Not handling `X-Forwarded-Host` header during custom authentication redirection

[shibayan]

Describe the bug

If you set up Front Door (or L7 Reverse proxy) in front of Static Web App and add Azure AD or OpenID Connect authentication after adding a custom domain to Front Door, the redirection will not be done on the custom domain.

It looks to me like a common problem of not handling X-Forwarded-Host correctly.

This can be handled by setting forwardProxy in httpSettings for Easy Auth in the App Service, but cannot be avoided in Static Web Apps because the setting is not provided.

https://docs.microsoft.com/en-us/azure/templates/microsoft.web/sites/config-authsettingsv2?tabs=json#httpsettings-object

To Reproduce
Steps to reproduce the behavior:

1. Create Static Web App
2. Create a Front Door and add Static Web App as a backend
3. Add custom domain to Front Door
4. Setup SWA custom authentication for custom domain
5. Access to https://customdomain/.auth/login/***

Expected behavior

The custom domain being accessed (the custom domain set in Front Door) is maintained even when redirected to the IdP.

[k-miyake]

Hi Team,

Since many applications use authentication and custom domains, it is practically impossible to place Front Door at the front of SWA if this issue is not resolved.

[anthonychu]

We’re working on a solution for this so that auth will work behind Front Door and other CDNs.

[shibayan]

Thanks for the reply. Do you have a release schedule?

[miwebst]

This should be available in the next month.

[joslinmicrosoft]

As an update, the solution for this issue has been released. Please see the documentation at https://docs.microsoft.com/azure/static-web-apps/configuration#forwarding-gateway for instructions on configuring your Static Web App with allowed forwarded hosts.

[shibayan]

Thanks for the quick fix. I have confirmed that setting the hostname to the newly added forwardingGateway solves this problem.

[msikka93]

Tatsuro Shibamura (@shibayan) shibayan I am also facing the same problem. We have an application gateway in front of static web app. The custom domain is assigned to the private IP of Application Gateway. After adding AAD auth in static web app, the custom domain redirects to the static web app URL. How can I avoid that? Do you have some insights? Do we need to add this code in staticwebapp.config.json? "forwardingGateway": {
"allowedForwardedHosts": [
"example.org",
"www.example.org",
"staging.example.org"
]
}