connect

Security-Onion-Solutions · Nov 11, 2024 · d4ed34d · d4ed34d
1 parent 57a9992
commit d4ed34d
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/salt/nginx/etc/nginx.conf b/salt/nginx/etc/nginx.conf
@@ -235,7 +235,7 @@ http {
 
 		location /connect/ {
 			if ($http_authorization !~ "Bearer .*") {
-				return 403;
+				return 401;
 			}
 			rewrite               /connect/(.*) /api/$1 break;
 			proxy_pass            http://{{ GLOBALS.manager }}:9822/;
@@ -360,13 +360,19 @@ http {
 		error_page 429 = @error429;
 
 		location @error401 {
+			if ($request_uri ~* (^/connect/.*|^/oauth2/.*)) {
+				return	  401;
+			}
 			if ($request_uri ~* ^/(?!(^/api/.*))) {
 				add_header    Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400";
 			}
 			return        302 /auth/self-service/login/browser;
 		}
 
 		location @error403 {
+			if ($request_uri ~* (^/connect/.*|^/oauth2/.*)) {
+				return	  403;
+			}
 			add_header    Set-Cookie "ory_kratos_session=;Path=/;Max-Age=0;expires=Thu, 01 Jan 1970 00:00:00 GMT;";
 			return        302 /auth/self-service/login/browser;
 		}