Skip to content

fix(auth): strip trailing slash from base URL to avoid double-slash paths - #1775

Open
Waleed-thisone wants to merge 4 commits into
supabase:mainfrom
Waleed-thisone:fix/auth-double-slash-url
Open

Waleed-thisone wants to merge 4 commits into
supabase:mainfrom
Waleed-thisone:fix/auth-double-slash-url

Conversation

@Waleed-thisone

Copy link
Copy Markdown

What kind of change does this PR introduce?

Bug fix for #1763.

What is the current behavior?

Clients constructed with an Auth base URL ending in / (e.g. https://project.example/auth/v1/) build double-slash endpoint paths such as /auth/v1//authorize for OAuth and /auth/v1//user for regular requests, because the base URL is stored verbatim in GoTrueBaseAPI and paths are built as f"{self._url}/{path}".

Fixes #1763

What is the new behavior?

The base URL is normalized once in AsyncGoTrueBaseAPI.__init__ (and the generated sync equivalent) by stripping any trailing slash, so every endpoint (client requests, admin API, OAuth authorize URL) is built from a clean base URL.

Additional context

  • The _sync base API file was changed by hand to the exact line unasync generates, to avoid unrelated formatting churn.
  • Added regression tests for both async and sync clients covering the OAuth authorize URL and a mocked /user request with a trailing-slash base URL.
  • Local test run: the new tests pass, and the rest of the auth suite is unchanged vs the upstream baseline (the remaining failures require the live GoTrue docker infra).

cc @silentworks for review, as suggested in CONTRIBUTING.md.

@Waleed-thisone

Copy link
Copy Markdown
Author

Heads-up: I noticed #1766 by @hsusul tackles the same issue and was opened before this PR — I only spotted it after filing mine, sorry for the duplicate.

Happy for the maintainers to merge whichever you prefer. If #1766 goes in, the regression tests in this PR (authorize URL + mocked /user request, for both the sync and async clients) could still be useful — feel free to cherry-pick them, or I can rebase them onto that change / open a tests-only PR if that's helpful.

Thanks for maintaining the project!

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Auth builds double-slash endpoint paths for base URLs ending in /

1 participant