[Saik2789]

Resolves #4026
/claim #4026

Root Cause / Motivation

Reverse proxy authentication (e.g., Authelia, Authentik, Cloudflare Access, OAuth2-Proxy) passes authenticated user identity via HTTP request headers (such as Remote-User and Remote-Email). Previously, Pterodactyl Panel lacked support for header-based authentication, preventing SSO integration behind reverse proxies without manual credential entry.

Key Changes

• Configuration & Environment (config/pterodactyl.php, .env.example): Added pterodactyl.auth.header configuration supporting AUTH_HEADER_ENABLED, AUTH_HEADER_USER, AUTH_HEADER_EMAIL, AUTH_HEADER_NAME, AUTH_HEADER_CREATE_USER, and AUTH_HEADER_TRUSTED_PROXIES.
• Middleware (app/Http/Middleware/AuthenticateWithHttpHeader.php): Implemented header authentication middleware within the web group:
  • Validates upstream reverse proxy against configured CIDRs/IPs via IpUtils::checkIp (or falls back to trusted proxies configuration).
  • Inspects user and email headers (including CGI HTTP_/REMOTE_ server variables).
  • Seamlessly handles active user sessions, switching users if proxy identity changes, and bypassing logout routes.
  • Automatically provisions new accounts via UserCreationService when create_user is enabled, sanitizing usernames to conform to panel validation rules.
  • Authenticates users using AuthManager::login and dispatches DirectLogin event with session regeneration.
• Kernel (app/Http/Kernel.php): Registered AuthenticateWithHttpHeader in the web middleware pipeline after session initialization.
• Test Coverage: Added comprehensive unit tests (tests/Unit/Http/Middleware/AuthenticateWithHttpHeaderTest.php, 11 tests) and integration tests (tests/Integration/Http/Controllers/Auth/AuthenticateWithHttpHeaderTest.php, 8 tests) covering pass-through, proxy validation, existing user login, auto-creation, identity switching, and logout isolation.

Verification & Test Proof

Executed PHP CS Fixer and PHPUnit suites (Unit and Integration):

vendor/bin/php-cs-fixer fix --dry-run --diff app/Http/Middleware/AuthenticateWithHttpHeader.php config/pterodactyl.php app/Http/Kernel.php tests/Integration/Http/Controllers/Auth/AuthenticateWithHttpHeaderTest.php tests/Unit/Http/Middleware/AuthenticateWithHttpHeaderTest.php
# 0 files changed (clean)

vendor/bin/phpunit --bootstrap vendor/autoload.php tests/Unit/Http/Middleware/AuthenticateWithHttpHeaderTest.php
# OK (11 tests, 59 assertions)

vendor/bin/phpunit tests/Integration/Http/Controllers/Auth/AuthenticateWithHttpHeaderTest.php
# OK (8 tests, 41 assertions)

vendor/bin/phpunit --bootstrap vendor/autoload.php tests/Unit
# OK (104 tests, 222 assertions)

Payout Address

Wallet (USDC on Base network): 0x20A0525b47f087f1Cc498cda257A0feB78D2320B
Contact: [EMAIL_REDACTED]