fix(identity): resolve front-end origin per-request for auth e-mail links by marcelo-maciel · Pull Request #1377 · fullstackhero/dotnet-starter-kit

Commits on Aug 10, 2026

fix(identity): resolve front-end origin per-request for auth e-mail links
marcelo-maciel
committed
626eb18
test(identity): assert forgot-password rejects a forged Origin end-to-end
marcelo-maciel
committed
78edf16
test(identity): assert e-mail links resolve to the requesting front-end
marcelo-maciel
committed
ffb5aff
test(identity): match confirmation/reset e-mail by subject; richer timeout
marcelo-maciel
committed
22862d4
test(identity): drop e-mail-body integration test; rely on unit coverage
marcelo-maciel
committed
4cafc42
docs(identity): describe origin comments by intent, not the prior behavior
marcelo-maciel
committed
aa4037f
fix(identity): reword confirm-email comment to satisfy S125
marcelo-maciel
committed
1b8c299
refactor(identity): dedicated FrontendOptions for e-mail link origins
marcelo-maciel
committed
0ee35bc
refactor(web): address origin-resolver review nits (log level, docs, boot message)
marcelo-maciel
committed
112ae5f
fix(web): require FrontendOptions:DefaultOrigin at startup
marcelo-maciel
committed
b635632
fix(web): keep booting when FrontendOptions:DefaultOrigin is unset
marcelo-maciel
committed
67e026f
fix(web): fall back to the request host when no origin is configured at all
marcelo-maciel
committed
7e0198c
fix(web): resolve links against the default when no allow-list is configured
marcelo-maciel
committed
a48e957
fix(web): count the allow-list after normalization in the startup warning
marcelo-maciel
committed
9374510
docs(web): stop claiming the Scalar try-it UI sends no Origin header
marcelo-maciel
committed
dc767b5
docs(rules): document the front-end origin resolver in the security rule
marcelo-maciel
committed
0fdca92
docs(agents): list front-end link origins in the security rule index
marcelo-maciel
committed
124f182

Commits on Sep 14, 2026

Commits on Sep 16, 2026

fix(infra): keep api_extra_cors_origins out of the e-mail-link allow-list
marcelo-maciel
committed
e36d4a0

Commits on Sep 17, 2026

fix(web): stop deriving e-mail-link origins from the request host
marcelo-maciel
committed
7231bee

Commits on Sep 18, 2026

Commits on Sep 25, 2026

Merge remote-tracking branch 'origin/main' into pr/1377
iammukeshm
committed
635e6ba
fix(api): fail fast in Production when FrontendOptions:DefaultOrigin is unset

iammukeshm
and
claude
committed
6868a4b
Merge remote-tracking branch 'origin/main' into pr/1377
iammukeshm
committed
1e32eda

Navigation Menu

fix(identity): resolve front-end origin per-request for auth e-mail links - #1377

fix(identity): resolve front-end origin per-request for auth e-mail links#1377
iammukeshm merged 29 commits into
fullstackhero:mainfrom
marcelo-maciel:fix/identity-origin-multifront

Commits on Aug 10, 2026

fix(identity): resolve front-end origin per-request for auth e-mail links

test(identity): assert forgot-password rejects a forged Origin end-to-end

test(identity): assert e-mail links resolve to the requesting front-end

test(identity): match confirmation/reset e-mail by subject; richer timeout

test(identity): drop e-mail-body integration test; rely on unit coverage

docs(identity): describe origin comments by intent, not the prior behavior

fix(identity): reword confirm-email comment to satisfy S125

refactor(identity): dedicated FrontendOptions for e-mail link origins

refactor(web): address origin-resolver review nits (log level, docs, boot message)

fix(web): require FrontendOptions:DefaultOrigin at startup

fix(web): keep booting when FrontendOptions:DefaultOrigin is unset

fix(web): fall back to the request host when no origin is configured at all

fix(web): resolve links against the default when no allow-list is configured

fix(web): count the allow-list after normalization in the startup warning

docs(web): stop claiming the Scalar try-it UI sends no Origin header

docs(rules): document the front-end origin resolver in the security rule

docs(agents): list front-end link origins in the security rule index

Commits on Sep 14, 2026

fix(deploy): wire FrontendOptions into the docker and terraform deploys

build(deps): bump Testcontainers to 4.14.0 and SourceLink past their advisories

fix(infra): pull MinIO from quay.io on a pinned tag, not Docker Hub

Commits on Sep 16, 2026

fix(infra): keep api_extra_cors_origins out of the e-mail-link allow-list

Commits on Sep 17, 2026

fix(web): stop deriving e-mail-link origins from the request host

Commits on Sep 18, 2026

fix(config): keep the dev SPA origins out of Production

fix(infra): pull minio/mc from quay.io too, not just minio/minio

fix(frontend-origin): validate DefaultOrigin and correct three stale comments

fix(frontend-origin): treat an unusable DefaultOrigin as an unset one at run time

Commits on Sep 25, 2026

Merge remote-tracking branch 'origin/main' into pr/1377

fix(api): fail fast in Production when FrontendOptions:DefaultOrigin is unset

Merge remote-tracking branch 'origin/main' into pr/1377