kevinveenbirkenbachandClaude Opus 5.5 bb1394517c fix(csp): let onion pages frame the single SSO issuer ...

Keycloak runs once on clearnet, yet onion pages such as the dashboard embed it for the silent SSO check, and its frame-ancestors listed only clearnet sources, so the browser refused the frame. On the issuer's clearnet vhost each translatable ancestor now also appears on the node onion. Whether a token moves to the node onion is decided by its host, so the issuer keeps its one URL on onion vhosts wherever it is listed, not only through the logout source.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-15 16:29:19 +02:00

..

action

perf(constructor): carry the applications SPOT through the merge block

2026-09-14 18:10:40 +02:00

filter

fix(csp): let onion pages frame the single SSO issuer

2026-10-15 16:29:19 +02:00

lookup

test(lookup): keep the onion apex redirect to a clearnet homepage on a multi node

2026-10-15 16:25:26 +02:00

__init__.py

…