fix: allow gotrue to work with multiple custom domains #999

kangmingtay · 2023-03-20T08:20:11Z

What kind of change does this PR introduce?

Improves on feat: Support for OAuth callback proxy. #725, albeit with a slightly different approach
When a request is made to gotrue, gotrue will retrieve the hostname and use it in the email links / oauth callback.
This helps to make gotrue usable with multiple custom domains, and also allows the email links to contain the custom domain.

hf

In general looks good, but how does it work with SAML? What are the SAML URLs advertized when you get the metadata?

kangmingtay · 2023-03-31T05:56:49Z

@hf good catch, we can always display the current API_EXTERNAL_URL as the default, but if they use a custom domain in the metadata url, it should also go through the same check to verify that the domain being used is in the allow list

internal/mailer/mailer_test.go

J0 · 2023-04-03T01:27:51Z

Thanks for your patience - generally LGTM as well. There's quite a bit of overlap with the PKCE PR - do. you want to get this in first? Will save quite a bit of conflict resolution

If we haven't yet we should also test this out with a proxy server

Co-authored-by: Joel Lee <lee.yi.jie.joel@gmail.com>

kangmingtay · 2023-04-04T05:51:56Z

@J0 sounds good - lemme finish up the deployment plan first to make sure that it won't break any existing projects

If we haven't yet we should also test this out with a proxy server

I managed to test this out by editing the /etc/hosts file locally to map localhost:9999 to a custom domain. But i'll also put it on a project in staging to see if it works with the current custom domain set up.

internal/mailer/mailer.go

internal/conf/configuration.go

internal/api/mail.go

hf

Looks OK, I'd just reconsider the hostname allow list as I don't think it does much.

internal/conf/configuration.go

internal/mailer/template.go

internal/api/mail_test.go

hf

Looks good!

github-actions · 2023-05-12T17:10:56Z

🎉 This PR is included in version 2.67.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

With #999 custom domains were introduced, however for OAuth, the redirect URLs should in fact be the ones specified in the config and not ones interpreted from the `X-Forwarded-Host` header.

## What kind of change does this PR introduce? * Improves on supabase#725, albeit with a slightly different approach * Gotrue will accept an allow list of domains via a comma-separate string (`DOMAIN_ALLOW_LIST`) , which includes the `API_EXTERNAL_URL` by default. On each request, gotrue will check that the domain being used is also included in the allow list. * When gotrue starts up, it will take the `DOMAIN_ALLOW_LIST` and convert it into a map where the key is the hostname and the value is the url * When a request is made to gotrue, gotrue will check the `DomainAllowListMap` to check if there is a matching hostname before allowing the request through. If there isn't a matching hostname used, gotrue will default to use the `API_EXTERNAL_URL` instead. * This helps to make gotrue usable with multiple custom domains, and also allows the email links to contain the custom domain. * Since the `EXTERNAL_XXX_REDIRECT_URI` is derived during runtime, we can remove that config once this PR is merged in as long as the `REDIRECT_URI` is also included in the `DOMAIN_ALLOW_LIST` --------- Co-authored-by: Joel Lee <lee.yi.jie.joel@gmail.com>

With supabase#999 custom domains were introduced, however for OAuth, the redirect URLs should in fact be the ones specified in the config and not ones interpreted from the `X-Forwarded-Host` header.

## What kind of change does this PR introduce? * Improves on supabase#725, albeit with a slightly different approach * Gotrue will accept an allow list of domains via a comma-separate string (`DOMAIN_ALLOW_LIST`) , which includes the `API_EXTERNAL_URL` by default. On each request, gotrue will check that the domain being used is also included in the allow list. * When gotrue starts up, it will take the `DOMAIN_ALLOW_LIST` and convert it into a map where the key is the hostname and the value is the url * When a request is made to gotrue, gotrue will check the `DomainAllowListMap` to check if there is a matching hostname before allowing the request through. If there isn't a matching hostname used, gotrue will default to use the `API_EXTERNAL_URL` instead. * This helps to make gotrue usable with multiple custom domains, and also allows the email links to contain the custom domain. * Since the `EXTERNAL_XXX_REDIRECT_URI` is derived during runtime, we can remove that config once this PR is merged in as long as the `REDIRECT_URI` is also included in the `DOMAIN_ALLOW_LIST` --------- Co-authored-by: Joel Lee <lee.yi.jie.joel@gmail.com>

With supabase#999 custom domains were introduced, however for OAuth, the redirect URLs should in fact be the ones specified in the config and not ones interpreted from the `X-Forwarded-Host` header.

