feat/opnform-prod #15
Simon
Tobias-Wuest
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/opnform-prod"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Newer OpnForm builds bind the OIDC state to a verifier: /api/auth/{slug}/ redirect returns state_verifier, callback.vue reads it from sessionStorage["oidc_state_verifier:<slug>:<state>"] and replays it as the X-OIDC-State-Verifier header - consumeState() rejects the callback without it (400 "Invalid state", user-visible as "Sign-in could not be completed"). The intercept page dropped the verifier, so every SSO login failed on images newer than the demo rollout. Store it exactly where the SPA looks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>@ -206,0 +211,4 @@# hand-run stacks on the digitalboard production hosts).- traefik.http.routers.{{ opnform_service_name }}.tls.domains[0].main={{ opnform_domain }}{% for san in opnform_tls_sans %}- traefik.http.routers.{{ opnform_service_name }}.tls.domains[0].sans={{ san }}[Hoch] Multi-SAN-Bug: Diese Zeile schreibt in der Schleife wiederholt denselben Label-Key
tls.domains[0].sans. Bei Traefiks Docker-Label-Provider gewinnt der letzte Wert – bei mehreren SANs überleben also alle außer dem letzten nicht, und das Zertifikat wird unvollständig. Traefik erwartet mehrere SANs als kommaseparierten Wert in einem einzelnen Label. Vorschlag: Schleife entfernen und stattdessen- traefik.http.routers.{{ opnform_service_name }}.tls.domains[0].sans={{ opnform_tls_sans | join(',') }}verwenden.@ -46,3 +51,3 @@}default_type text/html;return 200 '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Redirecting to sign-in…</title></head><body style="font-family:sans-serif;text-align:center;padding:3rem;color:#374151"><p id="m">Redirecting to sign-in…</p><script>fetch("/api/auth/{{ opnform_oidc_slug }}/redirect",{method:"POST",headers:{Accept:"application/json"}}).then(function(r){if(!r.ok)throw new Error("HTTP "+r.status);return r.json()}).then(function(d){if(d&&d.redirect_url){window.location.replace(d.redirect_url)}else{throw new Error("no redirect_url")}}).catch(function(e){document.getElementById("m").textContent="Sign-in redirect failed: "+e.message+". Open /login?bypass=1 to use the email form.";});</script></body></html>';return 200 '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Redirecting to sign-in…</title></head><body style="font-family:sans-serif;text-align:center;padding:3rem;color:#374151"><p id="m">Redirecting to sign-in…</p><script>fetch("/api/auth/{{ opnform_oidc_slug }}/redirect",{method:"POST",headers:{Accept:"application/json"}}).then(function(r){if(!r.ok)throw new Error("HTTP "+r.status);return r.json()}).then(function(d){if(d&&d.redirect_url){if(d.state&&d.state_verifier){try{sessionStorage.setItem("oidc_state_verifier:{{ opnform_oidc_slug }}:"+d.state,d.state_verifier)}catch(e){}}window.location.replace(d.redirect_url)}else{throw new Error("no redirect_url")}}).catch(function(e){document.getElementById("m").textContent="Sign-in redirect failed: "+e.message+". Open /login?bypass=1 to use the email form.";});</script></body></html>';[Mittel] Verschluckter sessionStorage-Fehler: Der
try{...}catch(e){}speichert denstate_verifierstill und ignoriert jeden Fehler. IstsessionStoragenicht verfügbar (Privatmodus, deaktivierter Storage, Quota), läuft die Weiterleitung zum IdP trotzdem durch und der Callback scheitert später mit genau dem 400 „Invalid state", vor dem der Kommentar oben warnt – ohne jede Diagnose. Vorschlag: Fehlerfall dem Nutzer sichtbar machen (analog zum vorhandenen.catch), statt still fortzufahren. Zusätzlich: Diese Zeile hängt an einem internen, undokumentierten UI-Vertrag (sessionStorage-Key-Format) – ein OpnForm-Upgrade kann den Login ohne Testabdeckung brechen; bitte OpnForm-Version pinnen oder Hinweis ergänzen.View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.