fix(auth): accept configured public origin for sign-in

2026-09-19 12:25:43 +12:00
parent fd6671cf7e
commit 153ac86a5a
8 changed files with 335 additions and 13 deletions
@@ -35,6 +35,14 @@ from `main`; use `prod-<short-commit>` tags to identify an exact release.
   feature, database integrity and account counts. Do not trigger bulk permission
   changes, email sends or user imports as a deployment smoke test.

+   Include browser-origin POST checks for both `/api/auth/login` and
+   `/api/auth/jellyfin/login`: an empty form with `Origin` set to the public URL
+   must reach input validation (422), while an unrelated origin must return 403.
+   GET-only login/health checks do not detect origin-policy lockouts. Set
+   `CORS_ALLOW_ORIGIN` to the exact public origin; the state-change guard also
+   accepts the explicitly configured Hosting & proxy public URL, never a URL
+   inferred from request Host or forwarded headers.
+
 For rollback, select the saved image and recreate only Magent. Restore data only
 if needed; doing so can discard activity since the backup. Never restore a whole
 shared Compose or Caddy file without checking for unrelated changes first.