Repository navigation
fix(console): derive environment.json api from the requested origin - #12893
Merged
livio-a merged 4 commits intoOct 21, 2026
Merged
Conversation
The api URL in the console's environment.json was built from the raw request Host header, while the issuer already uses the domain context resolved by the origin middleware. With multiple custom domains or a reverse proxy, both values diverged. Use the domain context origin for the api URL as well, so it always matches the issuer. This makes the externalSecure parameter of console.Start obsolete, as the protocol is already part of the domain context. Closes zitadel#12009 Co-Authored-By: Claude Opus 5.5 <[email protected]>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
@MustafaKemal0146 is attempting to deploy a commit to the zitadel Team on Vercel. A member of the Team first needs to authorize it. |
hifabienne
added
the
os-contribution
|
View your CI Pipeline Execution ↗ for commit 170d47b
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
1 of 2 tasks
livio-a
reviewed
Oct 7, 2026
livio-a
left a comment
livio-a
left a comment
Member
There was a problem hiding this comment.
Thanks for the fix, looks good! The api URL now follows the same origin resolution as the issuer, which fixes both #12009 and #12195. I added #12195 to the closed issues, since this also fixes the X-Forwarded-Host case. Could you have a look at the comments on the tests? Once they're addressed, I'm happy to approve.
Run the test cases through the WithOrigin middleware with real headers (X-Forwarded-Host, Forwarded, x-zitadel-*-host) instead of setting the domain context directly, and drop the issuer assertion which could not fail. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Member
|
I pushed the test changes from my review directly to keep this moving. Thanks again for the fix! |
livio-a
enabled auto-merge (squash)
October 21, 2026 12:36
livio-a
approved these changes
Oct 21, 2026
livio-a
disabled auto-merge
October 21, 2026 12:54
livio-a
added a commit
that referenced
this pull request
Oct 22, 2026
…12893) <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved - When an instance has multiple custom domains (or runs behind a reverse proxy that forwards the original host), the `api` attribute of the management console's `/ui/console/assets/environment.json` does not match the requested domain, while `issuer` does. - The `api` URL was built from the raw `r.Host` of the request, whereas the issuer is derived from the domain context that the `WithOrigin` middleware resolves from the instance / public host headers. # How the Problems Are Solved - The `api` URL is now taken from `http_util.DomainContext(ctx).Origin()`, the same source the OIDC issuer uses, so both values always match. # Additional Changes - Removes the now unused `externalSecure` parameter from `console.Start`. The protocol is already part of the domain context (`WithOrigin` is configured with `ExternalSecure`). - Adds a unit test for the `environment.json` handler covering the instance host, a public host and a forwarded instance host that differ from the request host. The test fails on `main` (`api` is `https://zitadel.internal:8080` instead of `https://custom.example.com`) and passes with this change. # Additional Context - Closes #12009 - Closes #12195 - AI-assisted: this change was prepared with Claude Code and reviewed and tested by me (`go test ./internal/api/ui/console/`, `go vet`, `go build ./cmd/...`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Livio Spring <[email protected]> (cherry picked from commit ce12560)
livio-a
added a commit
that referenced
this pull request
Oct 22, 2026
…12893) <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved - When an instance has multiple custom domains (or runs behind a reverse proxy that forwards the original host), the `api` attribute of the management console's `/ui/console/assets/environment.json` does not match the requested domain, while `issuer` does. - The `api` URL was built from the raw `r.Host` of the request, whereas the issuer is derived from the domain context that the `WithOrigin` middleware resolves from the instance / public host headers. # How the Problems Are Solved - The `api` URL is now taken from `http_util.DomainContext(ctx).Origin()`, the same source the OIDC issuer uses, so both values always match. # Additional Changes - Removes the now unused `externalSecure` parameter from `console.Start`. The protocol is already part of the domain context (`WithOrigin` is configured with `ExternalSecure`). - Adds a unit test for the `environment.json` handler covering the instance host, a public host and a forwarded instance host that differ from the request host. The test fails on `main` (`api` is `https://zitadel.internal:8080` instead of `https://custom.example.com`) and passes with this change. # Additional Context - Closes #12009 - Closes #12195 - AI-assisted: this change was prepared with Claude Code and reviewed and tested by me (`go test ./internal/api/ui/console/`, `go vet`, `go build ./cmd/...`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Livio Spring <[email protected]> (cherry picked from commit ce12560)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which Problems Are Solved
apiattribute of the management console's/ui/console/assets/environment.jsondoes not match the requested domain, whileissuerdoes.apiURL was built from the rawr.Hostof the request, whereas the issuer is derived from the domain context that theWithOriginmiddleware resolves from the instance / public host headers.How the Problems Are Solved
apiURL is now taken fromhttp_util.DomainContext(ctx).Origin(), the same source the OIDC issuer uses, so both values always match.Additional Changes
externalSecureparameter fromconsole.Start. The protocol is already part of the domain context (WithOriginis configured withExternalSecure).environment.jsonhandler covering the instance host, a public host and a forwarded instance host that differ from the request host. The test fails onmain(apiishttps://zitadel.internal:8080instead ofhttps://custom.example.com) and passes with this change.Additional Context
environment.jsonapiURL usesr.Hostdirectly — ignoresX-Forwarded-Host, breaks deployments behind a reverse proxy that rewrites Host #12195go test ./internal/api/ui/console/,go vet,go build ./cmd/...).🤖 Generated with Claude Code