Skip to content

Trust canonical host alongside API host - #289

Draft
williammartin wants to merge 1 commit into
trunkfrom
williammartin-relax-api-host-auth
Draft

Trust canonical host alongside API host#289
williammartin wants to merge 1 commit into
trunkfrom
williammartin-relax-api-host-auth

Conversation

@williammartin

Copy link
Copy Markdown
Member

Summary

  • treat APIHost as an additional trusted routing destination rather than replacing Host authorization
  • continue authenticating canonical Host requests and canonical subdomains when APIHost is configured
  • keep API host subdomains and unrelated hosts unauthenticated, including across redirects
  • update ClientOptions.APIHost and HTTP client documentation

Tests

  • go test ./pkg/api -run 'Test(NewHTTPClient|APIHostRouting)$'\n- env -u GH_TOKEN -u GITHUB_TOKEN -u GH_HOST go test ./pkg/api

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@williammartin
williammartin deleted the williammartin-relax-api-host-auth branch September 2, 2026 15:53
@williammartin
williammartin restored the williammartin-relax-api-host-auth branch September 2, 2026 15:54
@williammartin williammartin reopened this Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant