Releases: oauth2-proxy/oauth2-proxy
Releases · oauth2-proxy/oauth2-proxy
V7.1.0
Release Highlights
- New improved design for sign in and error pages based on bulma framework
- Refactored templates loading
robots.txt
,sign_in.html
anderror.html
can now be provided individually in--custom-templates-dir
- If any of the above are not provided, defaults are used
- Defaults templates be found in pkg/app/pagewriter
- Introduction of basic prometheus metrics
- Introduction of Traefik based local testing/example environment
- Support for request IDs to allow request co-ordination of log lines
Important Notes
- GHSA-652x-m2gr-hppm GitLab group authorization stopped working in v7.0.0, the functionality has now been restored, please see the linked advisory for details
- #1103 Upstream request signatures via
--signature-key
is
deprecated. Support will be removed completely in v8.0.0. - 1087 The default logging templates have been updated to include {{.RequestID}}
- #1117 The
--gcp-healthchecks
option is now deprecated. It will be removed in a future release.- To migrate, you can change your application health checks for OAuth2 Proxy to point to
the--ping-path
value. - You can also migrate the user agent based health check using the
--ping-user-agent
option. Set it toGoogleHC/1.0
to allow health checks on the path/
from the Google health checker.
- To migrate, you can change your application health checks for OAuth2 Proxy to point to
Breaking Changes
N/A
Changes since v7.0.1
- GHSA-652x-m2gr-hppm
--gitlab-group
GitLab Group Authorization config flag stopped working in v7.0.0 (@NickMeves, @papey) - #1113 Panic with GitLab project repository auth (@piersharding)
- #1116 Reinstate preferEmailToUser behaviour for basic auth sessions (@JoelSpeed)
- #1115 Fix upstream proxy appending ? to requests (@JoelSpeed)
- #1117 Deprecate GCP HealthCheck option (@JoelSpeed)
- #1104 Allow custom robots text pages (@JoelSpeed)
- #1045 Ensure redirect URI always has a scheme (@JoelSpeed)
- #1103 Deprecate upstream request signatures (@NickMeves)
- #1087 Support Request ID in logging (@NickMeves)
- #914 Extract email from id_token for azure provider when oidc is configured (@weinong)
- #1047 Refactor HTTP Server and add ServerGroup to handle graceful shutdown of multiple servers (@JoelSpeed)
- #1070 Refactor logging middleware to middleware package (@NickMeves)
- #1064 Add support for setting groups on session when using basic auth (@stefansedich)
- #1056 Add option for custom logos on the sign in page (@JoelSpeed)
- #1054 Update to Go 1.16 (@JoelSpeed)
- #1052 Update golangci-lint to latest version (v1.36.0) (@JoelSpeed)
- #1043 Refactor Sign In Page rendering and capture all page rendering code in pagewriter package (@JoelSpeed)
- #1029 Refactor error page rendering and allow debug messages on error (@JoelSpeed)
- #1028 Refactor templates, update theme and provide styled error pages (@JoelSpeed)
- #1039 Ensure errors in tests are logged to the GinkgoWriter (@JoelSpeed)
- #980 Add Prometheus metrics endpoint (@neuralsandwich)
- #1023 Update docs on Traefik ForwardAuth support without the use of Traefik 'errors' middleware (@pcneo83)
- #1091 Add an example with Traefik (configuration without Traefik 'errors' middleware) (@fcollonval)
V7.0.1
Release Highlights
- Fixed a bug that meant that flag ordering mattered
- Fixed a bug where response headers for groups were not being flattened
Important Notes
N/A
Breaking Changes
N/A
Changes since v7.0.0
- #1020 Flatten array-based response headers (@NickMeves)
- #1026 Ensure config flags get parsed correctly when other flags precede them (@JoelSpeed)
v7.0.0
Release Highlights
- Major internal improvements to provider interfaces
- Added group authorization support
- Improved support for external auth for Traefik
- Introduced alpha configuration format to allow users to trial new configuration format and alpha features
- GitLab provider now supports restricting to members of a project
- Keycloak provider now supports restricting users to members of a set of groups
- (Alpha) Flexible header configuration allowing user defined mapping of session claims to header values
Important Notes
- GHSA-4mf2-f3wh-gvf2 The whitelist domain feature has been updated to fix a vulnerability that was identified, please see the linked advisory for details
- #964 Redirect URL generation will attempt secondary strategies
in the priority chain if any fail theIsValidRedirect
security check. Previously any failures fell back to/
. - #953 Keycloak will now use
--profile-url
if set for the userinfo endpoint
instead of--validate-url
.--validate-url
will still work for backwards compatibility. - #957 To use X-Forwarded-{Proto,Host,Uri} on redirect detection,
--reverse-proxy
must betrue
. - #936
--user-id-claim
option is deprecated and replaced by--oidc-email-claim
- #630 Gitlab projects needs a Gitlab application with the extra
read_api
enabled - #849
/oauth2/auth
allowed_groups
querystring parameter can be paired with theallowed-groups
configuration option.- The
allowed_groups
querystring parameter can specify multiple comma delimited groups. - In this scenario, the user must have a group (from their multiple groups) present in both lists to not get a 401 or 403 response code.
