git.iko.soy/typeable/oauth2-proxy
on master help sign in
Rename cookie-domain config to cookie-domains (#559)
810a9e9Joel Speed
CHANGELOG.md+5
compare with master
unifiedsplit
@@ -39,9 +39,14 @@
39 reporting an invalid length of 20 or 28 when the user input cookie-secret was not that length.
39 reporting an invalid length of 20 or 28 when the user input cookie-secret was not that length.
40 - Now we will only base64 decode a cookie-secret to raw bytes if it is 16, 24, or 32 bytes long. Otherwise, we will convert
40 - Now we will only base64 decode a cookie-secret to raw bytes if it is 16, 24, or 32 bytes long. Otherwise, we will convert
41 the direct cookie-secret to bytes without silent padding added.
41 the direct cookie-secret to bytes without silent padding added.
42+- [#412](https://github.com/oauth2-proxy/oauth2-proxy/pull/412)/[#559](https://github.com/oauth2-proxy/oauth2-proxy/pull/559) Allow multiple cookie domains to be specified
43+ - Multiple cookie domains may now be configured. The longest domain that matches will be used.
44+ - The config options `cookie_domain` is now `cookie_domains`
45+ - The environment variable `OAUTH2_PROXY_COOKIE_DOMAIN` is now `OAUTH2_PROXY_COOKIE_DOMAINS`
42
46
43## Changes since v5.1.1
47## Changes since v5.1.1
44
48
49+- [#559](https://github.com/oauth2-proxy/oauth2-proxy/pull/559) Rename cookie-domain config to cookie-domains (@JoelSpeed)
45- [#569](https://github.com/oauth2-proxy/oauth2-proxy/pull/569) Updated autocompletion for `--` long options. (@Izzette)
50- [#569](https://github.com/oauth2-proxy/oauth2-proxy/pull/569) Updated autocompletion for `--` long options. (@Izzette)
46- [#489](https://github.com/oauth2-proxy/oauth2-proxy/pull/489) Move Options and Validation to separate packages (@JoelSpeed)
51- [#489](https://github.com/oauth2-proxy/oauth2-proxy/pull/489) Move Options and Validation to separate packages (@JoelSpeed)
47- [#556](https://github.com/oauth2-proxy/oauth2-proxy/pull/556) Remove unintentional auto-padding of secrets that were too short (@NickMeves)
52- [#556](https://github.com/oauth2-proxy/oauth2-proxy/pull/556) Remove unintentional auto-padding of secrets that were too short (@NickMeves)
contrib/local-environment/oauth2-proxy-nginx.cfg+1−1
@@ -8,5 +8,5 @@ client_id="oauth2-proxy"
8cookie_secure="false"
8cookie_secure="false"
9
9
10redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"
10redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"
11−cookie_domain=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.
11+cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.
12whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.
12whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.
contrib/oauth2-proxy.cfg.example+3−3
@@ -39,7 +39,7 @@
39# pass_user_headers = true
39# pass_user_headers = true
40## pass the request Host Header to upstream
40## pass the request Host Header to upstream
41## when disabled the upstream Host is used as the Host Header
41## when disabled the upstream Host is used as the Host Header
42−# pass_host_header = true
42+# pass_host_header = true
43
43
44## Email Domains to allow authentication for (this authorizes any email on this domain)
44## Email Domains to allow authentication for (this authorizes any email on this domain)
45## for more granular authorization use `authenticated_emails_file`
45## for more granular authorization use `authenticated_emails_file`
@@ -80,13 +80,13 @@
80## Expire - (duration) expire timeframe for cookie
80## Expire - (duration) expire timeframe for cookie
81## Refresh - (duration) refresh the cookie when duration has elapsed after cookie was initially set.
81## Refresh - (duration) refresh the cookie when duration has elapsed after cookie was initially set.
82## Should be less than cookie_expire; set to 0 to disable.
82## Should be less than cookie_expire; set to 0 to disable.
83−## On refresh, OAuth token is re-validated.
83+## On refresh, OAuth token is re-validated.
84## (ie: 1h means tokens are refreshed on request 1hr+ after it was set)
84## (ie: 1h means tokens are refreshed on request 1hr+ after it was set)
85## Secure - secure cookies are only sent by the browser of a HTTPS connection (recommended)
85## Secure - secure cookies are only sent by the browser of a HTTPS connection (recommended)
86## HttpOnly - httponly cookies are not readable by javascript (recommended)
86## HttpOnly - httponly cookies are not readable by javascript (recommended)
87# cookie_name = "_oauth2_proxy"
87# cookie_name = "_oauth2_proxy"
88# cookie_secret = ""
88# cookie_secret = ""
89−# cookie_domain = ""
89+# cookie_domains = ""
90# cookie_expire = "168h"
90# cookie_expire = "168h"
91# cookie_refresh = ""
91# cookie_refresh = ""
92# cookie_secure = true
92# cookie_secure = true
pkg/apis/options/cookie.go+1−1
@@ -6,7 +6,7 @@ import "time"
6type CookieOptions struct {
6type CookieOptions struct {
7 Name string `flag:"cookie-name" cfg:"cookie_name"`
7 Name string `flag:"cookie-name" cfg:"cookie_name"`
8 Secret string `flag:"cookie-secret" cfg:"cookie_secret"`
8 Secret string `flag:"cookie-secret" cfg:"cookie_secret"`
9− Domains []string `flag:"cookie-domain" cfg:"cookie_domain"`
9+ Domains []string `flag:"cookie-domain" cfg:"cookie_domains"`
10 Path string `flag:"cookie-path" cfg:"cookie_path"`
10 Path string `flag:"cookie-path" cfg:"cookie_path"`
11 Expire time.Duration `flag:"cookie-expire" cfg:"cookie_expire"`
11 Expire time.Duration `flag:"cookie-expire" cfg:"cookie_expire"`
12 Refresh time.Duration `flag:"cookie-refresh" cfg:"cookie_refresh"`
12 Refresh time.Duration `flag:"cookie-refresh" cfg:"cookie_refresh"`