Closes #14, closes #15. CHI_AUTH_URL defaulted to https://chi.uc.edu/auth/, which is only correct for a consumer that happens to sit on that host. CHI Auth redirects back to a bare path — its safe_path refuses anything else — and the browser resolves that against whichever host it was sent to. So an app on chi-dev.uc.edu sent its users to chi.uc.edu to sign in, set the session cookie there, and landed them on https://chi.uc.edu/<its own path>: a different host, which may not serve the app at all. Single sign-on does not span domains by design, because the cookie and the SSO-* headers are per-domain. It works today only because every deployed consumer happens to sit on the host its setting names. The default is now /auth/, which is right on every host since each vhost proxies it for itself, and W007 warns when the configured value has a scheme or a netloc. A warning rather than an error: an absolute value pointing at the app's own host does work, and an existing deployment should not fail to start over it. _already_chi_auth has always matched on path so both forms parse, so nothing else had to change. The sign-in template hard-coded the same host for its stylesheet and favicon. That matters more in a package than in an application: every consuming project inherited chi.uc.edu whether or not it was right for them, and a project that had already moved its own assets to a configurable ASSETS_URL got that host back the moment it rendered our sign-in page. ASSETS_URL is now a setting like any other, exposed through the existing context processor. Its default stays absolute, unlike CHI_AUTH_URL's. The two are not the same case: a wrong CHI_AUTH_URL breaks sign-in, while a cross-origin stylesheet only costs a round trip, and a consumer that says nothing should keep the styling it has. A project served under several hostnames, or one tightening a CSP, sets "/assets/". Behavioural change to a default, hence the minor bump rather than a patch. A consumer relying on the old CHI_AUTH_URL default gets a relative URL now; that is correct wherever the old value was, and correct in places the old value was not. 103 tests, 6 new. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Commits

Commits on Aug 19, 2026

Make CHI_AUTH_URL relative and ASSETS_URL configurable; 3.2.0