RomanNum3ral
/
ConvertX
mirror of https://github.com/C4illin/ConvertX.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

audit: guard trusted-header hook under ALLOW_UNAUTHENTICATED + document SSO logout 

- Skip the root trusted-header hook when ALLOW_UNAUTHENTICATED is set: the two
  modes are mutually exclusive and the ephemeral-session logic would otherwise
  overwrite (and waste a provision on) the header session.
- README: note that logout is proxy/IdP-managed under trusted-header SSO.
This commit is contained in:
claude 2026-08-05 16:28:05 -06:00
parent 20a812abaa
commit 35122193bf
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -93,7 +93,7 @@ All are optional, JWT_SECRET is recommended to be set.
| ACCOUNT_REGISTRATION | false | Allow users to register accounts |
| HTTP_ALLOWED | false | Allow HTTP connections, only set this to true locally |
| ALLOW_UNAUTHENTICATED | false | Allow unauthenticated users to use the service, only set this to true locally |
| HTTP_REMOTE_USER_ENABLED | false | Trust a reverse proxy to authenticate users and sign them in from a header (SSO). Only enable behind a proxy that strips the header — see below. |
| HTTP_REMOTE_USER_ENABLED | false | Trust a reverse proxy to authenticate users and sign them in from a header (SSO). Only enable behind a proxy that strips the header — see below. |
| HTTP_REMOTE_USER_HEADER | Remote-User | Header the trusted proxy passes the authenticated identity in (e.g. `X-authentik-email`, `X-Forwarded-Email`). Case-insensitive. |
| AUTO_DELETE_EVERY_N_HOURS | 24 | Checks every n hours for files older then n hours and deletes them, set to 0 to disable |
| WEBROOT | | The address to the root path setting this to "/convert" will serve the website on "example.com/convert/" |
@ -108,6 +108,8 @@ All are optional, JWT_SECRET is recommended to be set.
If you already run a reverse proxy that authenticates users — [Authentik](https://goauthentik.io/) (forward-auth outpost), [Authelia](https://www.authelia.com/), [oauth2-proxy](https://oauth2-proxy.github.io/oauth2-proxy/), Cloudflare Access, etc. — ConvertX can trust it instead of asking users to log in a second time. Set `HTTP_REMOTE_USER_ENABLED=true` and point `HTTP_REMOTE_USER_HEADER` at the header your proxy injects the authenticated identity in. On each request ConvertX reads that header, looks up the matching account (creating it on first sight), and signs the user in — so users go straight from your SSO to the app. The normal login/registration form still works for anyone reaching ConvertX without the header.
Logout is handled by your proxy/identity provider: because the header is present on every proxied request, ConvertX's own logout would immediately re-authenticate the user from it. Point your users at the proxy's logout (e.g. Authentik's end-session endpoint) to sign out.
```yml
# behind an Authentik forward-auth outpost:
environment:

6
src/pages/root.tsx
View File

@ -21,8 +21,10 @@ export const root = new Elysia().use(userService).get(
async ({ request, jwt, redirect, cookie: { auth, jobId } }) => {
// Trusted-header SSO: if a reverse proxy already authenticated the request,
// establish the ConvertX session here — before any auth redirect — so the
// user lands straight on the app with no second login.
if (!auth?.value) {
// user lands straight on the app with no second login. Skipped under
// ALLOW_UNAUTHENTICATED (mutually exclusive: that mode issues its own
// ephemeral session below and would just overwrite this one).
if (!ALLOW_UNAUTHENTICATED && !auth?.value) {
const ssoToken = await trustedHeaderToken(request, jwt);
if (ssoToken && auth) {
auth.set({