fix: use public origins for SSO redirects

This commit is contained in:
2026-07-20 15:04:20 +05:30
parent a75779fa4d
commit 944f83d3f4
57 changed files with 138 additions and 89 deletions
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ai",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "Zero-dependency Claude (Anthropic) client for WrNexus apps.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/authz",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/authz — part of the WrNexus framework.",
"license": "MIT",
+11 -11
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/cli",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/cli — part of the WrNexus framework.",
"license": "MIT",
@@ -28,16 +28,16 @@
"wrnexus": "./dist/index.js"
},
"dependencies": {
"@wrnexus/core": "^0.2.70",
"@wrnexus/router": "^0.2.70",
"@wrnexus/csr": "^0.2.70",
"@wrnexus/compiler": "^0.2.70",
"@wrnexus/styles": "^0.2.70",
"@wrnexus/dev-server": "^0.2.70",
"@wrnexus/ui": "^0.2.70",
"@wrnexus/validation": "^0.2.70",
"@wrnexus/i18n": "^0.2.70",
"@wrnexus/db": "^0.2.70"
"@wrnexus/core": "^0.2.71",
"@wrnexus/router": "^0.2.71",
"@wrnexus/csr": "^0.2.71",
"@wrnexus/compiler": "^0.2.71",
"@wrnexus/styles": "^0.2.71",
"@wrnexus/dev-server": "^0.2.71",
"@wrnexus/ui": "^0.2.71",
"@wrnexus/validation": "^0.2.71",
"@wrnexus/i18n": "^0.2.71",
"@wrnexus/db": "^0.2.71"
},
"files": [
"dist"
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/compiler",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/compiler — part of the WrNexus framework.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/core",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/core — part of the WrNexus framework.",
"license": "MIT",
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/csr",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/csr — part of the WrNexus framework.",
"license": "MIT",
@@ -21,7 +21,7 @@
}
},
"dependencies": {
"@wrnexus/core": "^0.2.70"
"@wrnexus/core": "^0.2.71"
},
"files": [
"dist"
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/db",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/db — part of the WrNexus framework.",
"license": "MIT",
+13 -13
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/dev-server",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/dev-server — part of the WrNexus framework.",
"license": "MIT",
@@ -25,18 +25,18 @@
}
},
"dependencies": {
"@wrnexus/core": "^0.2.70",
"@wrnexus/router": "^0.2.70",
"@wrnexus/ssr": "^0.2.70",
"@wrnexus/csr": "^0.2.70",
"@wrnexus/compiler": "^0.2.70",
"@wrnexus/styles": "^0.2.70",
"@wrnexus/ui": "^0.2.70",
"@wrnexus/validation": "^0.2.70",
"@wrnexus/i18n": "^0.2.70",
"@wrnexus/db": "^0.2.70",
"@wrnexus/pubsub": "^0.2.70",
"@wrnexus/uploader": "^0.2.70"
"@wrnexus/core": "^0.2.71",
"@wrnexus/router": "^0.2.71",
"@wrnexus/ssr": "^0.2.71",
"@wrnexus/csr": "^0.2.71",
"@wrnexus/compiler": "^0.2.71",
"@wrnexus/styles": "^0.2.71",
"@wrnexus/ui": "^0.2.71",
"@wrnexus/validation": "^0.2.71",
"@wrnexus/i18n": "^0.2.71",
"@wrnexus/db": "^0.2.71",
"@wrnexus/pubsub": "^0.2.71",
"@wrnexus/uploader": "^0.2.71"
},
"files": [
"dist"
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/encryption",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/encryption — part of the WrNexus framework.",
"license": "MIT",
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/helpers",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "Safe convenience helpers for WrNexus request contexts and common application flows.",
"license": "MIT",
@@ -21,7 +21,7 @@
}
},
"dependencies": {
"@wrnexus/core": "^0.2.70"
"@wrnexus/core": "^0.2.71"
},
"files": [
"dist"
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/i18n",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/i18n — part of the WrNexus framework.",
"license": "MIT",
@@ -21,7 +21,7 @@
}
},
"dependencies": {
"@wrnexus/core": "^0.2.70"
"@wrnexus/core": "^0.2.71"
},
"files": [
"dist"
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/jwt",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/jwt — part of the WrNexus framework.",
