[PR #46] [MERGED] feat: Merge automatic reverse proxy detection for NextAuth JWT cookies into release/202506.004 #56

New issue

Closed

opened 2026-10-15 13:01:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 13:01:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/wolfmanager/pull/46
Author: @salty2011
Created: 7/11/2025
Status: ✅ Merged
Merged: 7/11/2025
Merged by: @salty2011

Base: release/202506.004 ← Head: fix/issue-40-nextauth-url

📝 Commits (3)

9fbee1c Fix NEXTAUTH_URL inconsistency behind reverse proxy (issue #40)
ad3351b feat: Add comprehensive JWT debugging for Issue #40 NextAuth reverse proxy
6966225 feat: Complete automatic reverse proxy detection for NextAuth JWT cookies

📊 Changes

12 files changed (+505 additions, -25 deletions)

View changed files

📝 build/docker-compose.production.yml (+1 -1)
📝 build/docker-compose.yml (+2 -0)
📝 src/app/actions/api-test-actions.ts (+3 -2)
📝 src/lib/api/wolf-pair-server.ts (+7 -6)
📝 src/lib/auth.ts (+40 -13)
➕ src/lib/auth/reverse-proxy-detection.ts (+122 -0)
➕ src/lib/debug/jwt-debug.ts (+237 -0)
📝 src/lib/steamgriddb/client.ts (+2 -1)
➕ src/lib/url-resolver.ts (+69 -0)
📝 src/lib/utils.ts (+2 -1)
📝 src/middleware.ts (+19 -0)
📝 tsconfig.tsbuildinfo (+1 -1)

📄 Description

🎯 Merge Request: Issue #40 Resolution

Merging the automatic reverse proxy detection implementation from fix/issue-40-nextauth-url into release/202506.004.

🚀 Features Added

Automatic Reverse Proxy Detection

New Module: src/lib/auth/reverse-proxy-detection.ts
Smart Detection: Automatically detects common reverse proxy headers:
- x-forwarded-for, x-forwarded-host, x-forwarded-proto
- x-real-ip, cf-connecting-ip (Cloudflare)
- x-amzn-trace-id (AWS ALB)
Container Awareness: Detects Docker/Kubernetes environments
Universal Compatibility: Works with Traefik, nginx, Cloudflare, AWS ALB, etc.

Request-Aware Security: Cookie security determined per request based on proxy detection
Automatic Switching: Secure vs insecure cookies based on reverse proxy detection
Zero Configuration: Works out-of-the-box for most reverse proxy setups

Enhanced Error Handling & Debugging

Graceful JWT decode error handling during configuration transitions
Comprehensive debugging logs with reverse proxy context
Reduced logging verbosity after issue resolution

✅ Testing Results

Scenario	Authentication	Cookie Type	Status
Direct HTTPS	✅ Working	Secure cookies	✅ Tested
Traefik Proxy	✅ Working	Insecure cookies	✅ Tested
Without Proxy	✅ Working	Standard detection	✅ Tested

🔧 Configuration Options

Automatic (Recommended)

# No configuration needed! 
# System auto-detects reverse proxy and configures cookies appropriately

Manual Override (Optional)

environment:
  - INSECURE_COOKIES_IN_PRODUCTION=true          # Force insecure cookies
  - INSECURE_COOKIES_IN_PRODUCTION=force-secure  # Force secure cookies

📋 Benefits

🔧 Automatic Cookie Security Detection: Eliminates manual configuration
🛡️ Security Maintained: HTTPS security preserved at reverse proxy level
🔄 Universal Compatibility: Works with all major reverse proxies
📦 Production Ready: Container and Kubernetes deployments supported
🔄 Backward Compatible: Existing deployments unaffected
🐛 Enhanced Debugging: Clear troubleshooting capabilities

🎯 Resolution Summary

✅ Resolves Issue #40: Authentication behind reverse proxies now works seamlessly
✅ User Validated: Confirmed working with Traefik and direct deployments
✅ Production Ready: Enhanced error handling and debugging
✅ Zero Breaking Changes: Backward compatible implementation

Files Modified:

src/lib/auth/reverse-proxy-detection.ts (new)
src/lib/auth.ts (enhanced)
src/lib/debug/jwt-debug.ts (improved debugging)
src/middleware.ts (cleanup)

