git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #2637 from tuunit/docs/fix-search

docs: fix search

commite058c4d636a7621b58181a340ecb7977b4a4ac62 authorJoel Speed <Joel.speed@hotmail.co.uk> dateFri 10 May 2024, 11:26 (2 years ago) parentfc701bf2c65f39
9 files changed+1714−1746
docs/docusaurus.config.js+11 docs/package-lock.json+856−899 docs/package.json+5−5 docs/versioned_docs/version-7.0.x/configuration/overview.md+4−4 docs/versioned_docs/version-7.1.x/configuration/overview.md+162−162 docs/versioned_docs/version-7.2.x/configuration/overview.md+162−162 docs/versioned_docs/version-7.3.x/configuration/overview.md+167−167 docs/versioned_docs/version-7.4.x/configuration/overview.md+172−172 docs/versioned_docs/version-7.5.x/configuration/overview.md+175−175
docs/docusaurus.config.js+11
@@ -62,6 +62,17 @@ const config = {
6262 /** @type {import("@easyops-cn/docusaurus-search-local").PluginOptions} */
6363 ({
6464 hashed: true,
65+ docsDir: "docs", // only index the latest docs
66+ language: ["en"],
67+ indexDocs: true,
68+ indexBlog: false,
69+ indexPages: false,
70+ docsRouteBasePath: "/", // fix the default /docs path
71+ searchResultLimits: 10,
72+ searchBarShortcut: true,
73+ removeDefaultStemmer: true, // allow for partial word matching
74+ searchBarShortcutHint: true,
75+ highlightSearchTermsOnTargetPage: true,
6576 }),
6677 ]
6778 ],
docs/package-lock.json+856−899
@@ -8,9 +8,9 @@
88 "name": "oauth2-proxy",
99 "version": "0.0.0",
1010 "dependencies": {
11− "@docusaurus/core": "3.1.1",
12− "@docusaurus/preset-classic": "3.1.1",
13− "@docusaurus/theme-mermaid": "^3.1.0",
11+ "@docusaurus/core": "^3.3.2",
12+ "@docusaurus/preset-classic": "^3.3.2",
13+ "@docusaurus/theme-mermaid": "^3.3.2",
1414 "@easyops-cn/docusaurus-search-local": "^0.40.1",
1515 "@mdx-js/react": "^3.0.0",
1616 "clsx": "^2.0.0",
@@ -19,8 +19,8 @@
1919 "react-dom": "^18.0.0"
2020 },
2121 "devDependencies": {
22− "@docusaurus/module-type-aliases": "3.1.1",
23− "@docusaurus/types": "3.1.1"
22+ "@docusaurus/module-type-aliases": "^3.3.2",
23+ "@docusaurus/types": "^3.3.2"
2424 },
2525 "engines": {
2626 "node": ">=18.0"
@@ -68,74 +68,74 @@
6868 }
6969 },
7070 "node_modules/@algolia/cache-browser-local-storage": {
71− "version": "4.22.1",
72− "resolved": "https://registry.npmjs.org/@algolia/cache-browser-local-storage/-/cache-browser-local-storage-4.22.1.tgz",
73− "integrity": "sha512-Sw6IAmOCvvP6QNgY9j+Hv09mvkvEIDKjYW8ow0UDDAxSXy664RBNQk3i/0nt7gvceOJ6jGmOTimaZoY1THmU7g==",
71+ "version": "4.23.3",
72+ "resolved": "https://registry.npmjs.org/@algolia/cache-browser-local-storage/-/cache-browser-local-storage-4.23.3.tgz",
73+ "integrity": "sha512-vRHXYCpPlTDE7i6UOy2xE03zHF2C8MEFjPN2v7fRbqVpcOvAUQK81x3Kc21xyb5aSIpYCjWCZbYZuz8Glyzyyg==",
7474 "dependencies": {
75− "@algolia/cache-common": "4.22.1"
75+ "@algolia/cache-common": "4.23.3"
7676 }
7777 },
7878 "node_modules/@algolia/cache-common": {
79− "version": "4.22.1",
80− "resolved": "https://registry.npmjs.org/@algolia/cache-common/-/cache-common-4.22.1.tgz",
81− "integrity": "sha512-TJMBKqZNKYB9TptRRjSUtevJeQVXRmg6rk9qgFKWvOy8jhCPdyNZV1nB3SKGufzvTVbomAukFR8guu/8NRKBTA=="
79+ "version": "4.23.3",
80+ "resolved": "https://registry.npmjs.org/@algolia/cache-common/-/cache-common-4.23.3.tgz",
