fix: use public origins for SSO redirects

2026-07-20 15:04:20 +05:30
parent a75779fa4d
commit 944f83d3f4
57 changed files with 138 additions and 89 deletions
@@ -93,6 +93,29 @@ test("creates a safe login redirect with an encoded returnTo URL", () => {
  );
 });

+test("relative login redirects use the configured public app origin", () => {
+  const previous = process.env.WRNEXUS_APP_ORIGIN;
+  process.env.WRNEXUS_APP_ORIGIN = "https://sso.example.test";
+  try {
+    const ctx = context("http://127.0.0.1:3002/api/verify", {
+      "x-original-host": "admin.example.test",
+      "x-original-proto": "https",
+      "x-original-uri": "/settings",
+    });
+    const response = redirectToLogin(ctx, "/sign-in", {
+      allowedHosts: ["admin.example.test"],
+    });
+    const location = new URL(response.headers.get("location")!);
+
+    expect(location.origin).toBe("https://sso.example.test");
+    expect(location.pathname).toBe("/sign-in");
+    expect(location.searchParams.get("returnTo")).toBe("https://admin.example.test/settings");
+  } finally {
+    if (previous === undefined) delete process.env.WRNEXUS_APP_ORIGIN;
+    else process.env.WRNEXUS_APP_ORIGIN = previous;
+  }
+});
+
 test("supports an allowed-host callback and custom response options", () => {
  const ctx = context("https://login.example.test/api/verify", {
    "x-forwarded-host": "reports.example.test",