Commit: 6966225

Ready for Release: This implementation has been thoroughly tested and provides a robust solution for reverse proxy authentication issues.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/wolfmanager/pull/46 **Author:** [@salty2011](https://github.com/salty2011) **Created:** 7/11/2025 **Status:** ✅ Merged **Merged:** 7/11/2025 **Merged by:** [@salty2011](https://github.com/salty2011) **Base:** `release/202506.004` ← **Head:** `fix/issue-40-nextauth-url` --- ### 📝 Commits (3) - [`9fbee1c`](https://github.com/games-on-whales/wolfmanager/commit/9fbee1c9a25c30dac4bb85479dc63bf4df8100a2) Fix NEXTAUTH_URL inconsistency behind reverse proxy (issue #40) - [`ad3351b`](https://github.com/games-on-whales/wolfmanager/commit/ad3351b8ba84bf03d26d65d944d04d772dbbfe26) feat: Add comprehensive JWT debugging for Issue #40 NextAuth reverse proxy - [`6966225`](https://github.com/games-on-whales/wolfmanager/commit/6966225c1b16a1499a706a110a99e1d1b5639ecf) feat: Complete automatic reverse proxy detection for NextAuth JWT cookies ### 📊 Changes **12 files changed** (+505 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `build/docker-compose.production.yml` (+1 -1) 📝 `build/docker-compose.yml` (+2 -0) 📝 `src/app/actions/api-test-actions.ts` (+3 -2) 📝 `src/lib/api/wolf-pair-server.ts` (+7 -6) 📝 `src/lib/auth.ts` (+40 -13) ➕ `src/lib/auth/reverse-proxy-detection.ts` (+122 -0) ➕ `src/lib/debug/jwt-debug.ts` (+237 -0) 📝 `src/lib/steamgriddb/client.ts` (+2 -1) ➕ `src/lib/url-resolver.ts` (+69 -0) 📝 `src/lib/utils.ts` (+2 -1) 📝 `src/middleware.ts` (+19 -0) 📝 `tsconfig.tsbuildinfo` (+1 -1) </details> ### 📄 Description ## 🎯 **Merge Request: Issue #40 Resolution** Merging the automatic reverse proxy detection implementation from `fix/issue-40-nextauth-url` into `release/202506.004`. ### 🚀 **Features Added** #### **Automatic Reverse Proxy Detection** - **New Module**: `src/lib/auth/reverse-proxy-detection.ts` - **Smart Detection**: Automatically detects common reverse proxy headers: - `x-forwarded-for`, `x-forwarded-host`, `x-forwarded-proto` - `x-real-ip`, `cf-connecting-ip` (Cloudflare) - `x-amzn-trace-id` (AWS ALB) - **Container Awareness**: Detects Docker/Kubernetes environments - **Universal Compatibility**: Works with Traefik, nginx, Cloudflare, AWS ALB, etc. #### **Dynamic Cookie Configuration** - **Request-Aware Security**: Cookie security determined per request based on proxy detection - **Automatic Switching**: Secure vs insecure cookies based on reverse proxy detection - **Zero Configuration**: Works out-of-the-box for most reverse proxy setups #### **Enhanced Error Handling & Debugging** - **Graceful JWT decode error handling** during configuration transitions - **Comprehensive debugging logs** with reverse proxy context - **Reduced logging verbosity** after issue resolution ### ✅ **Testing Results** | **Scenario** | **Authentication** | **Cookie Type** | **Status** | |--------------|-------------------|-----------------|------------| | **Direct HTTPS** | ✅ Working | Secure cookies | ✅ Tested | | **Traefik Proxy** | ✅ Working | Insecure cookies | ✅ Tested | | **Without Proxy** | ✅ Working | Standard detection | ✅ Tested | ### 🔧 **Configuration Options** #### **Automatic (Recommended)** ```yaml # No configuration needed! # System auto-detects reverse proxy and configures cookies appropriately ``` #### **Manual Override (Optional)** ```yaml environment: - INSECURE_COOKIES_IN_PRODUCTION=true # Force insecure cookies - INSECURE_COOKIES_IN_PRODUCTION=force-secure # Force secure cookies ``` ### 📋 **Benefits** 1. **🔧 Automatic Cookie Security Detection**: Eliminates manual configuration 2. **🛡️ Security Maintained**: HTTPS security preserved at reverse proxy level 3. **🔄 Universal Compatibility**: Works with all major reverse proxies 4. **📦 Production Ready**: Container and Kubernetes deployments supported 5. **🔄 Backward Compatible**: Existing deployments unaffected 6. **🐛 Enhanced Debugging**: Clear troubleshooting capabilities ### 🎯 **Resolution Summary** - ✅ **Resolves Issue #40**: Authentication behind reverse proxies now works seamlessly - ✅ **User Validated**: Confirmed working with Traefik and direct deployments - ✅ **Production Ready**: Enhanced error handling and debugging - ✅ **Zero Breaking Changes**: Backward compatible implementation **Files Modified:** - `src/lib/auth/reverse-proxy-detection.ts` (new) - `src/lib/auth.ts` (enhanced) - `src/lib/debug/jwt-debug.ts` (improved debugging) - `src/middleware.ts` (cleanup) **Commit**: [`6966225`](https://github.com/games-on-whales/wolfmanager/commit/6966225) **Ready for Release**: This implementation has been thoroughly tested and provides a robust solution for reverse proxy authentication issues. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 13:01:59 +00:00