mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 22:10:34 +00:00
60e8bf134a
Add an optional PENPOT_TRUSTED_ORIGINS setting listing alternate origins. When a request Origin matches, the backend uses it as the public base for links generated while serving that request: email links, asset URLs, audit and webhook link fields, and redirects. A global http middleware stamps the trusted origin on the request and binds the config public-uri to it for the request extent. OIDC authorization stores the origin in the signed state so the callback (a navigation without Origin) can rebuild the token-exchange redirect_uri and its redirect targets on the alternate domain. Unlisted origins and requests without Origin are unchanged. Only bare origins are supported, and server-to-server or queued work keeps the canonical public-uri. Closes #11625 AI-assisted-by: deepseek-v4.1-flash