Merge pull request #368 from pusher/advisory-notes
Open redirect (security vulnerability) notes
commitc49d3628cd548f1a3061d7a25d28a0da5d3e1332
authorDavid Stark <david.stark@pusher.com>
dateWed 29 Jan 2020, 12:56 (7 years ago)
parenta316f8a3b0e8c3
CHANGELOG.md+1−1
@@ -17,7 +17,7 @@
1717- DigitalOcean provider support added
1818
1919## Important Notes
20−- (Security) Fix for open redirect vulnerability.. a bad actor using `/\` in redirect URIs can redirect a session to another domain
20+- (Security) Fix for [open redirect vulnerability](https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv).. a bad actor using `/\` in redirect URIs can redirect a session to another domain
2121
2222## Breaking Changes
2323
README.md+5
@@ -35,6 +35,11 @@ oauth2_proxy-4.0.0.linux-amd64: OK
35353. [Configure OAuth2 Proxy using config file, command line options, or environment variables](https://pusher.github.io/oauth2_proxy/configuration)
36364. [Configure SSL or Deploy behind a SSL endpoint](https://pusher.github.io/oauth2_proxy/tls-configuration) (example provided for Nginx)
3737
38+
39+## Security
40+
41+If you are running a version older than v5.0.0 we **strongly recommend you please update** to a current version. RE: [open redirect vulnverability](https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv)
42+
3843## Docs
3944
4045Read the docs on our [Docs site](https://pusher.github.io/oauth2_proxy).