@@ -15,43 +15,43 @@ import TabItem from '@theme/TabItem';
1515<Tabs defaultValue="python">
1616 <TabItem value="python" label="Python">
1717
18− ```shell
19− python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
20− ```
21−
18+```shell
19+python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
20+```
21+
2222 </TabItem>
2323 <TabItem value="bash" label="Bash">
2424
25− ```shell
26− dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
27− ```
28−
25+```shell
26+dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
27+```
28+
2929 </TabItem>
3030 <TabItem value="openssl" label="OpenSSL">
3131
32− ```shell
33− openssl rand -base64 32 | tr -- '+/' '-_'
34− ```
32+```shell
33+openssl rand -base64 32 | tr -- '+/' '-_'
34+```
3535
3636 </TabItem>
3737 <TabItem value="powershell" label="PowerShell">
3838
39− ```powershell
40− # Add System.Web assembly to session, just in case
41− Add-Type -AssemblyName System.Web
42− [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
43− ```
39+```powershell
40+# Add System.Web assembly to session, just in case
41+Add-Type -AssemblyName System.Web
42+[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
43+```
4444
4545 </TabItem>
4646 <TabItem value="terraform" label="Terraform">
4747
48− ```hcl
49− # Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
50− resource "random_password" "cookie_secret" {
51− length = 32
52− override_special = "-_"
53− }
54− ```
48+```hcl
49+# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
50+resource "random_password" "cookie_secret" {
51+ length = 32
52+ override_special = "-_"
53+}
54+```
5555
5656 </TabItem>
5757</Tabs>
@@ -199,7 +199,7 @@ Provider specific options can be found on their respective subpages.
199199| flag: `--htpasswd-file`<br/>toml: `htpasswd_file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
200200| flag: `--htpasswd-user-group`<br/>toml: `htpasswd_user_groups` | string \| list | the groups to be set on sessions for htpasswd users | |
201201| flag: `--proxy-prefix`<br/>toml: `proxy_prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
202−| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
202+| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, or X-Envoy-External-Address) | X-Real-IP |
203203| flag: `--redirect-url`<br/>toml: `redirect_url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
204204| flag: `--relative-redirect-url`<br/>toml: `relative_redirect_url` | bool | allow relative OAuth Redirect URL.` | false |
205205| flag: `--reverse-proxy`<br/>toml: `reverse_proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
@@ -231,6 +231,7 @@ Provider specific options can be found on their respective subpages.
231231| flag: `--tls-min-version`<br/>toml: `tls_min_version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
232232
233233### Session Options
234+
234235| Flag / Config Field | Type | Description | Default |
235236| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
236237| flag: `--session-cookie-minimal`<br/>toml: `session_cookie_minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
@@ -307,6 +308,7 @@ Each type of logging has its own configurable format and variables. By default,
307308Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.
308309
309310## Auth Log Format
311+
310312Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
311313
312314```
@@ -342,6 +344,7 @@ Available variables for auth logging:
342344| Status | AuthSuccess | The status of the auth request. See above for details. |
343345
344346## Request Log Format
347+
345348HTTP request logs will output by default in the below format:
346349
347350```
@@ -374,6 +377,7 @@ Available variables for request logging:
374377| Username | username@email.com | The email or username of the auth request. |
375378
376379## Standard Log Format
380+
377381All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
378382
379383```