NeskireDK 8e5a9e079e Add trusted-header authentication (Authelia SSO) ...

New config block trusted_header_auth. When enabled, before_all
resolves the session from the proxy-asserted header (default
Remote-User) instead of only the SID cookie:

- The header is honored only when the direct TCP peer is in
  trusted_proxies (literal IPs, IPv4-mapped IPv6 normalized).
  X-Forwarded-For is never consulted. Duplicated headers reject.
- /api/ is excluded: token clients (Yattee) are unaffected.
- Unknown users are provisioned like manual registration, with the
  subscriptions materialized view and a random bcrypt password.
  Both statements tolerate concurrent provisioning.
- A session cookie is set and reused; a cookie that belongs to a
  different user is dropped (identity-switch guard).
- Boot fails closed: enabled without valid trusted_proxies exits.
- Optional logout_url replaces the local sign-out form so logout
  ends the proxy session, not just the Invidious one.

The reverse proxy MUST strip the header on routes that bypass its
authentication (see config.example.yml warning).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-12 17:49:53 +02:00

..

migrate-scripts

variable postgres username and database name (#2451)

2021-10-11 19:16:56 +00:00

sql

Specify the public schema for public videos

2022-01-22 02:32:13 +00:00

config.example.yml

Add trusted-header authentication (Authelia SSO)

2026-08-12 17:49:53 +02:00