- Example:
- OAuth2-Proxy globally sets the
allowed_groups
asengineering
. - An application using Kubernetes ingress uses the
/oauth2/auth
endpoint withallowed_groups
querystring set tobackend
. - A user must have a session with the groups
["engineering", "backend"]
to pass authorization. - Another user with the groups
["engineering", "frontend"]
would fail the querystring authorization portion.
- OAuth2-Proxy globally sets the
- The
- #905 Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
- #826
skip-auth-strip-headers
now applies to all requests, not just those where authentication would be skipped. - #797 The behavior of the Google provider Groups restriction changes with this
- Either
--google-group
or the new--allowed-group
will work for Google now (--google-group
will be used if both are set) - Group membership lists will be passed to the backend with the
X-Forwarded-Groups
header - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
- Previously, group membership was only checked on session creation and refresh.
- Either
- #789
--skip-auth-route
is (almost) backwards compatible with--skip-auth-regex
- We are marking
--skip-auth-regex
as DEPRECATED and will remove it in the next major version. - If your regex contains an
=
and you want it for all methods, you will need to add a leading=
(this is the area where--skip-auth-regex
doesn't port perfectly)
- We are marking
- #575 Sessions from v5.1.1 or earlier will no longer validate since they were not signed with SHA1.
- Sessions from v6.0.0 or later had a graceful conversion to SHA256 that resulted in no reauthentication
- Upgrading from v5.1.1 or earlier will result in a reauthentication
- #616 Ensure you have configured oauth2-proxy to use the
groups
scope.- The user may be logged out initially as they may not currently have the
groups
claim however after going back through login process wil be authenticated.
- The user may be logged out initially as they may not currently have the
- #839 Enables complex data structures for group claim entries, which are output as Json by default.
Breaking Changes
- #964
--reverse-proxy
must be true to trustX-Forwarded-*
headers as canonical.
These are used throughout the application in redirect URLs, cookie domains and host logging logic. These are the headers:X-Forwarded-Proto
instead ofreq.URL.Scheme
X-Forwarded-Host
instead ofreq.Host
X-Forwarded-Uri
instead ofreq.URL.RequestURI()
- #953 In config files & envvar configs,
keycloak_group
is now the pluralkeycloak_groups
.
Flag configs are still--keycloak-group
but it can be passed multiple times. - #911 Specifying a non-existent provider will cause OAuth2-Proxy to fail on startup instead of defaulting to "google".
- #797 Security changes to Google provider group authorization flow
- If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
- Previously, group membership was only checked on session creation and refresh.
- If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
- #722 When a Redis session store is configured, OAuth2-Proxy will fail to start up unless connection and health checks to Redis pass
- #800 Fix import path for v7. The import path has changed to support the go get installation.
- You can now
go get github.com/oauth2-proxy/oauth2-proxy/v7
to get the latestv7
version of OAuth2 Proxy - Import paths for package are now under
v7
, eggithub.com/oauth2-proxy/oauth2-proxy/v7/pkg/<module>
- You can now
- #753 A bug in the Azure provider prevented it from properly passing the configured protected
--resource
via the login url. If this option was used in the past, behavior will change with this release as it will
affect the tokens returned by Azure. In the past, the tokens were always forhttps://graph.microsoft.com
(the default)
and will now be for the configured resource (if it exists, otherwise it will run into errors) - #754 The Azure provider now has token refresh functionality implemented. This means that there won't
be any redirects in the browser anymore when tokens expire, but instead a token refresh is initiated
in the background, which leads to new tokens being returned in the cookies.- Please note that
--cookie-refresh
must be 0 (the default) or equal to the token lifespan configured in Azure AD to make
Azure token refresh reliable. Setting this value to 0 means that it relies on the provider implementation
to decide if a refresh is required.
