14- Disabled CGO (binaries will work regardless og glibc/musl)
15- Allow whitelisted redirect ports
16- Nextcloud provider support added
17- DigitalOcean provider support added
20- (Security) Fix for [open redirect vulnerability](https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv).. a bad actor using `/\` in redirect URIs can redirect a session to another domain
24- [#321](https://github.com/pusher/oauth2_proxy/pull/331) Add reverse proxy boolean flag to control whether headers like `X-Real-Ip` are accepted.
25 This defaults to false. **Usage behind a reverse proxy will require this flag to be set to avoid logging the reverse proxy IP address**.
27## Changes since v4.1.0
29- [#331](https://github.com/pusher/oauth2_proxy/pull/331) Add reverse proxy setting (@martin-css)
30- [#365](https://github.com/pusher/oauth2_proxy/pull/365) Build with CGO=0 (@tomelliff)
31- [#339](https://github.com/pusher/oauth2_proxy/pull/339) Add configuration for cookie 'SameSite' value. (@pgroudas)
32- [#347](https://github.com/pusher/oauth2_proxy/pull/347) Update keycloak provider configuration documentation. (@sushiMix)
33- [#325](https://github.com/pusher/oauth2_proxy/pull/325) dist.sh: use sha256sum (@syscll)
34- [#179](https://github.com/pusher/oauth2_proxy/pull/179) Add Nextcloud provider (@Ramblurr)
35- [#280](https://github.com/pusher/oauth2_proxy/pull/280) whitelisted redirect domains: add support for whitelisting specific ports or allowing wildcard ports (@kamaln7)
36- [#351](https://github.com/pusher/oauth2_proxy/pull/351) Add DigitalOcean Auth provider (@kamaln7)
41- Added Keycloak provider
43- Upgrade Docker image to use Debian Buster
44- Added support for FreeBSD builds
46- Added support for GitHub teams
54## Changes since v4.0.0
55- [#292](https://github.com/pusher/oauth2_proxy/pull/292) Added bash >= 4.0 dependency to configure script (@jmfrank63)
56- [#227](https://github.com/pusher/oauth2_proxy/pull/227) Add Keycloak provider (@Ofinka)
57- [#259](https://github.com/pusher/oauth2_proxy/pull/259) Redirect to HTTPS (@jmickey)
58- [#273](https://github.com/pusher/oauth2_proxy/pull/273) Support Go 1.13 (@dio)
59- [#275](https://github.com/pusher/oauth2_proxy/pull/275) docker: build from debian buster (@syscll)
60- [#258](https://github.com/pusher/oauth2_proxy/pull/258) Add IDToken for Azure provider (@leyshon)
61 - This PR adds the IDToken into the session for the Azure provider allowing requests to a backend to be identified as a specific user. As a consequence, if you are using a cookie to store the session the cookie will now exceed the 4kb size limit and be split into multiple cookies. This can cause problems when using nginx as a proxy, resulting in no cookie being passed at all. Either increase the proxy_buffer_size in nginx or implement the redis session storage (see https://pusher.github.io/oauth2_proxy/configuration#redis-storage)
62- [#286](https://github.com/pusher/oauth2_proxy/pull/286) Requests.go updated with useful error messages (@biotom)
63- [#274](https://github.com/pusher/oauth2_proxy/pull/274) Supports many github teams with api pagination support (@toshi-miura, @apratina)
64- [#302](https://github.com/pusher/oauth2_proxy/pull/302) Rewrite dist script (@syscll)
65- [#304](https://github.com/pusher/oauth2_proxy/pull/304) Add new Logo! :tada: (@JoelSpeed)
66- [#300](https://github.com/pusher/oauth2_proxy/pull/300) Added userinfo endpoint (@kbabuadze)
67- [#309](https://github.com/pusher/oauth2_proxy/pull/309) Added support for custom CA when connecting to Redis cache (@lleszczu)
68- [#248](https://github.com/pusher/oauth2_proxy/pull/248) Fix issue with X-Auth-Request-Redirect header being ignored (@webnard)
69- [#314](https://github.com/pusher/oauth2_proxy/pull/314) Add redirect capability to sign_out (@costelmoraru)
70- [#265](https://github.com/pusher/oauth2_proxy/pull/265) Add upstream with static response (@cgroschupp)
71- [#317](https://github.com/pusher/oauth2_proxy/pull/317) Add build for FreeBSD (@fnkr)
72- [#296](https://github.com/pusher/oauth2_proxy/pull/296) Allow to override provider's name for sign-in page (@ffdybuster)
77- Documentation is now on a [microsite](https://pusher.github.io/oauth2_proxy/)
78- Health check logging can now be disabled for quieter logs
79- Authorization Header JWTs can now be verified by the proxy to skip authentication for machine users
80- Sessions can now be stored in Redis. This reduces refresh failures and uses smaller cookies (Recommended for those using OIDC refreshing)
81- Logging overhaul allows customisable logging formats
84- This release includes a number of breaking changes that will require users to
85reconfigure their proxies. Please read the Breaking Changes below thoroughly.
89- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Rework GitLab provider
90 - This PR changes the configuration options for the GitLab provider to use
91 a self-hosted instance. You now need to specify a `-oidc-issuer-url` rather than
92 explicit `-login-url`, `-redeem-url` and `-validate-url` parameters.
93- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent
94 - This PR changes configuration options so that all flags have a config counterpart
95 of the same name but with underscores (`_`) in place of hyphens (`-`).
96 This change affects the following flags:
97 - The `--tls-key` flag is now `--tls-key-file` to be consistent with existing
98 file flags and the existing config and environment settings
99 - The `--tls-cert` flag is now `--tls-cert-file` to be consistent with existing
100 file flags and the existing config and environment settings
101 This change affects the following existing configuration options:
102 - The `proxy-prefix` option is now `proxy_prefix`.
103 This PR changes environment variables so that all flags have an environment
104 counterpart of the same name but capitalised, with underscores (`_`) in place
105 of hyphens (`-`) and with the prefix `OAUTH2_PROXY_`.
106 This change affects the following existing environment variables:
107 - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.
108 - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.
109- [#146](https://github.com/pusher/oauth2_proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field
110 - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain
112 In that case, this header used to only contain the local part of the user's email address (e.g. `john.doe` for `john.doe@example.com`) but now contains
113 the user's full email address instead.
114- [#170](https://github.com/pusher/oauth2_proxy/pull/170) Pre-built binary tarballs changed format
115 - The pre-built binary tarballs again match the format of the [bitly](https://github.com/bitly/oauth2_proxy) repository, where the unpacked directory
116 has the same name as the tarball and the binary is always named `oauth2_proxy`. This was done to restore compatibility with third-party automation
117 recipes like https://github.com/jhoblitt/puppet-oauth2_proxy.
119## Changes since v3.2.0
121- [#234](https://github.com/pusher/oauth2_proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)
122- [#224](https://github.com/pusher/oauth2_proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)
123- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)
124- [#226](https://github.com/pusher/oauth2_proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)
125- [#178](https://github.com/pusher/oauth2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)
126- [#209](https://github.com/pusher/oauth2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)
127- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)
128- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)
129- [#65](https://github.com/pusher/oauth2_proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via
130 the `-skip-jwt-bearer-token` options. (@brianv0)
131 - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL
132 (e.g. `https://example.com/.well-known/jwks.json`).
133- [#180](https://github.com/pusher/oauth2_proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).
134- [#175](https://github.com/pusher/oauth2_proxy/pull/175) Bump go-oidc to v2.0.0 (@aeijdenberg).
135 - Includes fix for potential signature checking issue when OIDC discovery is skipped.
136- [#155](https://github.com/pusher/oauth2_proxy/pull/155) Add RedisSessionStore implementation (@brianv0, @JoelSpeed)
137 - Implement flags to configure the redis session store
138 - `-session-store-type=redis` Sets the store type to redis
139 - `-redis-connection-url` Sets the Redis connection URL
140 - `-redis-use-sentinel=true` Enables Redis Sentinel support
141 - `-redis-sentinel-master-name` Sets the Sentinel master name, if sentinel is enabled
142 - `-redis-sentinel-connection-urls` Defines the Redis Sentinel Connection URLs, if sentinel is enabled
143 - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.
