github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[PR #13738] [MERGED] server: reject unexpected auth hosts #40244

New Issue
Closed
opened 2026-04-23 01:11:30 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 01:11:30 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/13738
Author: @BruceMacD
Created: 1/16/2026
Status: ✅ Merged
Merged: 1/16/2026
Merged by: @BruceMacD

Base: main ← Head: brucemacd/cross-domain-check

📝 Commits (2)

📊 Changes

4 files changed (+123 additions, -5 deletions)

View changed files

📝 server/auth.go (+6 -1)
➕ server/auth_test.go (+113 -0)
📝 server/images.go (+3 -3)
📝 server/upload.go (+1 -1)

📄 Description

Added validation to ensure auth redirects stay on the same host as the original request. The fix is a single check in getAuthorizationToken comparing the realm URL's host against the request host. Added tests for the auth flow.

This builds on #10750, but is more strict than just suffix matching.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/13738 **Author:** [@BruceMacD](https://github.com/BruceMacD) **Created:** 1/16/2026 **Status:** ✅ Merged **Merged:** 1/16/2026 **Merged by:** [@BruceMacD](https://github.com/BruceMacD) **Base:** `main` ← **Head:** `brucemacd/cross-domain-check` --- ### 📝 Commits (2) - [`fc238ec`](https://github.com/ollama/ollama/commit/fc238ec48575324d3aabdf948c262301250bce04) server: reject unexpected auth hosts - [`add4e19`](https://github.com/ollama/ollama/commit/add4e1909bc4a2b312a8cad8b928a272bd487247) gofmt ### 📊 Changes **4 files changed** (+123 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `server/auth.go` (+6 -1) ➕ `server/auth_test.go` (+113 -0) 📝 `server/images.go` (+3 -3) 📝 `server/upload.go` (+1 -1) </details> ### 📄 Description Added validation to ensure auth redirects stay on the same host as the original request. The fix is a single check in getAuthorizationToken comparing the realm URL's host against the request host. Added tests for the auth flow. This builds on #10750, but is more strict than just suffix matching. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 01:11:30 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#40244
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?