Skip to content

Feat: add non-nginx ingress support via X_FORWARDED_* header support for media-auth #827

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Feat: add non-nginx ingress support via X_FORWARDED_* header support for media-auth #827

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
12f5187
feat: add traefik ingress support to media-auth
centerionware Mar 31, 2025
7e3bb20
cleanup: remove dump of all request headers to media-auth when not us…
centerionware Mar 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions src/backend/core/api/viewsets.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1182,13 +1182,18 @@ def _auth_get_original_url(self, request):
to let this request go through (by returning a 200 code) or if we block it (by returning
a 403 error). Note that we return 403 errors without any further details for security
reasons.

Traefik and other ingresses that aren't nginx don't send HTTP_X_ORIGINAL_URL but all
should send the standard X-Forwarded-* headers, fallback to that when HTTP_X_ORIGINAL_URL
is not found.
"""
# Extract the original URL from the request header
original_url = request.META.get("HTTP_X_ORIGINAL_URL")
if not original_url:
logger.debug("Missing HTTP_X_ORIGINAL_URL header in subrequest")
raise drf.exceptions.PermissionDenied()

if not request.META.get("HTTP_X_FORWARDED_URI"):
logger.debug("Missing HTTP_X_ORIGINAL_URL header and HTTP_X_FORWARDED_URI http header.")
raise drf.exceptions.PermissionDenied()
original_url = request.META.get("HTTP_X_FORWARDED_PROTO") + "://" + request.META.get("HTTP_X_FORWARDED_HOST") + request.META.get("HTTP_X_FORWARDED_URI")
logger.debug("Original url: '%s'", original_url)
return urlparse(original_url)

Expand Down