kevinveenbirkenbachandClaude Opus 5.5 b0856dcf7b fix(web-app-snipe-it): bridge the SSO header past v8.8.1's HTTP_ refusal ...

Snipe-IT v8.8.1 refuses any `login_remote_user_header_name` matching
`/^HTTP_/i`, so the configured `HTTP_X_FORWARDED_PREFERRED_USERNAME`
stopped minting sessions behind oauth2-proxy.

Apache in the image now copies `X-Forwarded-Preferred-Username` into
the server variable `INFINITO_SSO_USER`, and only when the request also
carries `X-Infinito-Sso-Proxy` equal to the new per-inventory
`sso_proxy_secret`; an empty secret keeps the bridge closed. openresty
sends that header on every proxied request, so a client reaching the
container directly cannot log in by forging the identity header. A
deploy-time check asserts both directions (forged 200, with secret 302).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-20 22:10:23 +02:00

..

compose.yml.j2

…

env.j2

fix(web-app-snipe-it): bridge the SSO header past v8.8.1's HTTP_ refusal

2026-10-20 22:10:23 +02:00

playwright.env.j2

…

test.env.j2

…