From 7d01f66f849f54296cf2441d8e78f4d2712f0787 Mon Sep 17 00:00:00 2001 From: Nasim Sadat Date: Sat, 24 Oct 2026 00:43:43 +0200 Subject: [PATCH] traefik: apply secure-headers before sso on the dashboard forwardAuth answers unauthenticated requests itself, so a middleware listed after it never sees that redirect: the dashboard's 302 to Keycloak went out without HSTS, nosniff and frame options. Co-Authored-By: Claude Opus 5.5 --- traefik/compose.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/traefik/compose.yaml b/traefik/compose.yaml index 91e4d67..84b81b0 100644 --- a/traefik/compose.yaml +++ b/traefik/compose.yaml @@ -54,7 +54,9 @@ services: traefik.http.routers.dashboard.entrypoints: websecure traefik.http.routers.dashboard.tls.certresolver: le traefik.http.routers.dashboard.service: api@internal - traefik.http.routers.dashboard.middlewares: sso,secure-headers@file + # secure-headers first: sso answers unauthenticated requests itself, and + # middlewares after it never see that response. + traefik.http.routers.dashboard.middlewares: secure-headers@file,sso # Keycloak gate for the dashboard host only (cookie, return hosts and # role are tied to it; README "Adding a project"): unauthenticated # requests are sent to Keycloak, users without petrolyst:traefik-admin