mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-27 21:01:03 +08:00
9cf7e8f943
The login route built the SP `callbackUrl` from `query.redirect_uri.origin`, which is the customer's app — not the backend. The IdP would then POST the assertion to e.g. `http://localhost:8103/api/v1/auth/saml/acs/acme` (the demo app), which 404s because the ACS handler only exists on the backend. Fix both login and ACS to derive `baseUrl` from the incoming request's own origin, matching what the metadata route already does. The e2e round-trip test didn't catch this because in tests the customer and backend run on the same host. |
||
|---|---|---|
| .. | ||
| backend | ||
| dashboard | ||
| dev-launchpad | ||
| e2e | ||
| hosted-components | ||
| internal-tool | ||
| mock-oauth-server | ||
| mock-saml-idp | ||
| oauth-mock-server | ||