git.iko.soy/typeable/oauth2-proxy
on master help sign in
Open redirect (security vulnerability) notes
3b0e8c3David Stark
CHANGELOG.md+1−1
compare with master
unifiedsplit
@@ -17,7 +17,7 @@
17- DigitalOcean provider support added
17- DigitalOcean provider support added
18
18
19## Important Notes
19## Important Notes
20−- (Security) Fix for open redirect vulnerability.. a bad actor using `/\` in redirect URIs can redirect a session to another domain
20+- (Security) Fix for [open redirect vulnerability](https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv).. a bad actor using `/\` in redirect URIs can redirect a session to another domain
21
21
22## Breaking Changes
22## Breaking Changes
23
23
README.md+5
@@ -35,6 +35,11 @@ oauth2_proxy-4.0.0.linux-amd64: OK
353. [Configure OAuth2 Proxy using config file, command line options, or environment variables](https://pusher.github.io/oauth2_proxy/configuration)
353. [Configure OAuth2 Proxy using config file, command line options, or environment variables](https://pusher.github.io/oauth2_proxy/configuration)
364. [Configure SSL or Deploy behind a SSL endpoint](https://pusher.github.io/oauth2_proxy/tls-configuration) (example provided for Nginx)
364. [Configure SSL or Deploy behind a SSL endpoint](https://pusher.github.io/oauth2_proxy/tls-configuration) (example provided for Nginx)
37
37
38+
39+## Security
40+
41+If you are running a version older than v5.0.0 we **strongly recommend you please update** to a current version. RE: [open redirect vulnverability](https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv)
42+
38## Docs
43## Docs
39
44
40Read the docs on our [Docs site](https://pusher.github.io/oauth2_proxy).
45Read the docs on our [Docs site](https://pusher.github.io/oauth2_proxy).