From 96b3f3dd353e94908e3fb674b3bc18201165d5db Mon Sep 17 00:00:00 2001 From: Max Peintner Date: Tue, 12 May 2026 08:34:39 +0200 Subject: [PATCH] fix(login): apply custom request headers from environment variable in proxy (#12144) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #12125 # Which Problems Are Solved The proxy middleware (proxy.ts) did not apply `CUSTOM_REQUEST_HEADERS` to rewritten requests (/.well-known/*, /oauth/*, /oidc/*, etc.). When `ZITADEL_API_URL` points to an internal service name, the Host header on proxied requests remained the internal name instead of the configured public domain, causing Errors.Instance.NotFound. # How the Problems Are Solved The other two outgoing request paths — the connectRPC transport and the security-settings fetch — already applied these headers. This adds the same applyCustomHeaders() call to the proxy path. Co-authored-by: Ramon --- apps/login/src/proxy.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apps/login/src/proxy.ts b/apps/login/src/proxy.ts index 198bb8d55..78892f78c 100644 --- a/apps/login/src/proxy.ts +++ b/apps/login/src/proxy.ts @@ -1,5 +1,6 @@ import { NextRequest, NextResponse } from "next/server"; import { buildCSP } from "./lib/csp"; +import { applyCustomHeaders } from "./lib/custom-headers"; import { createLogger } from "./lib/logger"; import { getIframeOrigins } from "./lib/server/security-settings"; import { getServiceConfig } from "./lib/service-url"; @@ -77,6 +78,12 @@ export async function proxy(request: NextRequest) { requestHeaders.set("x-zitadel-instance-host", instanceHost); } + // Apply headers from CUSTOM_REQUEST_HEADERS environment variable + applyCustomHeaders({ + set: (key, value) => requestHeaders.set(key, value), + remove: (key) => requestHeaders.delete(key), + }); + responseHeaders.set("Access-Control-Allow-Origin", "*"); responseHeaders.set("Access-Control-Allow-Headers", "*");