fix: preserve original host through forward auth

2026-07-13 19:56:06 +05:30
parent 0592c69f29
commit b273e30c2f
59 changed files with 167 additions and 88 deletions
@@ -135,11 +135,18 @@ export function forwardAuthFailure(res: Response, verifierUrl: string): Response
 /** Describe the original gateway request to a forward-auth verifier. */
 export function forwardAuthHeaders(req: Request): Headers {
  const original = new URL(req.url);
+  const host = req.headers.get("host") ?? original.host;
+  const protocol = original.protocol.replace(":", "");
  return new Headers({
    cookie: req.headers.get("cookie") ?? "",
    authorization: req.headers.get("authorization") ?? "",
-    "x-forwarded-host": req.headers.get("host") ?? original.host,
-    "x-forwarded-proto": original.protocol.replace(":", ""),
+    "x-forwarded-host": host,
+    "x-forwarded-proto": protocol,
+    // These survive when a verifier such as sso.localhost is routed through
+    // this gateway again. The second hop may replace X-Forwarded-Host with the
+    // verifier host, but must not lose the protected application's return URL.
+    "x-original-host": host,
+    "x-original-proto": protocol,
    "x-original-method": req.method,
    "x-original-uri": `${original.pathname}${original.search}`,
  });