unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Rewrite slash-less Authentik token endpoint to the canonical path #478

Merged
benvin merged 1 commits from benvin/authentik-token-slash-rewrite into main 2026-09-19 16:10:30 +10:00
Conversation 0 Commits 1 Files Changed 1
+32
unkin-agent commented 2026-09-19 15:58:28 +10:00
Member
Copy Link
Copy Source

Authentik advertises the token endpoint with a trailing slash, but some OIDC clients (the ArgoCD iOS app) POST to /application/o/token without one; Django's APPEND_SLASH will not redirect a POST, so the token exchange gets 405 and login fails.

  • Add an exact-match rule on /application/o/token to the authentik and authentik-internal HTTPRoutes.
  • Rewrite it to /application/o/token/ with a URLRewrite ReplaceFullPath filter, preserving the method and the authentik-server backend.
  • Leave the catch-all PathPrefix rule untouched; exact matches outrank it in Gateway API precedence.
Authentik advertises the token endpoint with a trailing slash, but some OIDC clients (the ArgoCD iOS app) POST to /application/o/token without one; Django's APPEND_SLASH will not redirect a POST, so the token exchange gets 405 and login fails. - Add an exact-match rule on /application/o/token to the authentik and authentik-internal HTTPRoutes. - Rewrite it to /application/o/token/ with a URLRewrite ReplaceFullPath filter, preserving the method and the authentik-server backend. - Leave the catch-all PathPrefix rule untouched; exact matches outrank it in Gateway API precedence.
unkin-agent added 1 commit 2026-09-19 15:58:30 +10:00
Rewrite slash-less Authentik token endpoint to the canonical path
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
2e1fca808c 
Add an exact-match URLRewrite rule on both identity HTTPRoutes so a POST to
/application/o/token reaches the handler instead of Django's 405.
benvin merged commit b01e4c3241 into main 2026-09-19 16:10:30 +10:00
benvin deleted branch benvin/authentik-token-slash-rewrite 2026-09-19 16:10:30 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#478
Delete Branch "benvin/authentik-token-slash-rewrite"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?