fix: preserve original host through forward auth

2026-07-13 19:56:06 +05:30
parent 0592c69f29
commit b273e30c2f
59 changed files with 167 additions and 88 deletions
@@ -44,6 +44,11 @@ Always list the application hosts that are valid redirect destinations. Forwarde
 headers are rejected when `allowedHosts` is absent or does not match, preventing an open
 redirect. A callback can support dynamic tenant domains:

+The SSO hostname is the login destination, not an `allowedHosts` entry. For example,
+when protecting `admin.localhost:3000`, keep `admin.localhost:3000` in the allowlist even
+though the verifier runs at `sso.localhost:3000`. WRNexus preserves both hosts across a
+nested gateway request.
+
 ```ts
 allowedHosts: (host) => host.endsWith(".example.test");
 ```