Mon Aug 25 20:24:57 2025 +0300

    all: fix ratelimiter
---
 CHANGELOG.md              | 2 ++
 internal/home/authhttp.go | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f88c2f0..b94937ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,10 +20,12 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Fixed
 
+- Authentication errors in the Web UI when AdGuard Home is behind a proxy that sets Basic Auth headers ([#7987]).
 - The HTTP API `GET /control/profile` endpoint failing when no users were configured ([#7985]).
 - Missing warning on the *Encryption Settings* page when using a certificate without an IP address.
 
 [#7985]: https://github.com/AdguardTeam/AdGuardHome/issues/7985
+[#7987]: https://github.com/AdguardTeam/AdGuardHome/issues/7987
 
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
diff --git a/internal/home/authhttp.go b/internal/home/authhttp.go
index e5517933..ac3a923f 100644
--- a/internal/home/authhttp.go
+++ b/internal/home/authhttp.go
@@ -506,9 +506,10 @@ func (mw *authMiddlewareDefault) userFromRequestBasicAuth(
 		return nil, fmt.Errorf("login attempt blocked for %s", left)
 	}
 
-	rateLimiter.inc(remoteIP)
 	defer func() {
 		if err != nil {
+			rateLimiter.inc(remoteIP)
+
 			return
 		}