Dex

2026-10-23 17:23:29 -04:00
parent ae25026d9f
commit caf8839edd
4 changed files with 34 additions and 4 deletions
@@ -77,7 +77,9 @@ EMAIL_USE_TLS = os.environ.get("EMAIL_USE_TLS", "1") == "1"
 EMAIL_TIMEOUT = 10
 DEFAULT_FROM_EMAIL = os.environ.get("DEFAULT_FROM_EMAIL", "accounts@eom.dev")

-DEX_ISSUER = os.environ.get("DEX_ISSUER", "https://dex.eom.dev").rstrip("/")
+# OIDC issuer identifiers are exact strings, including a trailing slash.
+# Never normalize this value: discovery and ID-token iss must match it exactly.
+DEX_ISSUER = os.environ.get("DEX_ISSUER", "https://dex.eom.dev/")
 if urlsplit(DEX_ISSUER).scheme != "https" or not urlsplit(DEX_ISSUER).hostname:
    raise ImproperlyConfigured("DEX_ISSUER must use HTTPS.")
 DEX_CLIENT_ID = os.environ.get("DEX_CLIENT_ID", "www-membership")