- Please note that
Changes since v6.1.1
- GHSA-4mf2-f3wh-gvf2 Subdomain checking of whitelisted domains could allow unintended redirects (@NickMeves)
- #1002 Use logger for logging refreshed session in azure and gitlab provider (@Bibob7)
- #799 Use comma separated multiple values for header (@lilida)
- #903 Add docs and generated reference for Alpha configuration (@JoelSpeed)
- #995 Add Security Policy (@JoelSpeed)
- #964 Require
--reverse-proxy
true to trustX-Forwareded-*
type headers (@NickMeves) - #970 Fix joined cookie name for those containing underline in the suffix (@peppered)
- #953 Migrate Keycloak to EnrichSession & support multiple groups for authorization (@NickMeves)
- #957 Use X-Forwarded-{Proto,Host,Uri} on redirect as last resort (@linuxgemini)
- #630 Add support for Gitlab project based authentication (@factorysh)
- #907 Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
- #938 Cleanup missed provider renaming refactor methods (@NickMeves)
- #816 (via #936) Support non-list group claims (@loafoe)
- #936 Refactor OIDC Provider and support groups from Profile URL (@NickMeves)
- #869 Streamline provider interface method names and signatures (@NickMeves)
- #849 Support group authorization on
oauth2/auth
endpoint viaallowed_groups
querystring (@NickMeves) - #925 Fix ba...
v6.1.1
Release Highlights
- Fixed a bug which prevented static upstreams from being used
- Fixed a bug which prevented file based upstreams from being used
- Ensure that X-Forwarded-Host is respected consistently
Important Notes
N/A
Breaking
N/A
Changes since v6.1.0
- #729 Use X-Forwarded-Host consistently when set (@NickMeves)
- #746 Fix conversion of static responses in upstreams (@JoelSpeed)
v6.1.0
Release Highlights
- Redis session stores now support authenticated connections
- Error logging can now be separated from info logging by directing error logs to stderr
- Added --session-cookie-minimal flag which helps prevent large session cookies
- Improvements to force-https behaviour
- Allow requests to skip authentication based on their source IP
Important Notes
- #632 There is backwards compatibility to sessions from v5
- Any unencrypted sessions from before v5 that only contained a Username & Email will trigger a reauthentication
Breaking Changes
N/A
Changes since v6.0.0
- #742 Only log no cookie match if cookie domains specified (@JoelSpeed)
- #562 Create generic Authorization Header constructor (@JoelSpeed)
- #715 Ensure session times are not nil before printing them (@JoelSpeed)
- #714 Support passwords with Redis session stores (@NickMeves)
- #719 Add Gosec fixes to areas that are intermittently flagged on PRs (@NickMeves)
- #718 Allow Logging to stdout with separate Error Log Channel
- #690 Address GoSec security findings & remediate (@NickMeves)
- #689 Fix finicky logging_handler_test from time drift (@NickMeves)
- #700 Allow OIDC Bearer auth IDTokens to have empty email claim & profile URL (@NickMeves)
- #699 Align persistence ginkgo tests with conventions (@NickMeves)
- #696 Preserve query when building redirect
- #561 Refactor provider URLs to package level vars (@JoelSpeed)
- #682 Refactor persistent session store session ticket management (@NickMeves)
- #688 Refactor session loading to make use of middleware pattern (@JoelSpeed)
- #593 Integrate upstream package with OAuth2 Proxy (@JoelSpeed)
- #687 Refactor HTPasswd Validator (@JoelSpeed)
- #624 Allow stripping authentication headers from whitelisted requests with
--skip-auth-strip-headers
(@NickMeves) - #673 Add --session-cookie-minimal option to create session cookies with no tokens (@NickMeves)
- #632 Reduce session size by encoding with MessagePack and using LZ4 compression (@NickMeves)
- #675 Fix required ruby version and deprecated option for building docs (@mkontani)
- #669 Reduce docker context to improve build times (@JoelSpeed)
- #668 Use req.Host in --force-https when req.URL.Host is empty (@zucaritask)
- #660 Use builder pattern to simplify requests to external endpoints (@JoelSpeed)
- #591 Introduce upstream package with new reverse proxy implementation (@JoelSpeed)
- #576 Separate Cookie validation out of main options validation (@JoelSpeed)
- #656 Split long session cookies more precisely (@NickMeves)
- #619 Improve Redirect to HTTPs behaviour (@JoelSpeed)
- #654 Close client connections after each redis test (@JoelSpeed)
