fix: preserve original host through forward auth

2026-07-13 19:56:06 +05:30
parent 0592c69f29
commit b273e30c2f
59 changed files with 167 additions and 88 deletions
@@ -35,6 +35,28 @@ test("reconstructs an allowed original gateway URL", () => {
  expect(getOriginalRequestMethod(ctx)).toBe("GET");
 });

+test("keeps the protected app URL when the SSO verifier crosses the gateway again", () => {
+  const ctx = context("http://sso.localhost:3000/api/verify", {
+    "x-forwarded-host": "sso.localhost:3000",
+    "x-forwarded-proto": "http",
+    "x-original-host": "admin.localhost:3000",
+    "x-original-proto": "http",
+    "x-original-method": "GET",
+    "x-original-uri": "/settings?tab=security",
+  });
+
+  const response = redirectToLogin(ctx, "/login", {
+    allowedHosts: ["admin.localhost:3000"],
+  });
+  const location = new URL(response.headers.get("location")!);
+
+  expect(location.origin).toBe("http://sso.localhost:3000");
+  expect(location.pathname).toBe("/login");
+  expect(location.searchParams.get("returnTo")).toBe(
+    "http://admin.localhost:3000/settings?tab=security",
+  );
+});
+
 test("rejects untrusted hosts and unsafe request paths", () => {
  const untrusted = context("http://sso.localhost/api/verify", {
    "x-forwarded-host": "evil.example",