mirror of
https://github.com/actualbudget/actual.git
synced 2026-07-16 07:04:23 -05:00
[GH-ISSUE #2135] [Feature] Enable additional headers for authentication front ends #42492
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/actual#42492
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @shall0pass on GitHub (Dec 29, 2023).
Original GitHub issue: https://github.com/actualbudget/actual/issues/2135
Verified feature request does not already exist?
💻
Pitch: what problem are you trying to solve?
When using an authentication packages such as Authelia/Keycloak/Authentik/etc.... Access to the site.webmanifest is restricted. From the reading I've done, this can be alleviated by adding a couple of headers.
https://portswigger.net/web-security/cors/access-control-allow-origin
Relevant Home Assistant issue: https://github.com/home-assistant/frontend/issues/940
Describe your ideal solution to this problem
Based on the portswigger page, a new environment option in the docker compose file that would allow users to set their domain name and enable the additional headers if using an authentication front end seems logical.
Teaching and learning
No response
@github-actions[bot] commented on GitHub (Dec 29, 2023):
✨ Thanks for sharing your idea! ✨
This repository uses lodash style issue management for enhancements. That means enhancement issues are automatically closed. This doesn’t mean we don’t accept feature requests, though! We will consider implementing ones that receive many upvotes, and we welcome contributions for any feature requests marked as needing votes (just post a comment first so we can help you make a successful contribution).
The enhancement backlog can be found here: https://github.com/actualbudget/actual/issues?q=label%3A%22needs+votes%22+sort%3Areactions-%2B1-desc+
Don’t forget to upvote the top comment with 👍!
@github-actions[bot] commented on GitHub (Jan 9, 2024):
🎉 This feature has been implemented in #2206 and will be released in the next version. Thanks for sharing your idea! 🎉
@lorenzo-w commented on GitHub (Feb 26, 2024):
Is this feature really implemented? This is asking for an option to use header authentication via a reverse proxy (which is a feature I would also very much like to have). As far as I can see, no new headers were introduced in the referenced PR.
@shall0pass commented on GitHub (Feb 26, 2024):
The linked PR solved the problem I was having. Without the cross-origin policy the PWA wouldn't install and the created shortcut wouldn't open a headless browser when using Authelia to authenticate. After the PR, it all installed and launched correctly. I had assumed it was the missing headers causing my problems from the other forums, but it turned out to be just the one line.
If there is something still missing, you can either create a new issue or we can reopen this one if you want to comment on what you're looking for. There is one open PR for additional header authentication #2362 .