approvedcompleteApache-2.0
rauthy behind a same-origin proxy + OIDC driver
005-rauthy-same-origin
rauthy as the OIDC IdP, reached exclusively through the app's own origin: the idp service mounts /auth/* as a raw passthrough proxy onto rauthy (RAUTHY_UPSTREAM, default 127.0.0.1:8081), so issuer, callback, and SPA share one origin with no CORS. backend/auth/rauthy.ts is the OIDC authorization-code + PKCE driver (login redirect + callback) plugged into spec 004's driver registry. Dev runs rauthy via docker compose with the same declarative client bootstrap the container uses in prod.
- Depends on
- Establishes
- backend/idp/ (directory)
- backend/auth/rauthy.ts
- docker/rauthy/ (directory)
- docker/compose.dev.yml
- scripts/sync-dev-rauthy-secret.mjs
- Sections
- 005: rauthy behind a same-origin proxy
- 1. Purpose
- 2. Territory
- 3. Behavior
- 4. Out of scope
- 5. Phase A seam (amended by spec 021, 2026-07-20)
- Source
- specs/005-rauthy-same-origin/spec.md @ dc4c9237e12aas of 2026-07-21 ยท shard b141509a265b