[ZedeN1]

Since RustDesk 1.5.0 (rustdesk/rustdesk#15710), the desktop client includes an apiDomain field in POST /api/oidc/auth:

{"apiDomain":"https://rustdesk.example.com","deviceInfo":{...},"id":"...","op":"Zitadel","uuid":"..."}

Because the global ValidationPipe uses forbidNonWhitelisted, the request is rejected with 400 {"message":["property apiDomain should not exist"]}. The client only displays "Bad Request", so third-party login from desktop clients 1.5.0 and newer fails, while web login keeps working.

This adds apiDomain as an optional string to OidcAuthRequestDto. The value is intentionally ignored: redirect URIs continue to be built from the configured site settings, so the client cannot influence them. Unknown fields are still rejected.

Tests: new oidc.dto.spec.ts covers requests with and without apiDomain, a non-string value, and other unknown fields.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2ecaafa5-1f6c-4df8-bddf-0e0c7f6a31d2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[ZedeN1]

Temporary workaround until this is released, for anyone running Nginx Proxy Manager in front of the console: add the following to the proxy host's Advanced tab. It removes apiDomain from the OIDC auth request before it reaches the backend.

location = /api/oidc/auth {
    access_by_lua_block {
        ngx.req.read_body()
        local cjson = require "cjson.safe"
        local body = ngx.req.get_body_data()
        local t = body and cjson.decode(body)
        if type(t) == "table" then
            t.apiDomain = nil
            ngx.req.set_body_data(cjson.encode(t))
        end
    }
    include conf.d/include/proxy.conf;
}