mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-27 21:01:03 +08:00
9cf7e8f943
The login route built the SP `callbackUrl` from `query.redirect_uri.origin`, which is the customer's app — not the backend. The IdP would then POST the assertion to e.g. `http://localhost:8103/api/v1/auth/saml/acs/acme` (the demo app), which 404s because the ACS handler only exists on the backend. Fix both login and ACS to derive `baseUrl` from the incoming request's own origin, matching what the metadata route already does. The e2e round-trip test didn't catch this because in tests the customer and backend run on the same host. |
||
|---|---|---|
| .. | ||
| prisma | ||
| scripts | ||
| src | ||
| .env | ||
| .env.development | ||
| .eslintrc.cjs | ||
| .gitignore | ||
| instrumentation-client.ts | ||
| LICENSE | ||
| next.config.mjs | ||
| package.json | ||
| prisma.config.ts | ||
| tsconfig.json | ||
| vercel.json | ||
| vitest.config.ts | ||
| vitest.setup.ts | ||