sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: cross-subdomain SSO auto-login for *arr services

Browse Source 
- Set Domain=.sami on session + CSRF cookies so browsers send them to all subdomains
- This fixes Caddy forward_auth returning 401 for radarr/sonarr/prowlarr
- Fix login URL concatenation bug (radarr.samilogin -> radarr.sami/login)
- Fix getSetCookie() missing from _httpsFetch/_httpFetch response objects
- Fix array/string handling for set-cookie header in session-handlers fallback
- Refactor csrf-protection to createCSRFMiddleware() factory with cookieDomain support
- Pass renewCSRFToken through middleware deps chain to TOTP route
This commit is contained in:
Coderbot
2026-05-23 16:15:56 -07:00
parent fe0f52ce17
commit 445da9f5fc
7 changed files with 101 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/src/context/index.js
+3
View File
@@ -160,6 +160,9 @@ function assembleContext({
loadNotificationConfig,
resyncHealthChecker,
// Middleware result (exposes renewCSRFToken etc.)
middlewareResult,
// File paths
SERVICES_FILE,
CONFIG_FILE,