144 - Redis Sessions are stored encrypted with a per-session secret
145 - Added tests for server based session stores
146- [#168](https://github.com/pusher/oauth2_proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)
147- [#169](https://github.com/pusher/oauth2_proxy/pull/169) Update Alpine to 3.9 (@kskewes)
148- [#148](https://github.com/pusher/oauth2_proxy/pull/148) Implement SessionStore interface within proxy (@JoelSpeed)
149- [#147](https://github.com/pusher/oauth2_proxy/pull/147) Add SessionStore interfaces and initial implementation (@JoelSpeed)
150 - Allows for multiple different session storage implementations including client and server side
151 - Adds tests suite for interface to ensure consistency across implementations
152 - Refactor some configuration options (around cookies) into packages
153- [#114](https://github.com/pusher/oauth2_proxy/pull/114), [#154](https://github.com/pusher/oauth2_proxy/pull/154) Documentation is now available live at our [docs website](https://pusher.github.io/oauth2_proxy/) (@JoelSpeed, @icelynjennings)
154- [#146](https://github.com/pusher/oauth2_proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field (@gargath)
155- [#144](https://github.com/pusher/oauth2_proxy/pull/144) Use GO 1.12 for ARM builds (@kskewes)
156- [#142](https://github.com/pusher/oauth2_proxy/pull/142) ARM Docker USER fix (@kskewes)
157- [#52](https://github.com/pusher/oauth2_proxy/pull/52) Logging Improvements (@MisterWil)
158 - Implement flags to configure file logging
159 - `-logging-filename` Defines the filename to log to
160 - `-logging-max-size` Defines the maximum
161 - `-logging-max-age` Defines the maximum age of backups to retain
162 - `-logging-max-backups` Defines the maximum number of rollover log files to retain
163 - `-logging-compress` Defines if rollover log files should be compressed
164 - `-logging-local-time` Defines if logging date and time should be local or UTC
165 - Implement two new flags to enable or disable specific logging types
166 - `-standard-logging` Enables or disables standard (not request or auth) logging
167 - `-auth-logging` Enables or disables auth logging
168 - Implement two new flags to customize the logging format
169 - `-standard-logging-format` Sets the format for standard logging
170 - `-auth-logging-format` Sets the format for auth logging
171- [#111](https://github.com/pusher/oauth2_proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)
172- [#170](https://github.com/pusher/oauth2_proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)
173- [#185](https://github.com/pusher/oauth2_proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)
174- [#141](https://github.com/pusher/oauth2_proxy/pull/141) Check google group membership based on email address (@bchess)
175 - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.
176- [#195](https://github.com/pusher/oauth2_proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)
177- [#198](https://github.com/pusher/oauth2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)
178- [#159](https://github.com/pusher/oauth2_proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email` (@djfinlay)
179- [#210](https://github.com/pusher/oauth2_proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)
180- [#201](https://github.com/pusher/oauth2_proxy/pull/201) Add Bitbucket as new OAuth2 provider, accepts email, team and repository permissions to determine authorization (@aledeganopix4d)
181 - Implement flags to enable Bitbucket authentication:
182 - `-bitbucket-repository` Restrict authorization to users that can access this repository
183 - `-bitbucket-team` Restrict authorization to users that are part of this Bitbucket team
184- [#211](https://github.com/pusher/oauth2_proxy/pull/211) Switch from dep to go modules (@steakunderscore)
185- [#145](https://github.com/pusher/oauth2_proxy/pull/145) Add support for OIDC UserInfo endpoint email verification (@rtluckie)
190- Internal restructure of session state storage to use JSON rather than proprietary scheme
191- Added health check options for running on GCP behind a load balancer
192- Improved support for protecting websockets
193- Added provider for login.gov
194- Allow manual configuration of OIDC providers
197- Dockerfile user is now non-root, this may break your existing deployment
198- In the OIDC provider, when no email is returned, the ID Token subject will be used
199instead of returning an error
200- GitHub user emails must now be primary and verified before authenticating
202## Changes since v3.1.0
204- [#96](https://github.com/bitly/oauth2_proxy/pull/96) Check if email is verified on GitHub (@caarlos0)
205- [#110](https://github.com/pusher/oauth2_proxy/pull/110) Added GCP healthcheck option (@timothy-spencer)
206- [#112](https://github.com/pusher/oauth2_proxy/pull/112) Improve websocket support (@gyson)
207- [#63](https://github.com/pusher/oauth2_proxy/pull/63) Use encoding/json for SessionState serialization (@yaegashi)
208 - Use JSON to encode session state to be stored in browser cookies
209 - Implement legacy decode function to support existing cookies generated by older versions