"license": "MIT",
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/mobile",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/mobile — part of the WrNexus framework.",
"license": "MIT",
@@ -21,7 +21,7 @@
}
},
"dependencies": {
"@wrnexus/native": "^0.2.70"
"@wrnexus/native": "^0.2.71"
},
"files": [
"dist"
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/native",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/native — part of the WrNexus framework.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/oauth",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/oauth — part of the WrNexus framework.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/pubsub",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/pubsub — part of the WrNexus framework.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/queue",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/queue — part of the WrNexus framework.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/reactive",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/reactive — part of the WrNexus framework.",
"license": "MIT",
+3 -3
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/router",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/router — part of the WrNexus framework.",
"license": "MIT",
@@ -21,8 +21,8 @@
}
},
"dependencies": {
"@wrnexus/compiler": "^0.2.70",
"@wrnexus/core": "^0.2.70"
"@wrnexus/compiler": "^0.2.71",
"@wrnexus/core": "^0.2.71"
},
"files": [
"dist"
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ssr",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/ssr — part of the WrNexus framework.",
"license": "MIT",
@@ -21,7 +21,7 @@
}
},
"dependencies": {
"@wrnexus/core": "^0.2.70"
"@wrnexus/core": "^0.2.71"
},
"files": [
"dist"
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/styles",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/styles — part of the WrNexus framework.",
"license": "MIT",
@@ -21,7 +21,7 @@
}
},
"dependencies": {
"@wrnexus/uploader": "^0.2.70"
"@wrnexus/uploader": "^0.2.71"
},
"files": [
"dist"
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/test",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/test — part of the WrNexus framework.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/tracking",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/tracking — part of the WrNexus framework.",
"license": "MIT",
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ui",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/ui — part of the WrNexus framework.",
"license": "MIT",
@@ -25,7 +25,7 @@
"./ui.css": "./ui.css"
},
"dependencies": {
"@wrnexus/core": "^0.2.70"
"@wrnexus/core": "^0.2.71"
},
"files": [
"dist",
+2 -2
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/uploader",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/uploader — part of the WrNexus framework.",
"license": "MIT",
@@ -21,7 +21,7 @@
}
},
"dependencies": {
"@wrnexus/core": "^0.2.70"
"@wrnexus/core": "^0.2.71"
},
"files": [
"dist"
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/validation",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"description": "@wrnexus/validation — part of the WrNexus framework.",
"license": "MIT",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ai",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"description": "Zero-dependency Claude (Anthropic) client for WrNexus apps.",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/authz",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/cli",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+9
View File
@@ -707,6 +707,15 @@ const MIGRATIONS: Migration[] = [
if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8");
},
},
{
version: "0.2.71",
id: "public-forward-auth-redirect-origins",
description:
"Builds SSO redirects and returnTo URLs from configured public app origins instead of internal gateway listeners.",
apply() {
// Public URL handling improves automatically after updating and rebuilding.
},
},
];
/** Release tooling uses this to require an explicit migration entry per version. */
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/compiler",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/core",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/csr",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/db",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/dev-server",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+8 -4
View File
@@ -166,10 +166,13 @@ export function forwardAuthFailure(res: Response, verifierUrl: string): Response
}
/** Describe the original gateway request to a forward-auth verifier. */
export function forwardAuthHeaders(req: Request): Headers {
export function forwardAuthHeaders(req: Request, publicOrigin?: string): Headers {
const original = new URL(req.url);
const host = req.headers.get("host") ?? original.host;
const protocol = original.protocol.replace(":", "");
const protocol = (publicOrigin ? new URL(publicOrigin).protocol : original.protocol).replace(
":",
"",
);
return new Headers({
cookie: req.headers.get("cookie") ?? "",
authorization: req.headers.get("authorization") ?? "",
@@ -194,6 +197,7 @@ async function checkAuth(
req: Request,
ip: string,
internalOrigins: Readonly<Record<string, string>>,
publicOrigin?: string,
): Promise<Response | null> {
if (!auth) return null;
@@ -225,7 +229,7 @@ async function checkAuth(
try {
const res = await fetch(verifyUrl, {
headers: forwardAuthHeaders(req),
headers: forwardAuthHeaders(req, publicOrigin),
redirect: "manual",
});
if (!res.ok) {
@@ -492,7 +496,7 @@ export async function startGateway(opts: GatewayOptions): Promise<RunningGateway
}
// Per-app access control (basic auth / IP allowlist / forward-auth).
const denied = await checkAuth(target.auth, req, ip, internalOrigins);
const denied = await checkAuth(target.auth, req, ip, internalOrigins, target.publicOrigin);
if (denied) {
if (sec.accessLog)
console.log(
+12
View File
@@ -85,6 +85,18 @@ test("forward auth describes the original gateway request", () => {
expect(headers.get("authorization")).toBe("Bearer token");
});
test("forward auth uses the protected app public protocol", () => {
const headers = forwardAuthHeaders(
new Request("http://127.0.0.1:10050/settings", {
headers: { host: "admin.wrnx.in" },
}),
"https://admin.wrnx.in",
);
expect(headers.get("x-original-host")).toBe("admin.wrnx.in");
expect(headers.get("x-original-proto")).toBe("https");
});
test("nested SSO proxy keeps the protected app's original request headers", () => {
const authHeaders = forwardAuthHeaders(
new Request("http://admin.localhost:3000/settings", {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/encryption",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/helpers",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"description": "Safe convenience helpers for WrNexus request contexts and common application flows.",
+2 -1
View File
@@ -6,6 +6,7 @@
*/
import type { Context } from "@wrnexus/core";
import { currentAppOrigin } from "./workspace.ts";
export type RequestContext = Pick<Context, "req" | "url">;
@@ -127,7 +128,7 @@ export function redirectToLogin(
loginUrl: string | URL,
options: LoginRedirectOptions = {},
): Response {
const target = new URL(loginUrl, ctx.url.origin);
const target = new URL(loginUrl, `${currentAppOrigin() ?? ctx.url.origin}/`);
if (target.protocol !== "http:" && target.protocol !== "https:") {
throw new TypeError("Login URL must use http or https");
}
+23
View File
@@ -93,6 +93,29 @@ test("creates a safe login redirect with an encoded returnTo URL", () => {
);
});
test("relative login redirects use the configured public app origin", () => {
const previous = process.env.WRNEXUS_APP_ORIGIN;
process.env.WRNEXUS_APP_ORIGIN = "https://sso.example.test";
try {
const ctx = context("http://127.0.0.1:3002/api/verify", {
"x-original-host": "admin.example.test",
"x-original-proto": "https",
"x-original-uri": "/settings",
});
const response = redirectToLogin(ctx, "/sign-in", {
allowedHosts: ["admin.example.test"],
});
const location = new URL(response.headers.get("location")!);
expect(location.origin).toBe("https://sso.example.test");
expect(location.pathname).toBe("/sign-in");
expect(location.searchParams.get("returnTo")).toBe("https://admin.example.test/settings");
} finally {
if (previous === undefined) delete process.env.WRNEXUS_APP_ORIGIN;
else process.env.WRNEXUS_APP_ORIGIN = previous;
}
});
test("supports an allowed-host callback and custom response options", () => {
const ctx = context("https://login.example.test/api/verify", {
"x-forwarded-host": "reports.example.test",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/i18n",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/jwt",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/mobile",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/native",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/oauth",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/pubsub",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/queue",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/reactive",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/router",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ssr",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/styles",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/test",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/tracking",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ui",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/uploader",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/validation",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",