Is it possible to turn off all the redirect responses off when accessing the APIs and just return 404? Ie. sending a GET to /foo on the admin port will respond with a /admin/foo redirect. And GET /identities on the public port will respond with a redirect to <adminurl>/admin/identities.

Hi! I don’t think so. Why do you want to disable that?

In a test setup in Kubernetes, the admin API is not exposed publicly and is configured with an internal-only URL, ie. http://admin.kratos.svc.cluster.local:4434/foo for integration with other internal services. But this URL is exposed externally when someone is accessing the public API, as GET /identities will expose the internal admin URL. It generally makes me uncomfortable helping potential attackers introspect the internal setup. 😅

I see, makes sense. You could try setting the

serve.admin.base_url

to some other domain so at least it doesn’t leak your internal domain.

is this the only use for the

base_url

though?

AFAICT, yes

ok shall we open an issue in the repo for this?

yes, I think that makes sense. Contributions are also welcome 🙂

The problem with changing the base_url to some other domain is that it also affects the Link header in the response, that seems to be used for pagination. Ie. Link: http://adminurl/identities?page=0&amp;page_size=250&amp;page_token=foo&amp;per_page=250