git.iko.soy/typeable/oauth2-proxy
on master help sign in
docs/conf/overview: Add hint about cookie prefixes to --cookie-name (#1744)

* docs/conf/overview: Add hint about cookie prefixes to --cookie-name Cookie Prefixes further restricts the possibilities of session attacks because supporting clients will only accept cookies with one of the prefix if certain requirements were meet, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes * Backport cookie prefixes to older docs Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

commit723f6cc5d50a4f250df546557691c89e6891bdc7 authorFelix Stupp <me+github@banananet.work> dateWed 31 Aug 2022, 21:08 (4 years ago) parentc228d9e
6 files changed+6−6
compare with master
unifiedsplit
docs/docs/configuration/overview.md+1−1 docs/versioned_docs/version-6.1.x/configuration/overview.md+1−1 docs/versioned_docs/version-7.0.x/configuration/overview.md+1−1 docs/versioned_docs/version-7.1.x/configuration/overview.md+1−1 docs/versioned_docs/version-7.2.x/configuration/overview.md+1−1 docs/versioned_docs/version-7.3.x/configuration/overview.md+1−1
docs/docs/configuration/overview.md+1−1
@@ -89,7 +89,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
8989| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
9090| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
9191| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
92−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
92+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
9393| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
9494| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
9595| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
docs/versioned_docs/version-6.1.x/configuration/overview.md+1−1
@@ -88,7 +88,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
8888| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
8989| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
9090| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
91−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
91+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
9292| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
9393| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
9494| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
docs/versioned_docs/version-7.0.x/configuration/overview.md+1−1
@@ -88,7 +88,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
8888| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
8989| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
9090| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
91−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
91+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
9292| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
9393| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
9494| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
docs/versioned_docs/version-7.1.x/configuration/overview.md+1−1
@@ -33,7 +33,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
3333| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
3434| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
3535| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
36−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
36+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
3737| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
3838| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
3939| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
docs/versioned_docs/version-7.2.x/configuration/overview.md+1−1
@@ -88,7 +88,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
8888| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
8989| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
9090| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
91−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
91+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
9292| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
9393| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
9494| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
docs/versioned_docs/version-7.3.x/configuration/overview.md+1−1
@@ -89,7 +89,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
8989| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
9090| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
9191| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
92−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
92+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
9393| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
9494| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
9595| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |