After Laravel 13: SAML sign-ins refused with 'Destination mismatch'
Description
Since this afternoon's deploy, single sign-on at Parcelwise and Almwerk fails in the EU: "Destination mismatch".
Cause: the upgrade took the Laravel 13 skeleton's bootstrap/app.php, and our trustProxies(at: …) line went with it, so behind the load balancer the app thinks requests are plain http://. The assertion consumer address we compare with the response's Destination is then http://… and the IdP sent https://….
Steps to reproduce
- Staging behind the load balancer, depot on SAML (Parcelwise test hub).
- Sign in through Entra ID.
Expected: signed in. Actual: "Destination mismatch".
Fix
Put the trustProxies line back, and a smoke test that does a real SAML sign-in through the load balancer, not straight to the app.
Linked issues
- relates to ENG-1200 Upgrade identity-service from Laravel 12 to 13 Done
- is caused by ENG-1200 Upgrade identity-service from Laravel 12 to 13 Done
Comments (3)
They run against the app directly, not through the load balancer. Changing that.
Hotfix (#247) out at 16:55. Parcelwise and Almwerk confirmed sign-ins. 112 failed sign-ins between 15:10 and 16:55.
Why didn't the SAML tests catch it?