mirror of
https://github.com/goauthentik/authentik.git
synced 2026-08-30 18:51:39 -07:00
fa9cce2cd6
* website: use $host instead of $http_host for proxy provider redirects. The Proxy Provider nginx recipes set the upstream Host header from $host but built X-Original-URL and the sign-in redirect (rd=) from $http_host, the raw client-supplied Host header. authentik's outpost parses that value directly (getNginxForwardUrl), so an unvalidated Host header flows into its own redirect construction. Use $host consistently, matching what the same files already do for Host. X-Forwarded-Host in the ingress-nginx snippet is left as $http_host; that's a different, informational header, not authentik's own redirect construction. * Update to deal with non-standard ports * WIP --------- Co-authored-by: Dewi Roberts <dewi@goauthentik.io> Co-authored-by: Dominic Roy <dominic@goauthentik.io>