81+ "integrity": "sha512-h9XcNI6lxYStaw32pHpB1TMm0RuxphF+Ik4o7tcQiodEdpKK+wKufY6QXtba7t3k8eseirEMVB83uFFF3Nu54A=="
8282 },
8383 "node_modules/@algolia/cache-in-memory": {
84− "version": "4.22.1",
85− "resolved": "https://registry.npmjs.org/@algolia/cache-in-memory/-/cache-in-memory-4.22.1.tgz",
86− "integrity": "sha512-ve+6Ac2LhwpufuWavM/aHjLoNz/Z/sYSgNIXsinGofWOysPilQZPUetqLj8vbvi+DHZZaYSEP9H5SRVXnpsNNw==",
84+ "version": "4.23.3",
85+ "resolved": "https://registry.npmjs.org/@algolia/cache-in-memory/-/cache-in-memory-4.23.3.tgz",
86+ "integrity": "sha512-yvpbuUXg/+0rbcagxNT7un0eo3czx2Uf0y4eiR4z4SD7SiptwYTpbuS0IHxcLHG3lq22ukx1T6Kjtk/rT+mqNg==",
8787 "dependencies": {
88− "@algolia/cache-common": "4.22.1"
88+ "@algolia/cache-common": "4.23.3"
8989 }
9090 },
9191 "node_modules/@algolia/client-account": {
92− "version": "4.22.1",
93− "resolved": "https://registry.npmjs.org/@algolia/client-account/-/client-account-4.22.1.tgz",
94− "integrity": "sha512-k8m+oegM2zlns/TwZyi4YgCtyToackkOpE+xCaKCYfBfDtdGOaVZCM5YvGPtK+HGaJMIN/DoTL8asbM3NzHonw==",
92+ "version": "4.23.3",
93+ "resolved": "https://registry.npmjs.org/@algolia/client-account/-/client-account-4.23.3.tgz",
94+ "integrity": "sha512-hpa6S5d7iQmretHHF40QGq6hz0anWEHGlULcTIT9tbUssWUriN9AUXIFQ8Ei4w9azD0hc1rUok9/DeQQobhQMA==",
9595 "dependencies": {
96− "@algolia/client-common": "4.22.1",
97− "@algolia/client-search": "4.22.1",
98− "@algolia/transporter": "4.22.1"
96+ "@algolia/client-common": "4.23.3",
97+ "@algolia/client-search": "4.23.3",
98+ "@algolia/transporter": "4.23.3"
9999 }
100100 },
101101 "node_modules/@algolia/client-analytics": {
102− "version": "4.22.1",
103− "resolved": "https://registry.npmjs.org/@algolia/client-analytics/-/client-analytics-4.22.1.tgz",
104− "integrity": "sha512-1ssi9pyxyQNN4a7Ji9R50nSdISIumMFDwKNuwZipB6TkauJ8J7ha/uO60sPJFqQyqvvI+px7RSNRQT3Zrvzieg==",
102+ "version": "4.23.3",
103+ "resolved": "https://registry.npmjs.org/@algolia/client-analytics/-/client-analytics-4.23.3.tgz",
104+ "integrity": "sha512-LBsEARGS9cj8VkTAVEZphjxTjMVCci+zIIiRhpFun9jGDUlS1XmhCW7CTrnaWeIuCQS/2iPyRqSy1nXPjcBLRA==",
105105 "dependencies": {
106− "@algolia/client-common": "4.22.1",
107− "@algolia/client-search": "4.22.1",
108− "@algolia/requester-common": "4.22.1",
109− "@algolia/transporter": "4.22.1"
106+ "@algolia/client-common": "4.23.3",
107+ "@algolia/client-search": "4.23.3",
108+ "@algolia/requester-common": "4.23.3",
109+ "@algolia/transporter": "4.23.3"
110110 }
111111 },
112112 "node_modules/@algolia/client-common": {
113− "version": "4.22.1",
114− "resolved": "https://registry.npmjs.org/@algolia/client-common/-/client-common-4.22.1.tgz",
115− "integrity": "sha512-IvaL5v9mZtm4k4QHbBGDmU3wa/mKokmqNBqPj0K7lcR8ZDKzUorhcGp/u8PkPC/e0zoHSTvRh7TRkGX3Lm7iOQ==",
113+ "version": "4.23.3",
114+ "resolved": "https://registry.npmjs.org/@algolia/client-common/-/client-common-4.23.3.tgz",
115+ "integrity": "sha512-l6EiPxdAlg8CYhroqS5ybfIczsGUIAC47slLPOMDeKSVXYG1n0qGiz4RjAHLw2aD0xzh2EXZ7aRguPfz7UKDKw==",
116116 "dependencies": {
117− "@algolia/requester-common": "4.22.1",
118− "@algolia/transporter": "4.22.1"
117+ "@algolia/requester-common": "4.23.3",
118+ "@algolia/transporter": "4.23.3"
119119 }
120120 },
121121 "node_modules/@algolia/client-personalization": {
122− "version": "4.22.1",
