Repository navigation
Fix SSO behind Cloudflare and stale dashboard assets after upgrade - #201
Merged
Merged
Conversation
…hour The asset URLs are not versioned, so Cache-Control: public, max-age=3600 kept browsers (and CDNs in front) on the previous release's app.js after an upgrade - e.g. the login page showed no SSO button although the server reported SSO as enabled. Serve everything no-cache; unchanged files cost an ETag 304. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Rdb1HFXbXk2xeKrJkzdvb
urllib's default Python-urllib/3.x is rejected by Cloudflare's Browser Integrity Check (error 1010), so SSO could not even fetch the discovery document when authentik sits behind Cloudflare. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Rdb1HFXbXk2xeKrJkzdvb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two fixes found while setting up authentik SSO on a deployment behind Cloudflare.
OIDC client sends a HiveHub User-Agent
server/oidc.pyusedurllibwithout aUser-Agent, so every call to the identity provider went out asPython-urllib/3.x. Cloudflare's Browser Integrity Check rejects that signature (error 1010,browser_signature_banned), so "Sign in with authentik" failed before the discovery document could even be fetched:Discovery, token and JWKS requests now send
User-Agent: HiveHub/<SERVER_VERSION> (OpenID Connect client).Dashboard assets revalidate on every load
The dashboard's JS/CSS were served with
Cache-Control: public, max-age=3600, but their URLs are not versioned. After an upgrade, browsers (and CDNs in front, whichpublicallows) kept serving the previous release'sapp.js— here a login page without the SSO button although/api/v1/local/auth/statusalready reportedsso.enabled: true. All dashboard files are nowno-cache: the copy stays cached, but is revalidated by ETag (unchanged files cost a 304), so a deploy shows up on the next load.Testing
pytest test-data/test_oidc_sso.py: 23 passed._http_jsonsends the newUser-Agent. Not tested against Cloudflare itself (the test environment could not reach the real host).index.html,sw.js,assets/app.jsandassets/style.cssreturnCache-Control: no-cache, and that a conditional request with the ETag returns 304.Deployments that already serve the old
app.jsfrom a CDN cache still need one cache purge after upgrading.🤖 Generated with Claude Code
https://claude.ai/code/session_018Rdb1HFXbXk2xeKrJkzdvb
Generated by Claude Code