WIP: hermes: restore legacy chat/triage hosts alongside the renamed ones #40

Closed

hermes-automation wants to merge 1 commits from fix/hermes-restore-legacy-chat-triage-hosts-v3 into main

Author	SHA1	Message	Date
Hermes Agent	b2cca91b6b	hermes: derive the oauth2-proxy callback from the request host Restoring the legacy chat/triage hosts is not enough on its own: both proxies pinned --redirect-url to the renamed host, and oauth2-proxy returns that value verbatim whenever it carries a host (getOAuthRedirectURI short-circuits on redirectURL.Host != ""). A login started on a legacy host would therefore send the browser to the canonical host's callback, while the CSRF cookie stays behind: it is issued with the __Host- prefix, which forbids a Domain attribute and pins it to the exact origin. The callback lands without it and fails as "unable to find a valid CSRF token". Drop the host from both callback URLs so oauth2-proxy builds them from the request host instead. For the renamed hosts the derived value is byte-identical to the pinned one, so their behaviour is unchanged; the legacy hosts now complete a login on the host the user actually visited. Derivation reads X-Forwarded-Host only behind a trusted reverse proxy, which both deployments already declare, and Keycloak still matches the result against the redirect URIs registered by the ensure script. The agent proxy keeps its pinned callback: it serves one host. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-21 09:09:54 +00:00

Author

SHA1

Message

Date

Hermes Agent

b2cca91b6b

hermes: derive the oauth2-proxy callback from the request host

Restoring the legacy chat/triage hosts is not enough on its own: both
proxies pinned --redirect-url to the renamed host, and oauth2-proxy
returns that value verbatim whenever it carries a host
(getOAuthRedirectURI short-circuits on redirectURL.Host != ""). A login
started on a legacy host would therefore send the browser to the
canonical host's callback, while the CSRF cookie stays behind: it is
issued with the __Host- prefix, which forbids a Domain attribute and
pins it to the exact origin. The callback lands without it and fails as
"unable to find a valid CSRF token".

Drop the host from both callback URLs so oauth2-proxy builds them from
the request host instead. For the renamed hosts the derived value is
byte-identical to the pinned one, so their behaviour is unchanged; the
legacy hosts now complete a login on the host the user actually visited.
Derivation reads X-Forwarded-Host only behind a trusted reverse proxy,
which both deployments already declare, and Keycloak still matches the
result against the redirect URIs registered by the ensure script.

The agent proxy keeps its pinned callback: it serves one host.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-21 09:09:54 +00:00

WIP: hermes: restore legacy chat/triage hosts alongside the renamed ones #40

1 Commits