123− "resolved": "https://registry.npmjs.org/@algolia/client-personalization/-/client-personalization-4.22.1.tgz",
124− "integrity": "sha512-sl+/klQJ93+4yaqZ7ezOttMQ/nczly/3GmgZXJ1xmoewP5jmdP/X/nV5U7EHHH3hCUEHeN7X1nsIhGPVt9E1cQ==",
122+ "version": "4.23.3",
123+ "resolved": "https://registry.npmjs.org/@algolia/client-personalization/-/client-personalization-4.23.3.tgz",
124+ "integrity": "sha512-3E3yF3Ocr1tB/xOZiuC3doHQBQ2zu2MPTYZ0d4lpfWads2WTKG7ZzmGnsHmm63RflvDeLK/UVx7j2b3QuwKQ2g==",
125125 "dependencies": {
126− "@algolia/client-common": "4.22.1",
127− "@algolia/requester-common": "4.22.1",
128− "@algolia/transporter": "4.22.1"
126+ "@algolia/client-common": "4.23.3",
127+ "@algolia/requester-common": "4.23.3",
128+ "@algolia/transporter": "4.23.3"
129129 }
130130 },
131131 "node_modules/@algolia/client-search": {
132− "version": "4.22.1",
133− "resolved": "https://registry.npmjs.org/@algolia/client-search/-/client-search-4.22.1.tgz",
134− "integrity": "sha512-yb05NA4tNaOgx3+rOxAmFztgMTtGBi97X7PC3jyNeGiwkAjOZc2QrdZBYyIdcDLoI09N0gjtpClcackoTN0gPA==",
132+ "version": "4.23.3",
133+ "resolved": "https://registry.npmjs.org/@algolia/client-search/-/client-search-4.23.3.tgz",
134+ "integrity": "sha512-P4VAKFHqU0wx9O+q29Q8YVuaowaZ5EM77rxfmGnkHUJggh28useXQdopokgwMeYw2XUht49WX5RcTQ40rZIabw==",
135135 "dependencies": {
136− "@algolia/client-common": "4.22.1",
137− "@algolia/requester-common": "4.22.1",
138− "@algolia/transporter": "4.22.1"
136+ "@algolia/client-common": "4.23.3",
137+ "@algolia/requester-common": "4.23.3",
138+ "@algolia/transporter": "4.23.3"
139139 }
140140 },
141141 "node_modules/@algolia/events": {
@@ -144,47 +144,65 @@
144144 "integrity": "sha512-FQzvOCgoFXAbf5Y6mYozw2aj5KCJoA3m4heImceldzPSMbdyS4atVjJzXKMsfX3wnZTFYwkkt8/z8UesLHlSBQ=="
145145 },
146146 "node_modules/@algolia/logger-common": {
147− "version": "4.22.1",
148− "resolved": "https://registry.npmjs.org/@algolia/logger-common/-/logger-common-4.22.1.tgz",
149− "integrity": "sha512-OnTFymd2odHSO39r4DSWRFETkBufnY2iGUZNrMXpIhF5cmFE8pGoINNPzwg02QLBlGSaLqdKy0bM8S0GyqPLBg=="
147+ "version": "4.23.3",
148+ "resolved": "https://registry.npmjs.org/@algolia/logger-common/-/logger-common-4.23.3.tgz",
149+ "integrity": "sha512-y9kBtmJwiZ9ZZ+1Ek66P0M68mHQzKRxkW5kAAXYN/rdzgDN0d2COsViEFufxJ0pb45K4FRcfC7+33YB4BLrZ+g=="
150150 },
151151 "node_modules/@algolia/logger-console": {
152− "version": "4.22.1",
153− "resolved": "https://registry.npmjs.org/@algolia/logger-console/-/logger-console-4.22.1.tgz",
154− "integrity": "sha512-O99rcqpVPKN1RlpgD6H3khUWylU24OXlzkavUAMy6QZd1776QAcauE3oP8CmD43nbaTjBexZj2nGsBH9Tc0FVA==",
152+ "version": "4.23.3",
153+ "resolved": "https://registry.npmjs.org/@algolia/logger-console/-/logger-console-4.23.3.tgz",
154+ "integrity": "sha512-8xoiseoWDKuCVnWP8jHthgaeobDLolh00KJAdMe9XPrWPuf1by732jSpgy2BlsLTaT9m32pHI8CRfrOqQzHv3A==",
155155 "dependencies": {
156− "@algolia/logger-common": "4.22.1"
156+ "@algolia/logger-common": "4.23.3"
157+ }
158+ },
159+ "node_modules/@algolia/recommend": {
160+ "version": "4.23.3",
161+ "resolved": "https://registry.npmjs.org/@algolia/recommend/-/recommend-4.23.3.tgz",
162+ "integrity": "sha512-9fK4nXZF0bFkdcLBRDexsnGzVmu4TSYZqxdpgBW2tEyfuSSY54D4qSRkLmNkrrz4YFvdh2GM1gA8vSsnZPR73w==",
163+ "dependencies": {
164+ "@algolia/cache-browser-local-storage": "4.23.3",
