From 22c4323fcb7698425cf4d305537ab598ac2b4090 Mon Sep 17 00:00:00 2001
From: muffn_ <9695227+monstermuffin@users.noreply.github.com>
Date: Fri, 2 Jan 2026 02:50:11 +0000
Subject: [PATCH] fix: set X-Forwarded-User header for SSE requests from
 existing session (#111)

Co-authored-by: muffin <MonsterMuffin@users.noreply.github.com>
---
 middleware.go | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/middleware.go b/middleware.go
index afb0595..ebd36e8 100644
--- a/middleware.go
+++ b/middleware.go
@@ -86,6 +86,17 @@ func (t *TraefikOidc) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	acceptHeader := req.Header.Get("Accept")
 	if strings.Contains(acceptHeader, "text/event-stream") {
 		t.logger.Debugf("Request accepts text/event-stream (%s), bypassing OIDC", acceptHeader)
+		// Set forwarded user headers from existing session before bypassing
+		if session, err := t.sessionManager.GetSession(req); err == nil {
+			defer session.returnToPoolSafely()
+			if email := session.GetEmail(); email != "" {
+				req.Header.Set("X-Forwarded-User", email)
+				if !t.minimalHeaders {
+					req.Header.Set("X-Auth-Request-User", email)
+				}
+				t.logger.Debugf("SSE bypass: forwarded user %s from session", email)
+			}
+		}
 		t.next.ServeHTTP(rw, req)
 		return
 	}