From c89f823cb6821c3cf7f1f58e78d4b03c0f6def88 Mon Sep 17 00:00:00 2001 From: cclohmar Date: Sun, 14 Jun 2026 14:52:25 +0000 Subject: [PATCH] fix(auth): chain session middleware before auth gate to prevent redirect loop --- src/main.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/main.go b/src/main.go index d2448f5..ad0b181 100644 --- a/src/main.go +++ b/src/main.go @@ -116,10 +116,11 @@ func main() { }) // --- Workspace launcher (public, but OIDC-protected) --- - sessionMiddleware := sessionStore.SessionMiddleware - authGate := oidcHandler.AuthGateMiddleware - uiHandler.RegisterRoutes(mux, authGate) - _ = sessionMiddleware // Used for session-aware middleware in future + // Chain: SessionMiddleware (reads cookie → sets context) → AuthGate (checks context → redirects if needed) + combinedAuth := func(next http.Handler) http.Handler { + return sessionStore.SessionMiddleware(oidcHandler.AuthGateMiddleware(next)) + } + uiHandler.RegisterRoutes(mux, combinedAuth) // --- Admin routes (protected by bearer token) --- adminAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)