165+ "@algolia/cache-common": "4.23.3",
166+ "@algolia/cache-in-memory": "4.23.3",
167+ "@algolia/client-common": "4.23.3",
168+ "@algolia/client-search": "4.23.3",
169+ "@algolia/logger-common": "4.23.3",
170+ "@algolia/logger-console": "4.23.3",
171+ "@algolia/requester-browser-xhr": "4.23.3",
172+ "@algolia/requester-common": "4.23.3",
173+ "@algolia/requester-node-http": "4.23.3",
174+ "@algolia/transporter": "4.23.3"
157175 }
158176 },
159177 "node_modules/@algolia/requester-browser-xhr": {
160− "version": "4.22.1",
161− "resolved": "https://registry.npmjs.org/@algolia/requester-browser-xhr/-/requester-browser-xhr-4.22.1.tgz",
162− "integrity": "sha512-dtQGYIg6MteqT1Uay3J/0NDqD+UciHy3QgRbk7bNddOJu+p3hzjTRYESqEnoX/DpEkaNYdRHUKNylsqMpgwaEw==",
178+ "version": "4.23.3",
179+ "resolved": "https://registry.npmjs.org/@algolia/requester-browser-xhr/-/requester-browser-xhr-4.23.3.tgz",
180+ "integrity": "sha512-jDWGIQ96BhXbmONAQsasIpTYWslyjkiGu0Quydjlowe+ciqySpiDUrJHERIRfELE5+wFc7hc1Q5hqjGoV7yghw==",
163181 "dependencies": {
164− "@algolia/requester-common": "4.22.1"
182+ "@algolia/requester-common": "4.23.3"
165183 }
166184 },
167185 "node_modules/@algolia/requester-common": {
168− "version": "4.22.1",
169− "resolved": "https://registry.npmjs.org/@algolia/requester-common/-/requester-common-4.22.1.tgz",
170− "integrity": "sha512-dgvhSAtg2MJnR+BxrIFqlLtkLlVVhas9HgYKMk2Uxiy5m6/8HZBL40JVAMb2LovoPFs9I/EWIoFVjOrFwzn5Qg=="
186+ "version": "4.23.3",
187+ "resolved": "https://registry.npmjs.org/@algolia/requester-common/-/requester-common-4.23.3.tgz",
188+ "integrity": "sha512-xloIdr/bedtYEGcXCiF2muajyvRhwop4cMZo+K2qzNht0CMzlRkm8YsDdj5IaBhshqfgmBb3rTg4sL4/PpvLYw=="
171189 },
172190 "node_modules/@algolia/requester-node-http": {
173− "version": "4.22.1",
174− "resolved": "https://registry.npmjs.org/@algolia/requester-node-http/-/requester-node-http-4.22.1.tgz",
175− "integrity": "sha512-JfmZ3MVFQkAU+zug8H3s8rZ6h0ahHZL/SpMaSasTCGYR5EEJsCc8SI5UZ6raPN2tjxa5bxS13BRpGSBUens7EA==",
191+ "version": "4.23.3",
192+ "resolved": "https://registry.npmjs.org/@algolia/requester-node-http/-/requester-node-http-4.23.3.tgz",
193+ "integrity": "sha512-zgu++8Uj03IWDEJM3fuNl34s746JnZOWn1Uz5taV1dFyJhVM/kTNw9Ik7YJWiUNHJQXcaD8IXD1eCb0nq/aByA==",
176194 "dependencies": {
177− "@algolia/requester-common": "4.22.1"
195+ "@algolia/requester-common": "4.23.3"
178196 }
179197 },
180198 "node_modules/@algolia/transporter": {
181− "version": "4.22.1",
182− "resolved": "https://registry.npmjs.org/@algolia/transporter/-/transporter-4.22.1.tgz",
183− "integrity": "sha512-kzWgc2c9IdxMa3YqA6TN0NW5VrKYYW/BELIn7vnLyn+U/RFdZ4lxxt9/8yq3DKV5snvoDzzO4ClyejZRdV3lMQ==",
199+ "version": "4.23.3",
200+ "resolved": "https://registry.npmjs.org/@algolia/transporter/-/transporter-4.23.3.tgz",
201+ "integrity": "sha512-Wjl5gttqnf/gQKJA+dafnD0Y6Yw97yvfY8R9h0dQltX1GXTgNs1zWgvtWW0tHl1EgMdhAyw189uWiZMnL3QebQ==",
184202 "dependencies": {
185− "@algolia/cache-common": "4.22.1",
186− "@algolia/logger-common": "4.22.1",
187− "@algolia/requester-common": "4.22.1"
203+ "@algolia/cache-common": "4.23.3",
204+ "@algolia/logger-common": "4.23.3",
205+ "@algolia/requester-common": "4.23.3"
188206 }
189207 },
190208 "node_modules/@ampproject/remapping": {
@@ -531,9 +549,9 @@
531549 }
532550 },
