Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support /.well-known/change-password URL #22981

Closed
wants to merge 2 commits into from
Closed

Support /.well-known/change-password URL #22981

wants to merge 2 commits into from

Conversation

beatbrot
Copy link

Google Chrome (since v86) as well as safari and the iCloud keychain support the .well-known/change-password URL.

This PR adds support for that to nextcloud by modifying the default .htaccess file.

This is my first PR to nextcloud, so feedback is appreciated

@rullzer rullzer added this to the Nextcloud 21 milestone Sep 22, 2020
@rullzer rullzer added 3. to review Waiting for reviews enhancement labels Sep 22, 2020
@rullzer
Copy link
Member

rullzer commented Sep 22, 2020

I guess it will also need an update to the docs for nginx

.htaccess Outdated Show resolved Hide resolved
@brad2014
Copy link
Contributor

I guess it will also need an update to the docs for nginx

If nextcloud is hosted at a path inside a server (e.g. www.example.com/cloud/) or behind a reverse-proxy, then the ".well-known" redirects need to be added to the host webserver configuration, so the docs would require updating for apache, etc, as well as nginx.

As suggested by @juliushaertl and @brad2014

Signed-off-by: Christoph Loy <loy.christoph@gmail.com>
@beatbrot
Copy link
Author

@rullzer @brad2014 So, should I also open a PR at nextcloud/documentation?

Also, do you understandy why CI fails?

@nickvergessen
Copy link
Member

The CI failure is random and unrelated

Copy link
Contributor

@kesselb kesselb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Servers should redirect HTTP requests for an origin’s change password url to the actual page on which users may change their password by returning a response with a redirect status of 302, 303, or 307, and a Location header. [FETCH] [HTTP-SEMANTICS] Clients must handle such redirects when requesting a change password url.

Note: The above paragraph restricts servers to using temporary redirect codes. See Issue 13.

https://w3c.github.io/webappsec-change-password-url/#semantics / w3c/webappsec-change-password-url#13

This was referenced Dec 14, 2020
@ChristophWurst
Copy link
Member

It's best if we add a handler based on the new API from #24702, then no special web server config will be requried.

@MorrisJobke
Copy link
Member

It's best if we add a handler based on the new API from #24702, then no special web server config will be requried.

Implemente, so this one can be closed, right?

@MorrisJobke MorrisJobke closed this Jan 7, 2021
@MorrisJobke MorrisJobke removed this from the Nextcloud 22 milestone Jan 7, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Waiting for reviews enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants