keystonejs/keystone

`statelessSessions` attempts to use unsupported `Authorization: Basic` header rather than the cookie

Open

#9,785 建立於 2026年3月6日

在 GitHub 查看
 (2 留言) (0 反應) (1 負責人)JavaScript (14,870 star) (2,386 fork)batch import
discussiondocumentationhelp wanted

描述

When deploying a Keystone app to a staging environment hidden behind a reverse proxy (like Nginx or Caddy) with HTTP Basic Authentication, Admin UI access breaks (Access denied), even if the user logs in correctly and has a valid keystonejs-session cookie.

Steps to reproduce:

  1. Setup a Keystone app using statelessSessions.
  2. Put the app behind a proxy that requires Basic Auth, passing the Authorization: Basic ... header down to the Node.js backend.
  3. Log in to the Admin UI successfully (the cookie is set in the browser).
  4. Refresh the page or try to access adminMeta.
  5. Result: Access denied because context.session becomes undefined.

Expected behaviour: Keystone should ignore Authorization: Basic ... headers and correctly fallback to parsing the keystonejs-session cookie.

Node.js - v22.13.0 keystone-6/auth - 8.1.0 keystone-6/core - 6.5.1

貢獻者指南

技術棧
javascriptnodejs
領域
backendauthentication
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
half day
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
blocked
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Node.jsHTTPCookies
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
40
研究方向
The bug is in the `statelessSessions` implementation. Look at how Keystone parses the `Authorization` header and falls back to the cookie. Check the session middleware code in the Keystone source, likely in packages/auth/ or packages/core/. The issue has been assigned to a contributor, so any new contributor should coordinate with them. There are no linked PRs yet, but the reproduction steps are clear.