git.iko.soy/typeable/oauth2-proxy
on master help sign in
Flip `--skip-auth-strip-headers` to `true` by default
commit14fd934b32dad88b3b08fdeaf44f26c4a23ecf29 authorNick Meves <nick.meves@greenhouse.io> dateSat 7 Nov 2020, 11:19 (6 years ago) parent5cba642
3 files changed+4−2
compare with master
unifiedsplit
CHANGELOG.md+2 docs/docs/configuration/overview.md+1−1 pkg/apis/options/legacy_options.go+1−1
CHANGELOG.md+2
@@ -4,6 +4,7 @@
44
55## Important Notes
66
7+- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
78- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) `--skip-auth-route` is (almost) backwards compatible with `--skip-auth-regex`
89 - We are marking `--skip-auth-regex` as DEPRECATED and will remove it in the next major version.
910 - If your regex contains an `=` and you want it for all methods, you will need to add a leading `=` (this is the area where `--skip-auth-regex` doesn't port perfectly)
@@ -32,6 +33,7 @@
3233
3334## Changes since v6.1.1
3435
36+- [#904](https://github.com/oauth2-proxy/oauth2-proxy/pull/904) Set `skip-auth-strip-headers` to `true` by default (@NickMeves)
3537- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) Integrate new header injectors into project (@JoelSpeed)
3638- [#898](https://github.com/oauth2-proxy/oauth2-proxy/pull/898) Migrate documentation to Docusaurus (@JoelSpeed)
3739- [#754](https://github.com/oauth2-proxy/oauth2-proxy/pull/754) Azure token refresh (@codablock)
docs/docs/configuration/overview.md+1−1
@@ -116,7 +116,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
116116| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
117117| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
118118| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
119−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy for allowlisted requests (`--skip-auth-route`, `--skip-auth-regex`, `--skip-auth-preflight`, `--trusted-ip`) | false |
119+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
120120| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
121121| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
122122| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
pkg/apis/options/legacy_options.go+1−1
@@ -159,7 +159,7 @@ func legacyHeadersFlagSet() *pflag.FlagSet {
159159
160160 flagSet.Bool("prefer-email-to-user", false, "Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, eg. htaccess authentication. Used in conjunction with -pass-basic-auth and -pass-user-headers")
161161 flagSet.String("basic-auth-password", "", "the password to set when passing the HTTP Basic Auth header")
162− flagSet.Bool("skip-auth-strip-headers", false, "strips X-Forwarded-* style authentication headers & Authorization header if they would be set by oauth2-proxy for request paths in --skip-auth-regex")
162+ flagSet.Bool("skip-auth-strip-headers", true, "strips X-Forwarded-* style authentication headers & Authorization header if they would be set by oauth2-proxy")
163163
164164 return flagSet
165165}