Skip to content

fix: preserve query string from X-Forwarded-Uri in decision handler#1265

Open
LennartKoot wants to merge 1 commit intoory:masterfrom
ShipitSmarter:fix/preserve-query-string-in-decision-mode
Open

fix: preserve query string from X-Forwarded-Uri in decision handler#1265
LennartKoot wants to merge 1 commit intoory:masterfrom
ShipitSmarter:fix/preserve-query-string-in-decision-mode

Conversation

@LennartKoot
Copy link

@LennartKoot LennartKoot commented Mar 19, 2026

This PR sets the r.URL.RawQuery to a potential query string provided within the X-Forwarded-Uri header. This was dropped in an earlier version because including it in the path broke the URL matcher, but fully stripping the query string breaks authenticator that rely on query parameters.

Related issue(s)

#1264

Checklist

  • I have read the contributing guidelines.
  • I have referenced an issue containing the design document if my change
    introduces a new feature.
  • I am following the
    contributing code guidelines.
  • I have read the security policy.
  • I confirm that this pull request does not address a security
    vulnerability. If this pull request addresses a security vulnerability, I
    confirm that I got the approval (please contact
    security@ory.com) from the maintainers to push
    the changes.
  • I have added tests that prove my fix is effective or that my feature
    works.
  • I have added or changed the documentation.

Further Comments

@LennartKoot LennartKoot requested review from a team and aeneasr as code owners March 19, 2026 13:47
@CLAassistant
Copy link

CLAassistant commented Mar 19, 2026

CLA assistant check
All committers have signed the CLA.

@LennartKoot LennartKoot force-pushed the fix/preserve-query-string-in-decision-mode branch from ef9e5fb to e127fb1 Compare March 19, 2026 13:57
@LennartKoot LennartKoot force-pushed the fix/preserve-query-string-in-decision-mode branch from e127fb1 to 569188b Compare March 19, 2026 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants