fix(auth): use X-Forwarded-Host for token realm URL
When behind proxy, use X-Forwarded-Host header for the Bearer realm URL instead of the proxied Host header (localhost:5000).
- commit
- 133ff8889f05ae5f2711df154e8d4732b1b2a256
- author
- brice · · 2026-01-15 12:54 UTC
- parent
- dbdcf7e
- signature
- GPG Verified
CD88F9E564E0102646FB6077A1A07C7C7C3E349D· arch-gpg Verified for the committer email - refs
- tag: v2.2.3
1 file · +6 -1
M internal/adapters/in/http/middleware/auth.go +6 -1
| @@ -382,6 +382,11 @@ func sendUnauthorized(w http.ResponseWriter, authType domain.AuthType, host stri | |||
| 382 | 382 | switch authType { | |
| 383 | 383 | case domain.AuthTypeToken: | |
| 384 | 384 | // For token auth, indicate the token server endpoint | |
| 385 | + | // Use X-Forwarded-Host if behind proxy, otherwise use Host header | |
| 386 | + | realmHost := r.Header.Get("X-Forwarded-Host") | |
| 387 | + | if realmHost == "" { | |
| 388 | + | realmHost = host | |
| 389 | + | } | |
| 385 | 390 | // Detect scheme from request (TLS or X-Forwarded-Proto header) | |
| 386 | 391 | scheme := "http" | |
| 387 | 392 | if r.TLS != nil { | |
| @@ -389,7 +394,7 @@ func sendUnauthorized(w http.ResponseWriter, authType domain.AuthType, host stri | |||
| 389 | 394 | } else if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" { | |
| 390 | 395 | scheme = proto | |
| 391 | 396 | } | |
| 392 | - | realm := scheme + "://" + host + "/v2/token" | |
| 397 | + | realm := scheme + "://" + realmHost + "/v2/token" | |
| 393 | 398 | w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`",service="gordon-registry"`) | |
| 394 | 399 | default: | |
| 395 | 400 | w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`) | |
| @@ -382,6 +382,11 @@ func sendUnauthorized(w http.ResponseWriter, authType domain.AuthType, host stri | |||||
| 382 | switch authType { | 382 | switch authType { | ||
| 383 | case domain.AuthTypeToken: | 383 | case domain.AuthTypeToken: | ||
| 384 | // For token auth, indicate the token server endpoint | 384 | // For token auth, indicate the token server endpoint | ||
| 385 | + | // Use X-Forwarded-Host if behind proxy, otherwise use Host header | |||
| 386 | + | realmHost := r.Header.Get("X-Forwarded-Host") | |||
| 387 | + | if realmHost == "" { | |||
| 388 | + | realmHost = host | |||
| 389 | + | } | |||
| 385 | // Detect scheme from request (TLS or X-Forwarded-Proto header) | 390 | // Detect scheme from request (TLS or X-Forwarded-Proto header) | ||
| 386 | scheme := "http" | 391 | scheme := "http" | ||
| 387 | if r.TLS != nil { | 392 | if r.TLS != nil { | ||
| @@ -389,7 +394,7 @@ func sendUnauthorized(w http.ResponseWriter, authType domain.AuthType, host stri | |||||
| 389 | } else if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" { | 394 | } else if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" { | ||
| 390 | scheme = proto | 395 | scheme = proto | ||
| 391 | } | 396 | } | ||
| 392 | - | realm := scheme + "://" + host + "/v2/token" | 397 | + | realm := scheme + "://" + realmHost + "/v2/token" |
| 393 | w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`",service="gordon-registry"`) | 398 | w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`",service="gordon-registry"`) | ||
| 394 | default: | 399 | default: | ||
| 395 | w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`) | 400 | w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`) | ||