Skip to content

feat(login): add per-account custom request headers - #17926

Open
laugmanuel wants to merge 1 commit into
nextcloud:masterfrom
laugmanuel:feat/5821-custom-request-headers
Open

laugmanuel wants to merge 1 commit into
nextcloud:masterfrom
laugmanuel:feat/5821-custom-request-headers

Conversation

@laugmanuel

Copy link
Copy Markdown

Allow additional request headers per account, for example the credentials of a pre-authentication proxy

This fixes #5821

  • Login: collapsible "Advanced options" below the QR button with a "Name: value" field. Headers are captured only for server checks the user started, registered provisionally for the typed origin and stored in the account only if the account ends up on that origin.
  • Accounts: headers are kept as account user data, registered at app start, reconciled after an account was removed and editable later via "Custom headers" in the account menu.
  • Web views: GET requests to a registered origin go through the library client, which follows redirects only within that origin and syncs cookies on every hop; main frame redirects navigate to their target. Other requests of the page's fetch and XMLHttpRequest calls get the headers from a per-origin page script; fetch rejects redirects for them.
  • Glide: images of registered origins are loaded through the library client.
  • The transport for web views and Glide verifies host names like the web view does, accepting a mismatch only for certificates the user accepted.

This PR requires nextcloud/android-library#2192 and a library bump.

🖼️ Screenshots

Screenshot_20261031_223558_Nextcloud Screenshot_20261031_223551_Nextcloud Screenshot_20261031_223644_Nextcloud

🏁 Checklist

  • ⛑️ Tests (unit and/or integration) are included or not needed
  • 🔙 Backport requests are created or not needed: /backport to stable-xx.x
  • 📅 Milestone is set
  • 🌸 PR title is meaningful (if it should be in the changelog: is it meaningful to users?)

🤖 AI (if applicable)

  • The content of this PR was partly or fully generated using Claude Code with Claude Opus 5.5

Allow additional request headers per account, for example the
credentials of a pre-authentication proxy

- Login: collapsible "Advanced options" below the QR button with a
  "Name: value" field. Headers are captured only for server checks the
  user started, registered provisionally for the typed origin and stored
  in the account only if the account ends up on that origin.
- Accounts: headers are kept as account user data, registered at app
  start, reconciled after an account was removed and editable later via
  "Custom headers" in the account menu.
- Web views: GET requests to a registered origin go through the library
  client, which follows redirects only within that origin and syncs
  cookies on every hop; main frame redirects navigate to their target.
  Other requests of the page's fetch and XMLHttpRequest calls get the
  headers from a per-origin page script; fetch rejects redirects for
  them.
- Glide: images of registered origins are loaded through the library
  client.
- The transport for web views and Glide verifies host names like the web
  view does, accepting a mismatch only for certificates the user accepted.

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Manuel Laug <laugmanuel@gmail.com>
@github-actions

Copy link
Copy Markdown

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Custom headers for all requests

1 participant