533551 "node_modules/@babel/helper-plugin-utils": {
534− "version": "7.22.5",
535− "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.22.5.tgz",
536− "integrity": "sha512-uLls06UVKgFG9QD4OeFYLEGteMIAa5kpTPcFL28yuCIIzsf6ZyKZMllKVOCZFhiZ5ptnwX4mtKdWCBE/uT4amg==",
552+ "version": "7.24.5",
553+ "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.24.5.tgz",
554+ "integrity": "sha512-xjNLDopRzW2o6ba0gKbkZq5YWEBaK3PCyTOY1K2P/O07LGMhMqlMXPxwN4S5/RhWuCobT8z0jrlKGlYmeR1OhQ==",
537555 "engines": {
538556 "node": ">=6.9.0"
539557 }
@@ -1608,11 +1626,11 @@
16081626 }
16091627 },
16101628 "node_modules/@babel/plugin-transform-react-constant-elements": {
1611− "version": "7.23.3",
1612− "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-constant-elements/-/plugin-transform-react-constant-elements-7.23.3.tgz",
1613− "integrity": "sha512-zP0QKq/p6O42OL94udMgSfKXyse4RyJ0JqbQ34zDAONWjyrEsghYEyTSK5FIpmXmCpB55SHokL1cRRKHv8L2Qw==",
1629+ "version": "7.24.1",
1630+ "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-constant-elements/-/plugin-transform-react-constant-elements-7.24.1.tgz",
1631+ "integrity": "sha512-QXp1U9x0R7tkiGB0FOk8o74jhnap0FlZ5gNkRIWdG3eP+SvMFg118e1zaWewDzgABb106QSKpVsD3Wgd8t6ifA==",
16141632 "dependencies": {
1615− "@babel/helper-plugin-utils": "^7.22.5"
1633+ "@babel/helper-plugin-utils": "^7.24.0"
16161634 },
16171635 "engines": {
16181636 "node": ">=6.9.0"
@@ -2133,18 +2151,18 @@
21332151 }
21342152 },
21352153 "node_modules/@docsearch/css": {
2136− "version": "3.5.2",
2137− "resolved": "https://registry.npmjs.org/@docsearch/css/-/css-3.5.2.tgz",
2138− "integrity": "sha512-SPiDHaWKQZpwR2siD0KQUwlStvIAnEyK6tAE2h2Wuoq8ue9skzhlyVQ1ddzOxX6khULnAALDiR/isSF3bnuciA=="
2154+ "version": "3.6.0",
2155+ "resolved": "https://registry.npmjs.org/@docsearch/css/-/css-3.6.0.tgz",
2156+ "integrity": "sha512-+sbxb71sWre+PwDK7X2T8+bhS6clcVMLwBPznX45Qu6opJcgRjAp7gYSDzVFp187J+feSj5dNBN1mJoi6ckkUQ=="
21392157 },
21402158 "node_modules/@docsearch/react": {
2141− "version": "3.5.2",
2142− "resolved": "https://registry.npmjs.org/@docsearch/react/-/react-3.5.2.tgz",
2143− "integrity": "sha512-9Ahcrs5z2jq/DcAvYtvlqEBHImbm4YJI8M9y0x6Tqg598P40HTEkX7hsMcIuThI+hTFxRGZ9hll0Wygm2yEjng==",
2159+ "version": "3.6.0",
2160+ "resolved": "https://registry.npmjs.org/@docsearch/react/-/react-3.6.0.tgz",
2161+ "integrity": "sha512-HUFut4ztcVNmqy9gp/wxNbC7pTOHhgVVkHVGCACTuLhUKUhKAF9KYHJtMiLUJxEqiFLQiuri1fWF8zqwM/cu1w==",
21442162 "dependencies": {
21452163 "@algolia/autocomplete-core": "1.9.3",
21462164 "@algolia/autocomplete-preset-algolia": "1.9.3",
2147− "@docsearch/css": "3.5.2",
2165+ "@docsearch/css": "3.6.0",
21482166 "algoliasearch": "^4.19.1"
21492167 },
21502168 "peerDependencies": {
@@ -2169,9 +2187,9 @@
21692187 }
21702188 },
21712189 "node_modules/@docusaurus/core": {
2172− "version": "3.1.1",
2173− "resolved": "https://registry.npmjs.org/@docusaurus/core/-/core-3.1.1.tgz",
2174− "integrity": "sha512-2nQfKFcf+MLEM7JXsXwQxPOmQAR6ytKMZVSx7tVi9HEm9WtfwBH1fp6bn8Gj4zLUhjWKCLoysQ9/Wm+EZCQ4yQ==",
2190+ "version": "3.3.2",
2191+ "resolved": "https://registry.npmjs.org/@docusaurus/core/-/core-3.3.2.tgz",
2192+ "integrity": "sha512-PzKMydKI3IU1LmeZQDi+ut5RSuilbXnA8QdowGeJEgU8EJjmx3rBHNT1LxQxOVqNEwpWi/csLwd9bn7rUjggPA==",
21752193 "dependencies": {
