SSO/Header auth

[ByteAfterlife]

Hi! I was wondering if there was a way to log people into my HFS server using SSO like OpenID connect or SAML, or behind a reverse proxy if I could pass a header like HTTP-Auth-User with the username/email of who to login and HFS interprets that and actually logs them into their HFS account.

[rejetto]

Hey, i think i've prepared a plugin for that.
keep you posted.

[ByteAfterlife]

Oh, alright! Thank you so much.

[rejetto]

tbh, i don't know much about this. i used an agent to create a plugin that should add the support for the http-auth-user case.
i studied it and it looks good to me, but i don't have the time to check if it complies with real needs, and i'm not "publishing" until i know it does. Would you care to check for yourself?
if you do, just unzip this in your plugins folder proxy-header-auth.zip
LMK anyway

[ByteAfterlife]

It seems like it works well, I have a question though, why is it allowing you to specify the Email header? I tested it and it seems good, also a small change if you want, make it so the logout button on the frontend logs the user out and redirects the user to some external page (for SLO) that gets specified in the plugin config, not very important change though. I'll now try using it with the same proxy I use primarily to see if it works! Thanks.

[ByteAfterlife]

I don't mean to complain much, but I also noticed the plugin interferes with trying to fix it, if a user for example misconfigured it, they cannot log into the admin panel to fix it, even if their password is correct, it just refreshes and makes them login again

2026-02-09.17-47-00.mp4

[rejetto]

i see, sorry for that, i'll try to spend some time on it asap

[rejetto]

proxy-header-auth.zip

can you see if it works well for you now?

[ByteAfterlife]

It works awesome! I just noticed the fix for logout URL doesn't actually work, from what I understood (I may have misunderstood the code) When the user contacts any API path, it's supposed to return the header "x-proxy-header-auth-logout" but it never returns that for me, I also noticed it never says "logged out (xxx)" in the logs, so maybe its not properly detecting the logout event? Sorry if I misunderstood something. Even without it though, I'm very satisfied with it and I am very thankful for you spending your time making this!

[rejetto]

does this fix that?
proxy-header-auth.zip

[ByteAfterlife]

After retesting 0.2 it still didn't return the logout header for me, so 0.3 fixed it anyway, thank you so much!

[ByteAfterlife]

I think you should publish it for people as its own HFS plugin at this point, it seems to work very well, just some minor issues with logout consistency and that stuff but other than that it perfectly integrates with my HFS server, and I think it will with many others who use reverse proxies.

[rejetto]

GPT says:

Thanks for retesting and confirming.

Yes, that is the intended behavior:

x-proxy-header-auth-logout is returned on API logout flows (including /~/api/logout) when logoutRedirect is configured.
For browser (non-API) requests, the plugin does a normal HTTP redirect instead.
So the reverse proxy/client should read x-proxy-header-auth-logout on API responses and perform the redirect/logout action there.

If you still see logout inconsistencies, please share a minimal reproducible flow (exact endpoint, request headers, and expected vs actual response), and I’ll investigate it.

do you still think it's ready to be published?

did you hide this thread in some way? i cannot find it by browsing, i had to recover a link from an email

[ByteAfterlife]

Yes, I think it's ready to be published, but I think you should also include this just solves half the problem, and the other half is actually setting up your reverse proxy to properly handle login and forward information to the plugin.

I do not think I hid the thread, maybe because I marked your v0.3 response as an answer it closed the thread and hid it?

[rejetto]

ok, thanks. published.