210 - Add detailed table driven tests in session_state_test.go
211- [#120](https://github.com/pusher/oauth2_proxy/pull/120) Encrypting user/email from cookie (@costelmoraru)
212- [#55](https://github.com/pusher/oauth2_proxy/pull/55) Added login.gov provider (@timothy-spencer)
213- [#55](https://github.com/pusher/oauth2_proxy/pull/55) Added environment variables for all config options (@timothy-spencer)
214- [#70](https://github.com/pusher/oauth2_proxy/pull/70) Fix handling of splitted cookies (@einfachchr)
215- [#92](https://github.com/pusher/oauth2_proxy/pull/92) Merge websocket proxy feature from openshift/oauth-proxy (@butzist)
216- [#57](https://github.com/pusher/oauth2_proxy/pull/57) Fall back to using OIDC Subject instead of Email (@aigarius)
217- [#85](https://github.com/pusher/oauth2_proxy/pull/85) Use non-root user in docker images (@kskewes)
218- [#68](https://github.com/pusher/oauth2_proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)
219- [#41](https://github.com/pusher/oauth2_proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery
220- [#83](https://github.com/pusher/oauth2_proxy/pull/83) Add `id_token` refresh to Google provider (@leki75)
221- [#10](https://github.com/pusher/oauth2_proxy/pull/10) fix redirect url param handling (@dt-rush)
222- [#122](https://github.com/pusher/oauth2_proxy/pull/122) Expose -cookie-path as configuration parameter (@costelmoraru)
223- [#124](https://github.com/pusher/oauth2_proxy/pull/124) Use Go 1.12 for testing and build environments (@syscll)
229- Introduction of ARM releases and and general improvements to Docker builds
230- Improvements to OIDC provider allowing pass-through of ID Tokens
231- Multiple redirect domains can now be whitelisted
232- Streamed responses are now flushed periodically
236- If you have been using [#bitly/621](https://github.com/bitly/oauth2_proxy/pull/621)
237 and have cookies larger than the 4kb limit,
238 the cookie splitting pattern has changed and now uses `_` in place of `-` when
240 This will force users to reauthenticate the first time they use `v3.1.0`.
241- Streamed responses will now be flushed every 1 second by default.
242 Previously streamed responses were flushed only when the buffer was full.
243 To retain the old behaviour set `--flush-interval=0`.
244 See [#23](https://github.com/pusher/oauth2_proxy/pull/23) for further details.
246## Changes since v3.0.0
248- [#14](https://github.com/pusher/oauth2_proxy/pull/14) OIDC ID Token, Authorization Headers, Refreshing and Verification (@joelspeed)
249 - Implement `pass-authorization-header` and `set-authorization-header` flags
250 - Implement token refreshing in OIDC provider
251 - Split cookies larger than 4k limit into multiple cookies
252 - Implement token validation in OIDC provider
253- [#15](https://github.com/pusher/oauth2_proxy/pull/15) WhitelistDomains (@joelspeed)
254 - Add `--whitelist-domain` flag to allow redirection to approved domains after OAuth flow
255- [#21](https://github.com/pusher/oauth2_proxy/pull/21) Docker Improvement (@yaegashi)
256 - Move Docker base image from debian to alpine
257 - Install ca-certificates in docker image
258- [#23](https://github.com/pusher/oauth2_proxy/pull/23) Flushed streaming responses
259 - Long-running upstream responses will get flushed every <timeperiod> (1 second by default)
260- [#24](https://github.com/pusher/oauth2_proxy/pull/24) Redirect fix (@agentgonzo)
261 - After a successful login, you will be redirected to your original URL rather than /
262- [#35](https://github.com/pusher/oauth2_proxy/pull/35) arm and arm64 binary releases (@kskewes)
263 - Add armv6 and arm64 to Makefile `release` target
264- [#37](https://github.com/pusher/oauth2_proxy/pull/37) cross build arm and arm64 docker images (@kskewes)
268Adoption of OAuth2_Proxy by Pusher.
269Project was hard forked and tidied however no logical changes have occurred since
270v2.2 as released by Bitly.
272## Changes since v2.2:
274- [#7](https://github.com/pusher/oauth2_proxy/pull/7) Migration to Pusher (@joelspeed)
275 - Move automated build to debian base image
277 - Update CI to run `make test`
278 - Update Dockerfile to use `make clean oauth2_proxy`
279 - Update `VERSION` parameter to be set by `ldflags` from Git Status
280 - Remove lint and test scripts
281 - Remove Go v1.8.x from Travis CI testing
282 - Add CODEOWNERS file
283 - Add CONTRIBUTING guide
284 - Add Issue and Pull Request templates
286 - Fix fsnotify import
287 - Update README to reflect new repository ownership
288 - Update CI scripts to separate linting and testing
289 - Now using `gometalinter` for linting
290 - Move Go import path from `github.com/bitly/oauth2_proxy` to `github.com/pusher/oauth2_proxy`
291 - Repository forked on 27/11/18
292 - README updated to include note that this repository is forked
293 - CHANGLOG created to track changes to repository from original fork
keysesc to close
- j k
- move down, up
- enter
- open
- esc
- back, or up a level
- 1 2 3 4
- readme, files, commits, refs
- /
- filter
- y
- copy the clone command
- c
- compare the chosen commit with another (or shift-click both)
- ?
- show or hide this list