Grist doesn't respect changes in FORWARD_AUTH_HEADER when doing SSO

Based on following how-tos: https://community.getgrist.com/t/a-template-for-self-hosting-grist-with-traefik-and-docker-compose/856 https://community.getgrist.com/t/grist-authelia-custom-logout-path/967

… I have setup Grist with Caddy as Reverse Proxy and Authelia for authentication. But I think there is an error on Grist when it comes to single sign on.

For showing the problem I have installed 2 different whoami, whoami.example.com and whoami2.example.com. Both secured with Authelia. Also Grist is secured.

Logout will be catched on all 3 apps by Caddy when calling /signed-out:

1. open in a tab whoami.example.com, login with Authelia
   Result: Remote-Email: [e-mail], Cookie: 123

2. open in a tab whoami2.example.com
   Result: Remote-Email: [e-mail], Cookie: 123

3. open in a tab grist.example.com, press sign-in
   Result: signed in automatically, Auth[GET]: id 6 email [e-mail], Cookie: 123

4. open whoami.example.com/signed-out
   Result: Authelia login page returns to both whoami and whoami2
           on grist Auth[GET]: id 6 email [e-mail], Cookie: 123, stil logged in!!

5. login to whoami.example.com with anotheruser
   Result: whoami and whoami2 are logged in with Remote-Email: [e-mail], Cookie: 789
           on grist still Auth[GET]: id 6 email [e-mail], but Cookie is: 789

Everything works fine as long as I only use Grist for Login/Logout. When I login on another Webapp first, Grist doesn’t respect the new login from another user.

[paulfitz]

Thanks for spelling this out @helmut72. It makes sense, the ForwardAuthLogin mechanism as implemented doesn’t play well with peer sites. I think the fix could be fairly straightforward.

[helmut72]

One thing I did want to mention is a currently undocumented feature

Thanks! This is enough for personal use, because I’m being able to include a tables/URLs in Markdown documents and no one need an account on my Grist installation to view/open the table.

There might need to be some refactoring throughout the app

I understand that this takes a longer time, also needs testing. Will ask in some months again. 😉 Thanks for sharing this undocumented feature. Unfortunately I’m busy these days and need to test it, but this should help.