Backchannel Logout URI can not be localhost
🪲Bugs✅Solved
Use-case:
In order to test our backchannel logout functionality in development, we want to be able to let Zitadel send backchannel logout requests to localhost.
Environment: Self hosted
Version: v4.16.1
Stack:
We are self hosting Zitadel v4.16.3, which resides in a docker container and is reachable via a Traefik reverse proxy.
We use OIDC and use https://github.com/sevensolutions/traefik-oidc-auth as a Traefik OIDC Plugin.
To configure Zitadel, we use .env files which contain various variables from the defaults.yml and steps.yml file (we prefer using .env directly instead of .yml files). Other aspects, such as organisations, projects, applications, etc are created at container start via a bash script and REST API.
Our backend is written in Python.
What you expected to happen:
Localhost should either be allowed when development mode is active or the DenyList should properly work (or rather not trigger) when overwriting it to be empty via environment variables on setup.
Alternatively some other way to test the backchannel logout route using localhost should be available. If it is, I couldn't find anything.
What went wrong:
Per default, localhost is part of the DenyList of addresses for this resulting in the error code PROJECT-msNebo
Overwriting the DenyList via configuration to be empty does not resolve this issue; localhost is still being blocked. I've checked the environment of the zitadel container and ZITADEL_HTTPCLIENT_DENYLIST truly is set to be empty. This is confusing.
I've found this likely bug while trying to resolve this issue on my own:
https://github.com/zitadel/zitadel/issues/12573#issuecomment-5281378449
In order to test our backchannel logout functionality in development, we want to be able to let Zitadel send backchannel logout requests to localhost.
Environment: Self hosted
Version: v4.16.1
Stack:
We are self hosting Zitadel v4.16.3, which resides in a docker container and is reachable via a Traefik reverse proxy.
We use OIDC and use https://github.com/sevensolutions/traefik-oidc-auth as a Traefik OIDC Plugin.
To configure Zitadel, we use .env files which contain various variables from the defaults.yml and steps.yml file (we prefer using .env directly instead of .yml files). Other aspects, such as organisations, projects, applications, etc are created at container start via a bash script and REST API.
Our backend is written in Python.
What you expected to happen:
Localhost should either be allowed when development mode is active or the DenyList should properly work (or rather not trigger) when overwriting it to be empty via environment variables on setup.
Alternatively some other way to test the backchannel logout route using localhost should be available. If it is, I couldn't find anything.
What went wrong:
Per default, localhost is part of the DenyList of addresses for this resulting in the error code PROJECT-msNebo
Overwriting the DenyList via configuration to be empty does not resolve this issue; localhost is still being blocked. I've checked the environment of the zitadel container and ZITADEL_HTTPCLIENT_DENYLIST truly is set to be empty. This is confusing.
I've found this likely bug while trying to resolve this issue on my own:
https://github.com/zitadel/zitadel/issues/12573#issuecomment-5281378449
GitHub
A traefik Plugin for securing the upstream service with OpenID Connect acting as a relying party. - sevensolutions/traefik-oidc-auth
A traefik Plugin for securing the upstream service with OpenID Connect acting as a relying party. - sevensolutions/traefik-oidc-authGitHub
Preflight Checklist I could not find a solution in the existing issues, docs, nor discussions I have joined the ZITADEL chat Describe your problem For local development, we need the backchannel log...
