fix: use web api to extract path from URL properly #172

New Issue

MrUnknownDE · 2026-04-05T17:02:00+02:00

MrUnknownDE commented

2026-04-05 17:02:00 +02:00

Originally created by @moohbr on 3/2/2026

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Fix PATH based resource rules failing to match when the request contains a query string.

Badger sends the path field with the full URI including query parameters (e.g. /stream.html?token=111). The isPathAllowed function performs segment-based matching, so /stream.html?token=111 never matches a rule configured as /stream.html, causing Bypass Auth rules to silently fail for unauthenticated users.

Instead of relying on the path and host fields sent by Badger, both are now derived from originalRequestURL using the native URL API, which guarantees a clean pathname (no query string or fragment) and a consistent host.

How to test?

Create a resource with Authentication = Protected and Rules enabled
Add a rule: Bypass Auth → Path → /stream.html
Send a request to the internal verify-session endpoint with path: /stream.html?token=111 and originalRequestURL: https://<resource-domain>/stream.html?token=111 and empty sessions
Confirm the response is valid: true
Send the same request with path: /config.html and confirm valid: false

*Originally created by @moohbr on 3/2/2026* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Fix PATH based resource rules failing to match when the request contains a query string. Badger sends the path field with the full URI including query parameters (e.g. `/stream.html?token=111`). The `isPathAllowed` function performs segment-based matching, so `/stream.html?token=111` never matches a rule configured as `/stream.html`, causing `Bypass Auth` rules to silently fail for unauthenticated users. Instead of relying on the path and host fields sent by Badger, both are now derived from `originalRequestURL` using the native `URL API`, which guarantees a clean `pathname` (no query string or fragment) and a consistent host. ## How to test? 1. Create a resource with `Authentication` = Protected and Rules enabled 2. Add a rule: Bypass Auth → Path → `/stream.html` 3. Send a request to the internal verify-session endpoint with path: `/stream.html?token=111` and `originalRequestURL`: `https://<resource-domain>/stream.html?token=111` and empty sessions 4. Confirm the response is `valid: true` 5. Send the same request with path: `/config.html` and confirm `valid: false`

MrUnknownDE closed this issue

2026-04-05 17:02:00 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#172