EthanHealy01 96ee014b99 feat(security): SSO auto-login with password login enabled, bypassable via /login?all (#8486)
Closes: #8317

SSO auto-login now redirects to the single provider even when
username/password login is also enabled, and `/login?all` skips that
redirect so a local admin can reach the password form.

Scenario | Result | Visits to the provider
-- | -- | --
Provider sends the user back without signing in | Redirected once, then
showed the form. A third load also showed the form. | 1
/login?all | Showed the form straight away | 0
Provider returns an error | Showed the form with access_denied | 1
Signing in after that error | Landed on /editor and both counts were
cleared | —
Session expires after signing in | Redirected automatically again and
signed back in | 1
Storage blocked | Showed the form and SSO button, no page errors | 0
Same as above but storage not blocked (control) | Redirected | 1
SSO-only mode (password login off) | Redirected once, then stayed on the
“Sign in with Mock” button | 1

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Login**
* Automatic sign-in redirects to the configured SSO provider when
exactly one provider is available, including when password login is
enabled.
* Add `?all` to the login URL to skip the automatic redirect and access
available sign-in options.
* Automatic redirects are skipped during first-time setup when password
sign-in is required, and after a local account is created.
* Redirects are limited to one attempt per browser tab. After signing
out, encountering an SSO error, or blocking browser storage, the sign-in
form remains available. Successful sign-in resets the redirect limit.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-10-28 21:33:43 +00:00
2026-10-23 09:50:03 +01:00
2026-10-23 09:50:03 +01:00
2026-10-21 23:21:07 +01:00

Stirling PDF logo

Stirling PDF - The Open-Source PDF Platform

Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.

Docker Pulls Discord OpenSSF Scorecard GitHub Repo stars

Stirling PDF - Dashboard

Key Capabilities

  • Everywhere you work - Desktop client, browser UI, and self-hosted server with a private API.
  • 50+ PDF tools - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
  • Automation & workflows - No-code pipelines direct in UI with APIs to process millions of PDFs.
  • Enterprise‑grade - SSO, auditing, and flexible on‑prem deployments.
  • Developer platform - REST APIs available for nearly all tools to integrate into your existing systems.
  • Global UI - Interface available in 40+ languages.

For a full feature list, see the docs: https://docs.stirlingpdf.com

Quick Start

docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf

Then open: http://localhost:8080

For full installation options (including desktop and Kubernetes), see our Documentation Guide.

Resources

Support

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

This project uses Task as a unified command runner for all build, dev, and test commands. Run task dev to get started running the editor, run task to see the most common commands, or see the Developer Guide for full details.

For adding translations, see the Translation Guide.

License

Stirling PDF is open-core. See LICENSE for details.

Languages
TypeScript 48.4%
Java 42.9%
Python 3.4%
CSS 2.3%
Shell 0.7%
Other 2.1%