From 0daf76283ed1e26d90c064b2df9b546c7293cc9b Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 17 Mar 2025 19:37:15 -0400 Subject: [PATCH 1/7] Capture `X-Forwarded` headers properly --- src/Tgstation.Server.Host/Core/Application.cs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/Tgstation.Server.Host/Core/Application.cs b/src/Tgstation.Server.Host/Core/Application.cs index ba07babec1..93be5a1fec 100644 --- a/src/Tgstation.Server.Host/Core/Application.cs +++ b/src/Tgstation.Server.Host/Core/Application.cs @@ -22,6 +22,7 @@ using Microsoft.AspNetCore.Cors.Infrastructure; using Microsoft.AspNetCore.Hosting; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Http.Connections; +using Microsoft.AspNetCore.HttpOverrides; using Microsoft.AspNetCore.Identity; using Microsoft.AspNetCore.Mvc.Infrastructure; using Microsoft.AspNetCore.SignalR; @@ -617,6 +618,12 @@ namespace Tgstation.Server.Host.Core // Wrap exceptions in a 500 (ErrorMessage) response applicationBuilder.UseServerErrorHandling(); + // header forwarding important for OIDC + applicationBuilder.UseForwardedHeaders(new ForwardedHeadersOptions + { + ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost, + }); + // metrics capture applicationBuilder.UseHttpMetrics(); From b0b3e59ffab4aa5d8e3f30ecf0961791add72463 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 17 Mar 2025 19:39:42 -0400 Subject: [PATCH 2/7] Update some nuget packages --- .../Tgstation.Server.Host.Service.csproj | 4 ++-- src/Tgstation.Server.Host/Tgstation.Server.Host.csproj | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/Tgstation.Server.Host.Service/Tgstation.Server.Host.Service.csproj b/src/Tgstation.Server.Host.Service/Tgstation.Server.Host.Service.csproj index 07863a2111..65a0469a4e 100644 --- a/src/Tgstation.Server.Host.Service/Tgstation.Server.Host.Service.csproj +++ b/src/Tgstation.Server.Host.Service/Tgstation.Server.Host.Service.csproj @@ -21,11 +21,11 @@ - + - + diff --git a/src/Tgstation.Server.Host/Tgstation.Server.Host.csproj b/src/Tgstation.Server.Host/Tgstation.Server.Host.csproj index 96c7dbcee1..4d0a20afb7 100644 --- a/src/Tgstation.Server.Host/Tgstation.Server.Host.csproj +++ b/src/Tgstation.Server.Host/Tgstation.Server.Host.csproj @@ -110,7 +110,7 @@ - + @@ -130,7 +130,7 @@ - + From 1a604b3ed461dc319b58a8a2e85fb31e2529faa0 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 17 Mar 2025 19:40:19 -0400 Subject: [PATCH 3/7] Remove another TGForums reference --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4161afa21b..44c310305a 100644 --- a/README.md +++ b/README.md @@ -329,7 +329,7 @@ Create an `appsettings.Production.yml` file next to `appsettings.yml`. This will #### OAuth Configuration -- `Security:OAuth:`: Sets the OAuth client ID and secret for a given ``. The currently supported providers are `GitHub`, `Discord`, `InvisionCommunity` and `TGForums`. Setting these fields to `null` disables logins AND gateway auth with the provider, but does not stop users from associating their accounts using the API. Sample Entry: +- `Security:OAuth:`: Sets the OAuth client ID and secret for a given ``. The currently supported providers are `GitHub`, `Discord`, and `InvisionCommunity`. Setting these fields to `null` disables logins AND gateway auth with the provider, but does not stop users from associating their accounts using the API. Sample Entry: ```yml Security: OAuth: From e3ee508176b884f9138c6bb04c7449224c5f2e82 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 17 Mar 2025 19:42:16 -0400 Subject: [PATCH 4/7] Note about header forwarding --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 44c310305a..a229c9a697 100644 --- a/README.md +++ b/README.md @@ -369,6 +369,8 @@ Security: - `Security:OidcStrictMode`: Boolean flag that, when `true`, disables password and OAuth logins, password changes, individual permission set assignment, and enables user registration using OpenID Connect providers. The claim name `tgstation-server-group-id` is used to dictate what TGS group users are registered to. +_Note: When using OIDC with a reverse proxy, TGS must receive `X-Forwarded` headers to properly identify the redirect URI to use. i.e. `X-Forwarded-Host` and `X-Forwarded-Proto`._ + ### Database Configuration If using a MariaDB/MySQL server, our client library [recommends you set 'utf8mb4' as your default charset](https://github.com/PomeloFoundation/Pomelo.EntityFrameworkCore.MySql#1-recommended-server-charset) disregard at your own risk. From 115d9a7407db3f490acdfb2139d68846b96b4191 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 17 Mar 2025 19:58:55 -0400 Subject: [PATCH 5/7] Webpanel version bump --- build/WebpanelVersion.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/WebpanelVersion.props b/build/WebpanelVersion.props index 2c3b54d0f1..9364e27aff 100644 --- a/build/WebpanelVersion.props +++ b/build/WebpanelVersion.props @@ -1,6 +1,6 @@ - 6.9.0 + 6.9.3 From 8b10619e2c5e9b728292f143ba8646e66b28b3ec Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 17 Mar 2025 20:10:32 -0400 Subject: [PATCH 6/7] Maybe fix release notes duplication --- .../Changelist.cs | 1 + .../ChangelistEqualityComparer.cs | 28 +++++++++++++++++++ 2 files changed, 29 insertions(+) create mode 100644 tools/Tgstation.Server.ReleaseNotes/ChangelistEqualityComparer.cs diff --git a/tools/Tgstation.Server.ReleaseNotes/Changelist.cs b/tools/Tgstation.Server.ReleaseNotes/Changelist.cs index feac94bc26..a1d437b546 100644 --- a/tools/Tgstation.Server.ReleaseNotes/Changelist.cs +++ b/tools/Tgstation.Server.ReleaseNotes/Changelist.cs @@ -41,6 +41,7 @@ namespace Tgstation.Server.ReleaseNotes Author = author }; }) + .Distinct(new ChangelistEqualityComparer()) .ToList(); } diff --git a/tools/Tgstation.Server.ReleaseNotes/ChangelistEqualityComparer.cs b/tools/Tgstation.Server.ReleaseNotes/ChangelistEqualityComparer.cs new file mode 100644 index 0000000000..08d320e859 --- /dev/null +++ b/tools/Tgstation.Server.ReleaseNotes/ChangelistEqualityComparer.cs @@ -0,0 +1,28 @@ +using System.Collections.Generic; +using System.Diagnostics.CodeAnalysis; +using System.Text.Json; + +namespace Tgstation.Server.ReleaseNotes +{ + internal class ChangelistEqualityComparer : IEqualityComparer + { + public bool Equals(Change x, Change y) + { + if (x == y) + return true; + + if (x == null) + return false; + + if (y == null) + return false; + + return JsonSerializer.Serialize(x) == JsonSerializer.Serialize(y); + } + + public int GetHashCode([DisallowNull] Change obj) + { + return JsonSerializer.Serialize(obj).GetHashCode(); + } + } +} From 79410b5d27e7de8576cd2943b83571df6be74581 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 17 Mar 2025 20:10:42 -0400 Subject: [PATCH 7/7] Version bump to 6.15.1 --- build/Version.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/Version.props b/build/Version.props index e504a6475f..edf4220733 100644 --- a/build/Version.props +++ b/build/Version.props @@ -3,7 +3,7 @@ - 6.15.0 + 6.15.1 5.6.0 10.13.0 0.6.0