21762194 "@babel/core": "^7.23.3",
21772195 "@babel/generator": "^7.23.3",
@@ -2183,15 +2201,12 @@
21832201 "@babel/runtime": "^7.22.6",
21842202 "@babel/runtime-corejs3": "^7.22.6",
21852203 "@babel/traverse": "^7.22.8",
2186− "@docusaurus/cssnano-preset": "3.1.1",
2187− "@docusaurus/logger": "3.1.1",
2188− "@docusaurus/mdx-loader": "3.1.1",
2189− "@docusaurus/react-loadable": "5.5.2",
2190− "@docusaurus/utils": "3.1.1",
2191− "@docusaurus/utils-common": "3.1.1",
2192− "@docusaurus/utils-validation": "3.1.1",
2193− "@slorber/static-site-generator-webpack-plugin": "^4.0.7",
2194− "@svgr/webpack": "^6.5.1",
2204+ "@docusaurus/cssnano-preset": "3.3.2",
2205+ "@docusaurus/logger": "3.3.2",
2206+ "@docusaurus/mdx-loader": "3.3.2",
2207+ "@docusaurus/utils": "3.3.2",
2208+ "@docusaurus/utils-common": "3.3.2",
2209+ "@docusaurus/utils-validation": "3.3.2",
21952210 "autoprefixer": "^10.4.14",
21962211 "babel-loader": "^9.1.3",
21972212 "babel-plugin-dynamic-import-node": "^2.3.3",
@@ -2205,12 +2220,13 @@
22052220 "copy-webpack-plugin": "^11.0.0",
22062221 "core-js": "^3.31.1",
22072222 "css-loader": "^6.8.1",
2208− "css-minimizer-webpack-plugin": "^4.2.2",
2209− "cssnano": "^5.1.15",
2223+ "css-minimizer-webpack-plugin": "^5.0.1",
2224+ "cssnano": "^6.1.2",
22102225 "del": "^6.1.1",
22112226 "detect-port": "^1.5.1",
22122227 "escape-html": "^1.0.3",
22132228 "eta": "^2.2.0",
2229+ "eval": "^0.1.8",
22142230 "file-loader": "^6.2.0",
22152231 "fs-extra": "^11.1.1",
22162232 "html-minifier-terser": "^7.2.0",
@@ -2219,12 +2235,13 @@
22192235 "leven": "^3.1.0",
22202236 "lodash": "^4.17.21",
22212237 "mini-css-extract-plugin": "^2.7.6",
2238+ "p-map": "^4.0.0",
22222239 "postcss": "^8.4.26",
22232240 "postcss-loader": "^7.3.3",
22242241 "prompts": "^2.4.2",
22252242 "react-dev-utils": "^12.0.1",
22262243 "react-helmet-async": "^1.3.0",
2227− "react-loadable": "npm:@docusaurus/react-loadable@5.5.2",
2244+ "react-loadable": "npm:@docusaurus/react-loadable@6.0.0",
22282245 "react-loadable-ssr-addon-v5-slorber": "^1.0.1",
22292246 "react-router": "^5.3.4",
22302247 "react-router-config": "^5.1.1",
@@ -2255,13 +2272,13 @@
22552272 }
22562273 },
22572274 "node_modules/@docusaurus/cssnano-preset": {
2258− "version": "3.1.1",
2259− "resolved": "https://registry.npmjs.org/@docusaurus/cssnano-preset/-/cssnano-preset-3.1.1.tgz",
2260− "integrity": "sha512-LnoIDjJWbirdbVZDMq+4hwmrTl2yHDnBf9MLG9qyExeAE3ac35s4yUhJI8yyTCdixzNfKit4cbXblzzqMu4+8g==",
2275+ "version": "3.3.2",
2276+ "resolved": "https://registry.npmjs.org/@docusaurus/cssnano-preset/-/cssnano-preset-3.3.2.tgz",
2277+ "integrity": "sha512-+5+epLk/Rp4vFML4zmyTATNc3Is+buMAL6dNjrMWahdJCJlMWMPd/8YfU+2PA57t8mlSbhLJ7vAZVy54cd1vRQ==",
22612278 "dependencies": {
2262− "cssnano-preset-advanced": "^5.3.10",
2263− "postcss": "^8.4.26",
2264− "postcss-sort-media-queries": "^4.4.1",
2279+ "cssnano-preset-advanced": "^6.1.2",
2280+ "postcss": "^8.4.38",
2281+ "postcss-sort-media-queries": "^5.2.0",
22652282 "tslib": "^2.6.0"
22662283 },
22672284 "engines": {
@@ -2269,9 +2286,9 @@
22692286 }
22702287 },
22712288 "node_modules/@docusaurus/logger": {
2272− "version": "3.1.1",
2273− "resolved": "https://registry.npmjs.org/@docusaurus/logger/-/logger-3.1.1.tgz",
2274− "integrity": "sha512-BjkNDpQzewcTnST8trx4idSoAla6zZ3w22NqM/UMcFtvYJgmoE4layuTzlfql3VFPNuivvj7BOExa/+21y4X2Q==",
