Repository navigation
fix(ui): preserve post-login redirect target through oauth2-proxy sign-in - #2532
Merged
EItanya merged 4 commits intoSep 4, 2026
Merged
Conversation
…n-in When oauth2-proxy intercepts an unauthenticated request it serves its sign-in page carrying the original destination as `.Redirect` (e.g. `/oauth2/sign_in?rd=%2Fagents%2Ffoo`). `sign_in.html` template ignored that and unconditionally redirected to `/login`, and `/login`'s "Sign in with SSO" link was hardcoded to `rd=/` -- so any login, expired- cookie or not, always landed back on the home page instead of the page the user was trying to reach. Signed-off-by: Brian Fox <[email protected]>
onematchfox
changed the title
oauth2-proxy sign-in
github-actions
Bot
added
bug
Adds env var to `oauth2-proxy`'s `Deployment` to ensure that it rolls out when content is updated. The vendored chart's `Deployment` doesn't support a checksum/config-style pod annotation for extra mounted ConfigMaps. Signed-off-by: Brian Fox <[email protected]>
onematchfox
force-pushed
the
fix-preserve-login-url
branch
from
August 24, 2026 11:15
8cfcd0e to
27fdd5f
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes lost post-auth navigation by preserving the original destination (rd) across the oauth2-proxy sign-in flow and the UI’s /login page, so users land back on the page they initially requested (instead of always returning to /).
Changes:
- Added a
sanitizeRedirecthelper (with Jest tests) to prevent open-redirect stylerdvalues and ensure only safe same-origin paths are forwarded. - Updated the
/loginpage to readrdfrom query params, sanitize it, and pass it through to the “Sign in with SSO” link. - Updated the Helm oauth2-proxy sign-in template to forward oauth2-proxy’s
.Redirectinto/login?rd=..., and added a values-driven checksum env var intended to force a rollout when the template content changes.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| ui/src/lib/loginRedirect.ts | Adds redirect-target sanitization logic to safely preserve post-login destinations. |
| ui/src/lib/tests/loginRedirect.test.ts | Covers sanitizer behavior for safe paths and common open-redirect vectors. |
| ui/src/app/login/page.tsx | Threads sanitized rd through the SSO start link so login returns users to their original page. |
| helm/kagent/values.yaml | Adds an env var intended to change on template updates to trigger oauth2-proxy redeploys. |
| helm/kagent/templates/oauth2-proxy-templates.yaml | Switches ConfigMap body to a named helper template to support hashing and reuse. |
| helm/kagent/templates/_helpers.tpl | Defines the oauth2-proxy sign_in.html body that forwards .Redirect to /login?rd=.... |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
jjamroga
reviewed
Aug 26, 2026
Signed-off-by: Brian Fox <[email protected]>
onematchfox
force-pushed
the
fix-preserve-login-url
branch
from
August 27, 2026 11:24
dd2c510 to
2b4071a
Compare
Charlesthebird
requested changes
Sep 3, 2026
Charlesthebird
left a comment
Charlesthebird
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for adding this! Just had one change request.
Co-authored-by: Nicholas Bucher <[email protected]> Signed-off-by: Brian Fox <[email protected]>
Charlesthebird
approved these changes
Sep 4, 2026
Charlesthebird
enabled auto-merge (squash)
September 4, 2026 13:55
EItanya
disabled auto-merge
September 4, 2026 14:28
EItanya
pushed a commit
that referenced
this pull request
Sep 4, 2026
…ign-in (#2533) #2532 - against main Signed-off-by: Brian Fox <[email protected]>
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
