Skip to content

Refactor certificate operations to use relative URL paths - #1231

Merged
shibayan merged 1 commit into
masterfrom
202-location-relative
Jul 30, 2026
Merged

Refactor certificate operations to use relative URL paths#1231
shibayan merged 1 commit into
masterfrom
202-location-relative

Conversation

@shibayan

Copy link
Copy Markdown
Member

This pull request updates how HTTP 202 Accepted responses are handled for certificate issuance and renewal operations. The main change is switching from using AcceptedAtFunction to Accepted with a route URL, and clarifying the documentation about the Location header. This ensures that clients receive a fully resolved URL for polling operation status, improving API usability and consistency.

API Response Handling:

  • Updated AddCertificate.cs, RenewCertificate.cs, and GetOperation.cs to use Accepted(Url.RouteUrl(...)) instead of AcceptedAtFunction(...), ensuring the Location header contains a properly resolved route URL for operation polling. [1] [2] [3]

Documentation:

  • Clarified in docs/reference/api.md that the Location header returned from certificate operations is a relative path and should be resolved against the endpoint called.

Fixes #1227

@shibayan shibayan self-assigned this Jul 30, 2026
Copilot AI review requested due to automatic review settings July 30, 2026 11:08
@shibayan shibayan added the bug Something isn't working label Jul 30, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refactors the HTTP 202 Accepted responses for certificate issuance/renewal and operation-status polling so the Location header is generated via a route URL (intended to avoid leaking an internal host when behind a reverse proxy), and updates the API reference to clarify how clients should interpret the Location header.

Changes:

  • Updated AddCertificate, RenewCertificate, and GetOperation to return Accepted(Url.RouteUrl(...)) instead of AcceptedAtFunction(...) so Location can be a host-less URL.
  • Updated API documentation to clarify that the Location header should be treated as a relative path to be resolved by the caller.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File Description
src/Acmebot.App/Functions/Http/AddCertificate.cs Generates the operation polling Location via Url.RouteUrl for issuance requests.
src/Acmebot.App/Functions/Http/RenewCertificate.cs Generates the operation polling Location via Url.RouteUrl for renewal requests.
src/Acmebot.App/Functions/Http/GetOperation.cs Returns 202 with Location pointing to the operation polling route while pending/running.
docs/reference/api.md Documents that the Location header is a relative path that should be resolved by clients.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/Acmebot.App/Functions/Http/AddCertificate.cs
Comment thread src/Acmebot.App/Functions/Http/RenewCertificate.cs
Comment thread src/Acmebot.App/Functions/Http/GetOperation.cs
@shibayan
shibayan merged commit 1b7d2eb into master Jul 30, 2026
11 checks passed
@shibayan
shibayan deleted the 202-location-relative branch July 30, 2026 11:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Dashboard operation status polling uses internal Host header instead of public-facing hostname when behind a reverse proxy

2 participants