guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- next.js, react, typescript
调研方向
从 @ory/nextjs 中的 guessPotentiallyProxiedOrySdkUrl 开始，然后跟踪 getLoginFlow 和其他服务端 flow 函数如何传递 knownProxiedUrl。将该行为与 middleware 的 proxyRequest 以及客户端使用 @ory/elements-react 的方式进行比较。当位于 Traefik 或其他非 Vercel 代理之后的生产部署能够使用代理后的应用 URL 进行登录、注册、恢复和验证，而不需要开发模式 workaround 时，即视为完成。
由索引模型根据 Issue 内容生成。
描述
Preflight checklist
- I could not find a solution in the existing issues, docs, nor discussions.
- I agree to follow this project's Code of Conduct.
- I have read and am following this repository's Contribution Guidelines.
- I have joined the Ory Community Slack.
- I am signed up to the Ory Security Patch Newsletter.
Ory Network Project
https://busy-mayer-9wpd865lft.projects.oryapis.com
Describe the bug
Hi,
We're integrating Ory Network with a Next.js 16 app using @ory/[email protected] and @ory/[email protected]. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
AI root cause findings: guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
Environment:
@ory/[email protected], @ory/[email protected]
Next.js 16 (standalone output, App Router)
Docker Compose + Traefik Proxy
NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
https://github.com/user-attachments/assets/b0dd3ca1-d8e9-41bf-8ff5-29a0a100cb7b
Thanks for any guidance.
Reproducing the bug
See the video attached above
Relevant log output
Relevant configuration
Version
@ory/[email protected] @ory/[email protected]
On which operating system are you observing this issue?
None
In which environment are you deploying?
None
Additional Context
No response
- 主要语言
- TypeScript
- 星标
- 187
- 派生
- 80
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ory/elements 的其他 Issue
-
Needs Triage
难度 2/5 1-3 小时 新手友好度 70/100
-
good first issue help wanted upstream
难度 2/5 1-3 小时 新手友好度 45/100
-
good first issue help wanted upstream
难度 3/5 1-2 天 新手友好度 25/100
-
Needs Triage
难度 3/5 1-2 天 新手友好度 52/100
-
Needs Triage
难度 4/5 3-5 天 新手友好度 48/100
相似的 Issue
-
resources
难度 2/5 1-3 小时 新手友好度 72/100
railmapgen/rmg-palette#2445 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 88/100
danielmiessler/LifeOS#2242 ·
维护者通常 5 天内回复
-
good first issue hacktoberfest help wanted translation
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
callstackincubator/appduct#129 ·
维护者通常 1 天内回复
-
难度 1/5 1-3 小时 新手友好度 88/100