kagent 0.10.0 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre><!-- Release notes generated using configuration in .github/release.yml at v0.10.0 --> ## What's Changed ### Features * feat(streaming): configurable nginx, controller, and UI inactivity ti… by @yanivmn in kagent-dev/kagent#1973 * feat(helm): add controller service annotations by @anthonyhaussman in kagent-dev/kagent#2088 * feat: enable sharing of chat sessions by @onematchfox in kagent-dev/kagent#1935 * feat: substrate support for BYO and python runtimes for SandboxAgent CR by @jmhbh in kagent-dev/kagent#2043 * feat(substrate): bump agent substrate to 0.0.7 by @supreme-gg-gg in kagent-dev/kagent#2109 * feat(substrate): bump agent substrate to 0.0.8 by @jjamroga in kagent-dev/kagent#2140 * feat(helm/kagent): support deployment annotations by @anthonyhaussman in kagent-dev/kagent#2143 * feat: add nodeSelector support to agent helm charts by @the-mentor in kagent-dev/kagent#2145 * feat: expose icon, provider, documentation URL and version on agent A2A card by @QuentinBisson in kagent-dev/kagent#2188 * feat: add claude ACP sandbox target by @the-mentor in kagent-dev/kagent#2189 * feat(sandbox-agents): Store session state in `durableDir` volume for declarative sandbox agents by @jmhbh in kagent-dev/kagent#2171 * feat(helm): add UI HTTPRoute by @younsl in kagent-dev/kagent#2165 * feat(helm): bump bundled oauth2-proxy subchart to ~10.7.0 by @elihai-risk in kagent-dev/kagent#2254 * feat: default nodeSelector for agent deployments (--default-agent-node-selector) by @elihai-risk in kagent-dev/kagent#2259 * feat(helm): add podLabels for controller and UI pod templates by @elihai-risk in kagent-dev/kagent#2237 * feat(helm): add extraObjects for arbitrary manifests by @younsl in kagent-dev/kagent#2174 * feat(ui-test): Playwright ui tests foundation stage 0 by @cjlg-soloio in kagent-dev/kagent#2262 * feat: allow read-only shares to read A2A tasks by @QuentinBisson in kagent-dev/kagent#2191 * feat(controller): make Go (ADK) runtime agent image independently configurable by @QuentinBisson in kagent-dev/kagent#2021 * feat(helm): allow custom annotations on the default ModelConfig by @marians in kagent-dev/kagent#2201 * feat(ui-test): Playwright UI E2E suite — helpers + feature flows (stage 2) by @cjlg-soloio in kagent-dev/kagent#2264 * feat: serve A2A ListTasks from the task store by @QuentinBisson in kagent-dev/kagent#2187 * feat(models): add maxCompletionTokens for OpenAI by @anthonytwh in kagent-dev/kagent#2175 * feat(models): wire maxOutputTokens for native Gemini and Vertex by @anthonytwh in kagent-dev/kagent#2147 * feat: add envFrom support to agent deployment spec by @uncycler in kagent-dev/kagent#2321 * feat: add native AWS Bedrock Guardrails support to ModelConfig by @sanskar-singh-2403 in kagent-dev/kagent#2323 * feat(bedrock): configurable Bedrock read/connect timeout by @go-faustino in kagent-dev/kagent#2223 * feat: add deploymentAnnotations to agent deployment spec by @anthonyhaussman in kagent-dev/kagent#2359 * feat(helm/kagent): allow disabling default modelconfig by @anthonyhaussman in kagent-dev/kagent#2142 * feat(sts): send RFC 8707 resource and audience on token exchange by @QuentinBisson in kagent-dev/kagent#2106 * feat(sts): send RFC 8707 resource and audience on token exchange (Python) by @QuentinBisson in kagent-dev/kagent#2107 * Backport of 2407 (pg connection) to 0.10.x release by @supreme-gg-gg in kagent-dev/kagent#2399 * Backport 2409 (db session cleanup) to 0.10.x release by @supreme-gg-gg in kagent-dev/kagent#2403 * Backport of 2408 (s3 skills) to 0.10.x release by @supreme-gg-gg in kagent-dev/kagent#2405 * feat: configurable refresh interval for tool server controllers by @supreme-gg-gg in kagent-dev/kagent#2480 * feat: support file upload in agent chat by @supreme-gg-gg in kagent-dev/kagent#2429 ### Bug Fixes * fix(ui): chat interface overflows viewport causing input to be hidden below fold by @onematchfox in kagent-dev/kagent#2081 * fix(ui): avoid false stale chat send guard by @erauner12 in kagent-dev/kagent#2034 * fix(go-adk): extract system prompt from genai.GenerateContentConfig in Ollama and Bedrock model providers by @supreme-gg-gg in kagent-dev/kagent#2118 * fix(helm): support omitting image.registry in grafana-mcp chart by @michaelspinks in kagent-dev/kagent#2125 * fix(helm): support omitting image.registry in querydoc chart by @michaelspinks in kagent-dev/kagent#2124 * fix(security): patch CRITICAL/HIGH CVEs in golang-adk-full and app images by @jsonmp-k8 in kagent-dev/kagent#2133 * fix(go-adk): openai embeddings generation by @supreme-gg-gg in kagent-dev/kagent#2132 * fix(helm): omit empty