2289+ "version": "3.3.2",
2290+ "resolved": "https://registry.npmjs.org/@docusaurus/logger/-/logger-3.3.2.tgz",
2291+ "integrity": "sha512-Ldu38GJ4P8g4guN7d7pyCOJ7qQugG7RVyaxrK8OnxuTlaImvQw33aDRwaX2eNmX8YK6v+//Z502F4sOZbHHCHQ==",
22752292 "dependencies": {
22762293 "chalk": "^4.1.2",
22772294 "tslib": "^2.6.0"
@@ -2281,15 +2298,13 @@
22812298 }
22822299 },
22832300 "node_modules/@docusaurus/mdx-loader": {
2284− "version": "3.1.1",
2285− "resolved": "https://registry.npmjs.org/@docusaurus/mdx-loader/-/mdx-loader-3.1.1.tgz",
2286− "integrity": "sha512-xN2IccH9+sv7TmxwsDJNS97BHdmlqWwho+kIVY4tcCXkp+k4QuzvWBeunIMzeayY4Fu13A6sAjHGv5qm72KyGA==",
2301+ "version": "3.3.2",
2302+ "resolved": "https://registry.npmjs.org/@docusaurus/mdx-loader/-/mdx-loader-3.3.2.tgz",
2303+ "integrity": "sha512-AFRxj/aOk3/mfYDPxE3wTbrjeayVRvNSZP7mgMuUlrb2UlPRbSVAFX1k2RbgAJrnTSwMgb92m2BhJgYRfptN3g==",
22872304 "dependencies": {
2288− "@babel/parser": "^7.22.7",
2289− "@babel/traverse": "^7.22.8",
2290− "@docusaurus/logger": "3.1.1",
2291− "@docusaurus/utils": "3.1.1",
2292− "@docusaurus/utils-validation": "3.1.1",
2305+ "@docusaurus/logger": "3.3.2",
2306+ "@docusaurus/utils": "3.3.2",
2307+ "@docusaurus/utils-validation": "3.3.2",
22932308 "@mdx-js/mdx": "^3.0.0",
22942309 "@slorber/remark-comment": "^1.0.0",
22952310 "escape-html": "^1.0.3",
@@ -2321,18 +2336,17 @@
23212336 }
23222337 },
23232338 "node_modules/@docusaurus/module-type-aliases": {
2324− "version": "3.1.1",
2325− "resolved": "https://registry.npmjs.org/@docusaurus/module-type-aliases/-/module-type-aliases-3.1.1.tgz",
2326− "integrity": "sha512-xBJyx0TMfAfVZ9ZeIOb1awdXgR4YJMocIEzTps91rq+hJDFJgJaylDtmoRhUxkwuYmNK1GJpW95b7DLztSBJ3A==",
2339+ "version": "3.3.2",
2340+ "resolved": "https://registry.npmjs.org/@docusaurus/module-type-aliases/-/module-type-aliases-3.3.2.tgz",
2341+ "integrity": "sha512-b/XB0TBJah5yKb4LYuJT4buFvL0MGAb0+vJDrJtlYMguRtsEBkf2nWl5xP7h4Dlw6ol0hsHrCYzJ50kNIOEclw==",
23272342 "dependencies": {
2328− "@docusaurus/react-loadable": "5.5.2",
2329− "@docusaurus/types": "3.1.1",
2343+ "@docusaurus/types": "3.3.2",
23302344 "@types/history": "^4.7.11",
23312345 "@types/react": "*",
23322346 "@types/react-router-config": "*",
23332347 "@types/react-router-dom": "*",
23342348 "react-helmet-async": "*",
2335− "react-loadable": "npm:@docusaurus/react-loadable@5.5.2"
2349+ "react-loadable": "npm:@docusaurus/react-loadable@6.0.0"
23362350 },
23372351 "peerDependencies": {
23382352 "react": "*",
@@ -2340,17 +2354,17 @@
23402354 }
23412355 },
23422356 "node_modules/@docusaurus/plugin-content-blog": {
2343− "version": "3.1.1",
2344− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-blog/-/plugin-content-blog-3.1.1.tgz",
2345− "integrity": "sha512-ew/3VtVoG3emoAKmoZl7oKe1zdFOsI0NbcHS26kIxt2Z8vcXKCUgK9jJJrz0TbOipyETPhqwq4nbitrY3baibg==",
2346− "dependencies": {
2347− "@docusaurus/core": "3.1.1",
2348− "@docusaurus/logger": "3.1.1",
2349− "@docusaurus/mdx-loader": "3.1.1",
2350− "@docusaurus/types": "3.1.1",
2351− "@docusaurus/utils": "3.1.1",
2352− "@docusaurus/utils-common": "3.1.1",
2353− "@docusaurus/utils-validation": "3.1.1",
2357+ "version": "3.3.2",
2358+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-blog/-/plugin-content-blog-3.3.2.tgz",
