Repository navigation
fix(deploy): let UC_EXTERNAL_URL carry the path prefix the cookie fix depends on - #24
Merged
Merged
Conversation
… depends on deploy-uc.sh rejected any UC_EXTERNAL_URL with a path and exited, while the state-cookie fix from #21 only takes effect when server.external-url has one. The two conditions were mutually exclusive: anyone deploying through this repo's own script could not reach the fix, and the sample file and both guides told them a path was a mistake. A path is required when a gateway serves UC under a prefix and strips it before forwarding -- the redirect_uri registered with the identity provider carries it, and the state cookie must be scoped to it. Accept scheme://host[:port][/path]; keep rejecting what can only be a slip: a trailing slash, an empty segment, a query, a fragment, a missing scheme. The Secure flag reads only the scheme, so a path never affects it, and a host-only value renders byte-identically to before. Say so where operators read: the property's comment, the sample file, and a 'behind a path prefix' section in both deployment guides with the worked example and the redirect URI to register. Closes #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #22
What
deploy-uc.shrejected anyUC_EXTERNAL_URLwith a path and exited, while the state-cookie fix from #21 only takes effect whenserver.external-urlhas one. The two conditions were mutually exclusive: anyone deploying through this repo's own script could not reach the fix, and the sample file and both guides told them a path was a mistake.A path is required when a gateway serves UC under a prefix and strips it before forwarding — the
redirect_uriregistered with the identity provider carries it, and the state cookie must be scoped to it.Changes
deploy/deploy-uc.shscheme://host[:port][/path]; keep rejecting a trailing slash, an empty segment, a query, a fragment and a missing scheme. Comment and error text restatedServerProperties.java(scheme + host [+ port])and notes that the path also scopes the OAuth state cookiedeploy/uc.env.exampledeploy/README.md,deploy/README.zh-CN.mdThe Secure flag reads only the scheme, so a path never affects it; a host-only value renders byte-identically to before.
Shape check, walked by hand
https://uc.example.comhttps://uc.example.com:8443https://api.example.com/unitycataloghttps://api.example.com/a/bhttps://uc.example.com/https://api.example.com//uchttps://uc.example.com?x=1https://uc.example.com#fuc.example.comVerified end to end, locally
A prefix-stripping gateway in front of the server with
UC_EXTERNAL_URL=https://…/unitycatalog, deployed throughdeploy-uc.sh(now accepted), signing in against a mock OIDC provider: theredirect_uricarries the prefix, the state cookie is scoped to/unitycatalog/api/1.0/unity-control/auth, the browser returns it, the callback sets the session cookie and clears the state on the same path, and the session is usable through the gateway.AuthServiceHostedLoginBehindPrefixTestwas also mutated (both call sites back to the unprefixed path) to confirm both cases turn red.One thing this does not change, and that the same run shows: after a successful callback the browser is sent to
Location: /, the gateway root, rather than back under the prefix. The session is established regardless. Tracked separately from #22.🤖 Generated with Claude Code