From f990365cb8c9267dc7caefa9d9b05939c2c49e30 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Tue, 19 May 2026 13:07:35 +0100
Subject: [PATCH] feat(lib): add TrustForwardedURI to honor X-Forwarded-Uri for
 post-login redirect target

---
 auth_flow.go          |  4 ++--
 forwarded_uri.go      | 17 +++++++++++++++++
 forwarded_uri_test.go | 33 +++++++++++++++++++++++++++++++++
 main.go               |  1 +
 settings.go           |  7 +++++++
 types.go              |  1 +
 6 files changed, 61 insertions(+), 2 deletions(-)
 create mode 100644 forwarded_uri.go
 create mode 100644 forwarded_uri_test.go

diff --git a/auth_flow.go b/auth_flow.go
index 39d577a..c0d4d8d 100644
--- a/auth_flow.go
+++ b/auth_flow.go
@@ -69,7 +69,7 @@ func (t *TraefikOidc) prepareSessionForAuthentication(session *SessionData, csrf
 //   - session: The session data to prepare for authentication.
 //   - redirectURL: The pre-calculated callback URL (redirect_uri) for this middleware instance.
 func (t *TraefikOidc) defaultInitiateAuthentication(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string) {
-	t.logger.Debugf("Initiating new OIDC authentication flow for request: %s", req.URL.RequestURI())
+	t.logger.Debugf("Initiating new OIDC authentication flow for request: %s", t.originalRequestURI(req))
 
 	// Check and handle redirect limits
 	if err := t.validateRedirectCount(session, rw, req); err != nil {
@@ -98,7 +98,7 @@ func (t *TraefikOidc) defaultInitiateAuthentication(rw http.ResponseWriter, req
 	}
 
 	// Clear existing session data and set new authentication state
-	t.prepareSessionForAuthentication(session, csrfToken, nonce, codeVerifier, req.URL.RequestURI())
+	t.prepareSessionForAuthentication(session, csrfToken, nonce, codeVerifier, t.originalRequestURI(req))
 
 	session.MarkDirty()
 
diff --git a/forwarded_uri.go b/forwarded_uri.go
new file mode 100644
index 0000000..32b6cfa
--- /dev/null
+++ b/forwarded_uri.go
@@ -0,0 +1,17 @@
+package traefikoidc
+
+import "net/http"
+
+// originalRequestURI returns the request URI that should be used as the
+// post-login redirect target. When TrustForwardedURI is enabled and the
+// X-Forwarded-Uri header is present, that header wins — this lets the
+// oidcgate forward-auth daemon recover the real URL when nginx/Caddy/etc
+// proxied a stripped subrequest to /oauth2/auth or /oauth2/start.
+func (t *TraefikOidc) originalRequestURI(req *http.Request) string {
+	if t.trustForwardedURI {
+		if v := req.Header.Get("X-Forwarded-Uri"); v != "" {
+			return v
+		}
+	}
+	return req.URL.RequestURI()
+}
diff --git a/forwarded_uri_test.go b/forwarded_uri_test.go
new file mode 100644
index 0000000..b92c285
--- /dev/null
+++ b/forwarded_uri_test.go
@@ -0,0 +1,33 @@
+package traefikoidc
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestOriginalRequestURI_DefaultOff(t *testing.T) {
+	tr := &TraefikOidc{trustForwardedURI: false}
+	req := httptest.NewRequest(http.MethodGet, "/protected?x=1", nil)
+	req.Header.Set("X-Forwarded-Uri", "/spoofed")
+	if got := tr.originalRequestURI(req); got != "/protected?x=1" {
+		t.Fatalf("default-off: want /protected?x=1, got %q", got)
+	}
+}
+
+func TestOriginalRequestURI_TrustEnabled(t *testing.T) {
+	tr := &TraefikOidc{trustForwardedURI: true}
+	req := httptest.NewRequest(http.MethodGet, "/protected?x=1", nil)
+	req.Header.Set("X-Forwarded-Uri", "/real?y=2")
+	if got := tr.originalRequestURI(req); got != "/real?y=2" {
+		t.Fatalf("trust-on with header: want /real?y=2, got %q", got)
+	}
+}
+
+func TestOriginalRequestURI_TrustEnabledNoHeader(t *testing.T) {
+	tr := &TraefikOidc{trustForwardedURI: true}
+	req := httptest.NewRequest(http.MethodGet, "/protected", nil)
+	if got := tr.originalRequestURI(req); got != "/protected" {
+		t.Fatalf("trust-on no header: want /protected, got %q", got)
+	}
+}
diff --git a/main.go b/main.go
index 6682464..a2e1dc4 100644
--- a/main.go
+++ b/main.go
@@ -201,6 +201,7 @@ func NewWithContext(ctx context.Context, config *Config, next http.Handler, name
 		}(),
 		forceHTTPS:                config.ForceHTTPS,
 		enablePKCE:                config.EnablePKCE,
+		trustForwardedURI:         config.TrustForwardedURI,
 		overrideScopes:            config.OverrideScopes,
 		strictAudienceValidation:  config.StrictAudienceValidation,
 		allowOpaqueTokens:         config.AllowOpaqueTokens,
diff --git a/settings.go b/settings.go
index 516e4db..6725205 100644
--- a/settings.go
+++ b/settings.go
@@ -125,6 +125,13 @@ type Config struct {
 	// ClientAssertionAlg is the JWS signing algorithm. Defaults to RS256.
 	// Supported: RS256/384/512, PS256/384/512, ES256/384/512.
 	ClientAssertionAlg string `json:"clientAssertionAlg,omitempty"`
+
+	// TrustForwardedURI, when true, makes the middleware prefer the
+	// X-Forwarded-Uri request header (set by an upstream reverse proxy)
+	// over req.URL when capturing the "where was the user going" target
+	// stored for post-login redirect. Used by the oidcgate standalone
+	// daemon. Default false preserves the Traefik plugin behavior exactly.
+	TrustForwardedURI bool `json:"trustForwardedURI,omitempty"`
 }
 
 // loadCACertPool assembles an x509.CertPool from CACertPath and CACertPEM.
diff --git a/types.go b/types.go
index 08c00ae..59d1395 100644
--- a/types.go
+++ b/types.go
@@ -149,4 +149,5 @@ type TraefikOidc struct {
 	enablePKCE                 bool
 	forceHTTPS                 bool
 	suppressDiagnosticLogs     bool
+	trustForwardedURI          bool
 }