lundberg/porchlight
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Implement forward-auth #2

Merged
lundberg merged 2 commits from lundberg_forward_auth into main 2026-07-04 22:02:51 +00:00
Conversation 0 Commits 2 Files changed 9 +711 -1
lundberg commented 2026-07-04 22:02:23 +00:00
Owner
Copy link
No description provided.
lundberg added 2 commits 2026-07-04 22:02:23 +00:00 
Add a /forward-auth endpoint that validates the existing Porchlight
session for reverse proxies and returns identity headers for
authenticated active users. Unauthenticated or inactive sessions
redirect to login, with optional post-login return targets reconstructed
from proxy headers and constrained by an allowed host list.

Also add forward_auth_allowed_redirect_hosts configuration, preserve
validated forward-auth return targets through login/session reset,
exempt the endpoint from CSRF for proxy subrequests, document
configuration, and cover the flow with tests.
Harden forward-auth redirect and header handling
All checks were successful
publish-latest / docker (push) Successful in 22s
Details
6b6ff29b9a 
Tighten forward-auth return URL validation to reject unsafe host syntax,
including backslash-based browser/parser mismatches, and normalize
scheme/port matching so bare allowlist entries are HTTPS default-port
only. Support explicit scheme-qualified targets, including IPv6
host:port entries.

Always emit deterministic identity headers with empty values when
attributes are absent, zero unsafe header values, and clear stale
forward-auth return targets when OIDC or registration flows take
precedence.

Add regression coverage for wildcard redirect bypasses, scheme/port
handling, IPv6 allowlist entries, empty identity headers, unsafe header
values, and stale return-target cleanup. Update docs with proxy
header-stripping guidance and the new allowlist semantics.
lundberg merged commit 6b6ff29b9a into main 2026-07-04 22:02:51 +00:00
lundberg deleted branch lundberg_forward_auth 2026-07-04 22:02:51 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lundberg/porchlight#2
No description provided.
Delete branch "lundberg_forward_auth"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?