lxe/workflow-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OIDC-Integration: Keycloak-Login (Authorization Code Flow + PKCE), app-seitige Rollen bleiben unangetastet

Browse Source
This commit is contained in:
Kühn
2026-09-15 11:41:29 +02:00
parent 1d03ab498f
commit 1ee37c402a
9 changed files with 420 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/server.js
View File

@@ -113,8 +113,9 @@ app.use(cookieParser());
// P4: CSRF protection for state-changing requests (Double-Submit-Cookie)
// Skip CSRF check for login/register (no session yet, no CSRF token available)
// and OIDC flow endpoints (GET-Redirects; der Flow selbst ist per State-Cookie geschützt)
app.use('/api', (req, res, next) => {
if (req.path.startsWith('/auth/login') || req.path.startsWith('/auth/register') || req.path.startsWith('/v1/auth/login') || req.path.startsWith('/v1/auth/register')) {
if (req.path.startsWith('/auth/login') || req.path.startsWith('/auth/register') || req.path.startsWith('/v1/auth/login') || req.path.startsWith('/v1/auth/register') || req.path.startsWith('/auth/oidc/') || req.path.startsWith('/v1/auth/oidc/')) {
return next();
}
csrfMiddleware(req, res, next);