- #542 Move SessionStore tests to independent package (@JoelSpeed)
- #577 Move Cipher and Session Store initialisation out of Validation (@JoelSpeed)
- #635 Support specifying alternative provider TLS trust source(s) (@k-wall)
- #649 Resolve an issue where an empty healthcheck URL and ping-user-agent returns the healthcheck response (@jordancrawfordnz)
- #662 Do not add Cache-Control header to response from auth only endpoint (@johejo)
- #552 Implements --trusted-ip option to allow clients behind specified IPs or CIDR ranges to bypass authentication (@Izzette)
- #733 dist.sh: remove go version from asset links (@syscll)
v6.0.0
Release Highlights
- Migrated to an independent GitHub organisation
- Added local test environment examples using docker-compose and kind
- Error pages will now be rendered when upstream connections fail
- Non-Existent options in config files will now return errors on startup
- Sessions are now always encrypted, independent of configuration
Important Notes
- (Security) Fix for open redirect vulnerability.
- More invalid redirects that lead to open-redirects were reported
- An extensive test suite has been added to prevent future regressions
- #453 Responses to endpoints with a proxy prefix will now return headers for preventing browser caching.
Breaking Changes
- #464 Migration from Pusher to independent org may have introduced breaking changes for your environment.
- See the changes listed below for PR #464 for full details
- Binaries renamed from
oauth2_proxy
tooauth2-proxy
- #440 Switch Azure AD Graph API to Microsoft Graph API
- The Azure AD Graph API has been deprecated and is being replaced by the Microsoft Graph API.
If your application relies on the access token being passed to it to access the Azure AD Graph API, you should migrate your application to use the Microsoft Graph API.
Existing behaviour can be retained by setting-resource=https://graph.windows.net
.
- The Azure AD Graph API has been deprecated and is being replaced by the Microsoft Graph API.
- #484 Configuration loading has been replaced with Viper and PFlag
- Flags now require a
--
prefix before the option - Previously flags allowed either
-
or--
to prefix the option name - Eg
-provider
must now be--provider
- Flags now require a
- #487 Switch flags to StringSlice instead of StringArray
- Options that take multiple arguments now split strings on commas if present
- Eg
--foo=a,b,c,d
would result in the valuesa
,b
,c
andd
instead of a singlea,b,c,d
value as before
- #535 Drop support for pre v3.1 cookies
- The encoding for session cookies was changed starting in v3.1.0, support for the previous encoding is now dropped
- If you are upgrading from a version earlier than this, please upgrade via a version between v3.1.0 and v5.1.1
- #537 Drop Fallback to Email if User not set
- Previously, when a session was loaded, if the User was not set, it would be replaced by the Email.
This behaviour was inconsistent as it required the session to be stored and then loaded to function properly. - This behaviour has now been removed and the User field will remain empty if it was not set when the session was saved.
- In some scenarios
X-Forwarded-User
will now be empty. UseX-Forwarded-Email
instead. - In some scenarios, this may break setting Basic Auth on upstream or responses.
Use--prefer-email-to-user
to restore falling back to the Email in these cases.
- Previously, when a session was loaded, if the User was not set, it would be replaced by the Email.
- #556 Remove unintentional auto-padding of secrets that were too short
- Previously, after cookie-secrets were opportunistically base64 decoded to raw bytes,
they were padded to have a length divisible by 4. - This led to wrong sized secrets being valid AES lengths of 16, 24, or 32 bytes. Or it led to confusing errors
reporting an invalid length of 20 or 28 when the user input cookie-secret was not that length. - Now we will only base64 decode a cookie-secret to raw bytes if it is 16, 24, or 32 bytes long. Otherwise, we will convert
the direct cookie-secret to bytes without silent padding added.
- Previously, after cookie-secrets were opportunistically base64 decoded to raw bytes,
- #412/#559 Allow multiple cookie domains to be specified
- Multiple cookie domains may now be configured. The longest domain that matches will be used.
