claudio e74439b509 Auto-login from trusted reverse-proxy Authentik headers ...

When SSO_GATEWAY_SECRET is set and an incoming request carries both
X-Artifacto-Gateway (matching the secret) and X-Authentik-Username, the
admin middleware mints a session automatically so Authentik-authenticated
users skip the password form. Missing or wrong gateway header falls back
to the password-login flow, so peers that can reach the container
directly (bypassing the reverse proxy) cannot spoof Authentik identities.

2026-04-22 22:21:20 +02:00

2.4 KiB

Raw Permalink Blame History

View Raw