git.iko.soy/typeable/oauth2-proxy
on master help sign in
Update documentation to include session storage
commit4ad4b11411e20467f45660b5e93df2ae61f45d13 authorJoel Speed <Joel.speed@hotmail.co.uk> dateSat 18 May 2019, 13:30 (7 years ago) parent72fd3b9
2 files changed+37−1
compare with master
unifiedsplit
docs/3_configuration.md → docs/configuration/configuration.md+3−1 docs/configuration/sessions.md+34
docs/3_configuration.md → docs/configuration/configuration.mdrenamed+3−1
@@ -1,7 +1,8 @@
11---
22layout: default
33title: Configuration
4−permalink: /configuration
4+permalink: /docs/configuration
5+has_children: true
56nav_order: 3
67---
78
@@ -78,6 +79,7 @@ Usage of oauth2_proxy:
7879 -request-logging-format: Template for request log lines (see "Logging Configuration" paragraph below)
7980 -resource string: The resource that is protected (Azure AD only)
8081 -scope string: OAuth scope specification
82+ -session-store-type: Session data storage backend (default: cookie)
8183 -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)
8284 -set-authorization-header: set Authorization Bearer response header (useful in Nginx auth_request mode)
8385 -signature-key string: GAP-Signature request signature key (algorithm:secretkey)
docs/configuration/sessions.mdnew file+34
@@ -0,0 +1,34 @@
1+---
2+layout: default
3+title: Sessions
4+permalink: /configuration
5+parent: Configuration
6+nav_order: 3
7+---
8+
9+## Sessions
10+
11+Sessions allow a user's authentication to be tracked between multiple HTTP
12+requests to a service.
13+
14+The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
15+data in one of the available session storage backends.
16+
17+At present the available backends are (as passed to `--session-store-type`):
18+- [cookie](cookie-storage) (deafult)
19+
20+### Cookie Storage
21+
22+The Cookie storage backend is the default backend implementation and has
23+been used in the OAuth2 Proxy historically.
24+
25+With the Cookie storage backend, all session information is stored in client
26+side cookies and transferred with each and every request.
27+
28+The following should be known when using this implementation:
29+- Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
30+- Cookies are signed server side to prevent modification client-side
31+- It is recommended to set a `cookie-secret` which will ensure data is encrypted within the cookie data.
32+- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
33+cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
34+users to re-authenticate