- The config options
cookie_domain
is nowcookie_domains
- The environment variable
OAUTH2_PROXY_COOKIE_DOMAIN
is nowOAUTH2_PROXY_COOKIE_DOMAINS
- #414 Always encrypt sessions regardless of config
- Previously, sessions were encrypted only when certain options were configured.
This lead to confusion and misconfiguration as it was not obvious when a session should be encrypted. - Cookie Secrets must now be 16, 24 or 32 bytes.
- If you need to change your secret, this will force users to reauthenticate.
- Previously, sessions were encrypted only when certain options were configured.
- #548 Separate logging options out of main options structure
- Fixes an inconsistency in the
--exclude-logging-paths
option by renaming it to--exclude-logging-option
. - This flag may now be given multiple times as with other list options
- This flag also accepts comma separated values
- Fixes an inconsistency in the
- #639 Change how gitlab-group is parsed on options
- Previously, the flag gitlab-group used comma seperated values, while the config option used space seperated values.
- This fixes the config value to use slices internally.
- The config option
gitlab_group
is nowgitlab_groups
- The environment variable
OAUTH2_PROXY_GITLAB_GROUP
is nowOAUTH2_PROXY_GITLAB_GROUPS
Changes since v5.1.1
- GHSA-5m6c-jp6f-2vcv New OpenRedirect cases have been found (@JoelSpeed)
- #639 Change how gitlab-group is parsed on options (@linuxgemini)
- #615 Kubernetes example based on Kind cluster and Nginx ingress (@EvgeniGordeev)
- #596 Validate Bearer IDTokens in headers with correct provider/extra JWT Verifier (@NickMeves)
- #620 Add HealthCheck middleware (@JoelSpeed)
- #597 Don't log invalid redirect if redirect is empty (@JoelSpeed)
- #604 Add Keycloak local testing environment (@EvgeniGordeev)
- #539 Refactor encryption ciphers and add AES-GCM support (@NickMeves)
- #601 Ensure decrypted user/email are valid UTF8 (@JoelSpeed)
- #560 Fallback to UserInfo is User ID claim not present (@JoelSpeed)
- #598 acr_values no longer sent to IdP when empty (@ScottGuymer)
- #548 Separate logging options out of main options structure (@JoelSpeed)
- #567 Allow health/ping request to be identified via User-Agent (@chkohner)
- #536 Improvements to Session State code (@JoelSpeed)
- #573 Properly parse redis urls for cluster and sentinel connections (@amnay-mo)
- #574 render error page on 502 proxy status (@amnay-mo)
- #559 Rename cookie-domain config to cookie-domains (@JoelSpeed)
- #569 Updated autocompletion for
--
long options. (@Izzette) - #489 Move Options and Validation to separate packages (@JoelSpeed)
- #556 Remove unintentional auto-padding of secrets that were too short (@NickMeves)
- #538 Refactor sessions/utils.go functionality to other areas (@NickMeves)
- #503 Implements --real-client-ip-header option to select the header from which to obtain a proxied client's IP (@Izzette)
- #529 Add local test environments for testing changes and new features (@JoelSpeed)
- #537 Drop Fallback to Email if User not set (@JoelSpeed)
- #535 Drop support for pre v3.1 cookies (@JoelSpeed)
- #533 Set up code coverage within Travis for Code Climate (@JoelSpeed)
- #514 Add basic string functions to templates (@n-i-x)
- #524 Sign cookies with SHA256 (@NickMeves)
- #515 Drop configure script in favour of native Makefile env and checks (@JoelSpeed)
- #519 Support context in providers (@johejo)
- #487 Switch flags to PFlag to remove StringArray (@JoelSpeed)
- #484 Replace configuration loading with Viper (@JoelSpeed)
- #499 Add `-...
v5.1.1
Security Release
Release Highlights
N/A
Important Notes
- (Security) Fix for open redirect vulnerability.