repository segment in bundled image path by @michaelspinks in kagent-dev/kagent#2120 * fix: intermittent Postgres deadlock for concurrent memory searches by @supreme-gg-gg in kagent-dev/kagent#2146 * fix(deps): bump google-adk to 1.32.0 for Anthropic thinking blocks by @anxkhn in kagent-dev/kagent#2172 * fix: fix typos in part_converter comments by @mesutoezdil in kagent-dev/kagent#2195 * fix(adk): annotate serialize_metadata_value as str | dict by @anxkhn in kagent-dev/kagent#2173 * fix(ui): fix model name editing on the model config form by @Valyrian-Code in kagent-dev/kagent#1979 * fix: correct package comment in v1alpha2 groupversion_info by @mesutoezdil in kagent-dev/kagent#2183 * fix(crewai): unwrap Part before DataPart check so structured inputs are used by @anxkhn in kagent-dev/kagent#2231 * fix(helm): expose nodeSelector and tolerations for kagent-tools subchart by @the-mentor in kagent-dev/kagent#2213 * fix(helm): make the cluster DNS domain configurable by @shekhargit1912 in kagent-dev/kagent#2209 * fix: parse migration filenames the same way golang-migrate does by @mesutoezdil in kagent-dev/kagent#2194 * fix: build sandbox runtime outside QEMU emulation by @peterj in kagent-dev/kagent#2299 * fix: set kgateway.dev/a2a as appProtoco for BYO agents by @supreme-gg-gg in kagent-dev/kagent#2305 * fix(db): normalize agent name in memory vector search by @mesutoezdil in kagent-dev/kagent#2307 * fix(adk/bedrock): coerce nil tool-call args to empty object by @go-faustino in kagent-dev/kagent#2222 * fix: correct webhook typo in CLI help text by @tziyon31 in kagent-dev/kagent#2203 * fix(build): use AZURE_OPENAI_API_KEY env var name consistently by @mesutoezdil in kagent-dev/kagent#2310 * fix(security): scope task get, create, and delete to the owner by @mesutoezdil in kagent-dev/kagent#2265 * fix(adk): keep token refresh loop alive after a failed read by @mesutoezdil in kagent-dev/kagent#2330 * fix(acp-shim): drain child stdout during terminate to avoid teardown deadlock by @tomsen02 in kagent-dev/kagent#2338 * fix(adk): keep full session state when num_recent_events is set by @mesutoezdil in kagent-dev/kagent#2329 * fix(controller): wire up SessionSharesHandler in NewHandlers (#2363) by @onematchfox in kagent-dev/kagent#2420 * fix: ensure API key passthrough works for OpenAI embedding models by @onematchfox in kagent-dev/kagent#2494 * fix(adk): validate ask_user questions by @erauner12 in kagent-dev/kagent#2486 * Backport fix(golang-adk): resolve user identity from A2A call context to 0.10.x by @buravc in kagent-dev/kagent#2507 * fix(a2a): serve exact task reads from the persistent store by @erauner12 in kagent-dev/kagent#2484 * fix(ui): preserve post-login redirect target through `oauth2-proxy` sign-in by @onematchfox in kagent-dev/kagent#2532 ### Documentation * docs: fix duplicate descriptions and broken link in README by @mesutoezdil in kagent-dev/kagent#2068 * docs: fix typos and errors in component READMEs by @mesutoezdil in kagent-dev/kagent#2070 * docs: fix typos and list formatting in contributor docs by @mesutoezdil in kagent-dev/kagent#2069 * docs: replace outdated AutoGen reference in SECURITY.md by @mesutoezdil in kagent-dev/kagent#2110 * docs(python): fix kagent-langgraph README import to kagent.langgraph by @anxkhn in kagent-dev/kagent#2167 * docs(python): fix KAgentSession import path in kagent-openai README by @anxkhn in kagent-dev/kagent#2163 * docs: fix stale references and See merge request: Harmonybrew/homebrew-core!18335
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When oauth2-proxy intercepts an unauthenticated request it serves its sign-in page carrying the original destination as
.Redirect(e.g./oauth2/sign_in?rd=%2Fagents%2Ffoo).sign_in.htmltemplate ignored that and unconditionally redirected to/login, and/login's "Sign in with SSO" link was hardcoded tord=/-- so any login, expired- cookie or not, always landed back on the home page instead of the page the user was trying to reach.Also contains a Helm update that ensures that this change will result in
oauth2-proxybeing redeployed to pick up the updated sign-in page template.