## What kind of change does this PR introduce? * Improves on supabase#725, albeit with a slightly different approach * Gotrue will accept an allow list of domains via a comma-separate string (`DOMAIN_ALLOW_LIST`) , which includes the `API_EXTERNAL_URL` by default. On each request, gotrue will check that the domain being used is also included in the allow list. * When gotrue starts up, it will take the `DOMAIN_ALLOW_LIST` and convert it into a map where the key is the hostname and the value is the url * When a request is made to gotrue, gotrue will check the `DomainAllowListMap` to check if there is a matching hostname before allowing the request through. If there isn't a matching hostname used, gotrue will default to use the `API_EXTERNAL_URL` instead. * This helps to make gotrue usable with multiple custom domains, and also allows the email links to contain the custom domain. * Since the `EXTERNAL_XXX_REDIRECT_URI` is derived during runtime, we can remove that config once this PR is merged in as long as the `REDIRECT_URI` is also included in the `DOMAIN_ALLOW_LIST` --------- Co-authored-by: Joel Lee <lee.yi.jie.joel@gmail.com>

With supabase#999 custom domains were introduced, however for OAuth, the redirect URLs should in fact be the ones specified in the config and not ones interpreted from the `X-Forwarded-Host` header.

kangmingtay added 4 commits March 20, 2023 15:19

fix: add domain allow list config & middleware

0315ca7

fix: use valid req host as external url

c06014d

fix: use req host as callback url

df21f7d

fix tests

df3a79a

kangmingtay self-assigned this Mar 20, 2023

kangmingtay requested a review from a team as a code owner March 20, 2023 08:20

refactor configuration

5cd5daf

kangmingtay force-pushed the km/fix-custom-domain branch from 3864668 to 5cd5daf Compare March 21, 2023 04:40

Merge branch 'master' into km/fix-custom-domain

cc04360

hf reviewed Mar 30, 2023

View reviewed changes

J0 reviewed Apr 3, 2023

View reviewed changes

internal/mailer/mailer_test.go Outdated Show resolved Hide resolved

J0 approved these changes Apr 3, 2023

View reviewed changes

kangmingtay and others added 2 commits April 3, 2023 12:17

Update internal/mailer/mailer_test.go

78a4d82

Co-authored-by: Joel Lee <lee.yi.jie.joel@gmail.com>

Merge branch 'master' into km/fix-custom-domain

984deb6

kangmingtay added 2 commits May 8, 2023 17:03

Merge branch 'master' into km/fix-custom-domain

8d00d05

Merge branch 'master' into km/fix-custom-domain

a4186d1

kangmingtay commented May 8, 2023

View reviewed changes

internal/mailer/mailer.go Outdated Show resolved Hide resolved

kangmingtay commented May 8, 2023

View reviewed changes

internal/conf/configuration.go Outdated Show resolved Hide resolved

hf reviewed May 9, 2023

View reviewed changes

internal/api/mail.go Show resolved Hide resolved

hf reviewed May 9, 2023

View reviewed changes

internal/conf/configuration.go Outdated Show resolved Hide resolved

internal/mailer/template.go Outdated Show resolved Hide resolved

internal/mailer/template.go Outdated Show resolved Hide resolved

refactor getPath

4fc85c3

hf reviewed May 10, 2023

View reviewed changes

internal/api/mail_test.go Outdated Show resolved Hide resolved

kangmingtay added 3 commits May 11, 2023 17:23

remove custom domain config

dffc133

fix test

b950b0e

fix: use x-forwarded-host & x-forwarded-proto to determine url

21cb664

hf approved these changes May 12, 2023

View reviewed changes

kangmingtay merged commit 91a82ed into master May 12, 2023

kangmingtay deleted the km/fix-custom-domain branch May 12, 2023 17:04

github-actions bot added the released label May 12, 2023

hf mentioned this pull request May 22, 2023

fix: use configured redirect URL for external providers #1114

Merged

rmvh mentioned this pull request Sep 22, 2023

Broken Invitation Links - http://kong is the domain #1228

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: allow gotrue to work with multiple custom domains #999

fix: allow gotrue to work with multiple custom domains #999

kangmingtay commented Mar 20, 2023 •

edited

Loading

hf left a comment

kangmingtay commented Mar 31, 2023

J0 commented Apr 3, 2023 •

edited

Loading

kangmingtay commented Apr 4, 2023

hf left a comment

hf left a comment

github-actions bot commented May 12, 2023

fix: allow gotrue to work with multiple custom domains #999

fix: allow gotrue to work with multiple custom domains #999

Conversation

kangmingtay commented Mar 20, 2023 • edited Loading

What kind of change does this PR introduce?

hf left a comment

Choose a reason for hiding this comment

kangmingtay commented Mar 31, 2023

J0 commented Apr 3, 2023 • edited Loading

kangmingtay commented Apr 4, 2023

hf left a comment

Choose a reason for hiding this comment

hf left a comment

Choose a reason for hiding this comment

github-actions bot commented May 12, 2023

kangmingtay commented Mar 20, 2023 •

edited

Loading

J0 commented Apr 3, 2023 •

edited

Loading