- A bad actor using encoded whitespace in redirect URIs can redirect a session to another domain
Breaking Changes
N/A
Changes since v5.1.0
- GHSA-j7px-6hwj-hpjg Fix Open Redirect Vulnerability with encoded Whitespace characters (@JoelSpeed)
Special thanks to @rootxharsh @iamnoooob and @Mik317 for bringing this issue to our attention
v5.1.0
Release Hightlights
- Bump to Go 1.14
- Reduced number of Google API requests for group validation
- Support for Redis Cluster
- Support for overriding hosts in hosts file
Important Notes
- [#335] The session expiry for the OIDC provider is now taken from the Token Response (expires_in) rather than from the id_token (exp)
Breaking Changes
N/A
Changes since v5.0.0
- #450 Fix http.Cookie SameSite is not copied (@johejo)
- #445 Expose
acr_values
to all providers (@holyjak) - #419 Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)
- #444 Support prompt in addition to approval-prompt (@holyjak)
- #435 Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)
- #400 Add
nsswitch.conf
to Docker image to allow hosts file to work (@luketainton) - #385 Use the
Authorization
header instead ofaccess_token
for refreshing GitHub Provider sessions (@ibuclaw) - #372 Allow fallback to secondary verified email address in GitHub provider (@dmnemec)
- #335 OIDC Provider support for empty id_tokens in the access token refresh response (@howzat)
- #363 Extension of Redis Session Store to Support Redis Cluster (@yan-dblinf)
- #353 Fix login page fragment handling after soft reload on Firefox (@ffdybuster)
- #355 Add Client Secret File support for providers that rotate client secret via file system (@pasha-r)
- #401 Give the option to pass email address in the Basic auth header instead of upstream usernames. (@Spindel)
- #405 The
/sign_in
page now honors therd
query parameter, fixing the redirect after a successful authentication (@ti-mo) - #434 Give the option to prefer email address in the username header when using the -pass-user-headers option (@jordancrawfordnz)
v5.0.0
Release Hightlights
- Disabled CGO (binaries will work regardless og glibc/musl)
- Allow whitelisted redirect ports
- Nextcloud provider support added
- DigitalOcean provider support added
Important Notes
- (Security) Fix for open redirect vulnerability.. a bad actor using
/\
in redirect URIs can redirect a session to another domain
Breaking Changes
- #321 Add reverse proxy boolean flag to control whether headers like
X-Real-Ip
are accepted.
This defaults to false. Usage behind a reverse proxy will require this flag to be set to avoid logging the reverse proxy IP address.
Changes since v4.1.0
- #331 Add reverse proxy setting (@martin-css)
- #365 Build with CGO=0 (@tomelliff)
- #339 Add configuration for cookie 'SameSite' value. (@pgroudas)
- #347 Update keycloak provider configuration documentation. (@sushiMix)
- #325 dist.sh: use sha256sum (@syscll)
- #179 Add Nextcloud provider (@Ramblurr)
- #280 whitelisted redirect domains: add support for whitelisting specific ports or allowing wildcard ports (@kamaln7)
- #351 Add DigitalOcean Auth provider (@kamaln7)
v4.1.0
Release Highlights
- Added Keycloak provider
- Build on Go 1.13
- Upgrade Docker image to use Debian Buster
- Added support for FreeBSD builds
- Added new logo
- Added support for GitHub teams
Important Notes
N/A
Breaking Changes
N/A
Changes since v4.0.0
- #292 Added bash >= 4.0 dependency to configure script (@jmfrank63)
- #227 Add Keycloak provider (@Ofinka)
- #259 Redirect to HTTPS (@jmickey)
- #273 Support Go 1.13 (@dio)
- #275 docker: build from debian buster (@syscll)
- #258 Add IDToken for Azure provider (@leyshon)
- This PR adds the IDToken into the session for the Azure provider allowing requests to a backend to be identified as a specific user. As a consequence, if you are using a cookie to store the session the cookie will now exceed the 4kb size limit and be split into multiple cookies. This can cause problems when using nginx as a proxy, resulting in no cookie being passed at all. Either increase the proxy_buffer_size in nginx or implement the redis session storage (see https://pusher.github.io/oauth2_proxy/configuration#redis-storage)
- #286 Requests.go updated with useful error messages (@biotom)
- #274 Supports many github teams with api pagination support (@toshi-miura, @apratina)
- #302 Rewrite dist script (@syscll)
- #304 Add new Logo! 🎉 (@JoelSpeed)
- #300 Added userinfo endpoint (@kbabuadze)
- #309 Added support for custom CA when connecting to Redis cache (@lleszczu)
- #248 Fix issue with X-Auth-Request-Redirect header being ignored (@webnard)
- #314 Add redirect capability to sign_out (@costelmoraru)
- #265 Add upstream with static response (@cgroschupp)
- #317 Add build for FreeBSD (@fnkr)
- #296 Allow to override provider's name for sign-in page (@ffdybuster)