2359+ "integrity": "sha512-fJU+dmqp231LnwDJv+BHVWft8pcUS2xVPZdeYH6/ibH1s2wQ/sLcmUrGWyIv/Gq9Ptj8XWjRPMghlxghuPPoxg==",
2360+ "dependencies": {
2361+ "@docusaurus/core": "3.3.2",
2362+ "@docusaurus/logger": "3.3.2",
2363+ "@docusaurus/mdx-loader": "3.3.2",
2364+ "@docusaurus/types": "3.3.2",
2365+ "@docusaurus/utils": "3.3.2",
2366+ "@docusaurus/utils-common": "3.3.2",
2367+ "@docusaurus/utils-validation": "3.3.2",
23542368 "cheerio": "^1.0.0-rc.12",
23552369 "feed": "^4.2.2",
23562370 "fs-extra": "^11.1.1",
@@ -2371,17 +2385,18 @@
23712385 }
23722386 },
23732387 "node_modules/@docusaurus/plugin-content-docs": {
2374− "version": "3.1.1",
2375− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-docs/-/plugin-content-docs-3.1.1.tgz",
2376− "integrity": "sha512-lhFq4E874zw0UOH7ujzxnCayOyAt0f9YPVYSb9ohxrdCM8B4szxitUw9rIX4V9JLLHVoqIJb6k+lJJ1jrcGJ0A==",
2377− "dependencies": {
2378− "@docusaurus/core": "3.1.1",
2379− "@docusaurus/logger": "3.1.1",
2380− "@docusaurus/mdx-loader": "3.1.1",
2381− "@docusaurus/module-type-aliases": "3.1.1",
2382− "@docusaurus/types": "3.1.1",
2383− "@docusaurus/utils": "3.1.1",
2384− "@docusaurus/utils-validation": "3.1.1",
2388+ "version": "3.3.2",
2389+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-docs/-/plugin-content-docs-3.3.2.tgz",
2390+ "integrity": "sha512-Dm1ri2VlGATTN3VGk1ZRqdRXWa1UlFubjaEL6JaxaK7IIFqN/Esjpl+Xw10R33loHcRww/H76VdEeYayaL76eg==",
2391+ "dependencies": {
2392+ "@docusaurus/core": "3.3.2",
2393+ "@docusaurus/logger": "3.3.2",
2394+ "@docusaurus/mdx-loader": "3.3.2",
2395+ "@docusaurus/module-type-aliases": "3.3.2",
2396+ "@docusaurus/types": "3.3.2",
2397+ "@docusaurus/utils": "3.3.2",
2398+ "@docusaurus/utils-common": "3.3.2",
2399+ "@docusaurus/utils-validation": "3.3.2",
23852400 "@types/react-router-config": "^5.0.7",
23862401 "combine-promises": "^1.1.0",
23872402 "fs-extra": "^11.1.1",
@@ -2400,15 +2415,15 @@
24002415 }
24012416 },
24022417 "node_modules/@docusaurus/plugin-content-pages": {
2403− "version": "3.1.1",
2404− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-pages/-/plugin-content-pages-3.1.1.tgz",
2405− "integrity": "sha512-NQHncNRAJbyLtgTim9GlEnNYsFhuCxaCNkMwikuxLTiGIPH7r/jpb7O3f3jUMYMebZZZrDq5S7om9a6rvB/YCA==",
2406− "dependencies": {
2407− "@docusaurus/core": "3.1.1",
2408− "@docusaurus/mdx-loader": "3.1.1",
2409− "@docusaurus/types": "3.1.1",
2410− "@docusaurus/utils": "3.1.1",
2411− "@docusaurus/utils-validation": "3.1.1",
2418+ "version": "3.3.2",
2419+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-pages/-/plugin-content-pages-3.3.2.tgz",
2420+ "integrity": "sha512-EKc9fQn5H2+OcGER8x1aR+7URtAGWySUgULfqE/M14+rIisdrBstuEZ4lUPDRrSIexOVClML82h2fDS+GSb8Ew==",
2421+ "dependencies": {
2422+ "@docusaurus/core": "3.3.2",
2423+ "@docusaurus/mdx-loader": "3.3.2",
2424+ "@docusaurus/types": "3.3.2",
2425+ "@docusaurus/utils": "3.3.2",
2426+ "@docusaurus/utils-validation": "3.3.2",
24122427 "fs-extra": "^11.1.1",
24132428 "tslib": "^2.6.0",
24142429 "webpack": "^5.88.1"
@@ -2422,13 +2437,13 @@
24222437 }
24232438 },
24242439 "node_modules/@docusaurus/plugin-debug": {
2425− "version": "3.1.1",
2426− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-debug/-/plugin-debug-3.1.1.tgz",
2427− "integrity": "sha512-xWeMkueM9wE/8LVvl4+Qf1WqwXmreMjI5Kgr7GYCDoJ8zu4kD+KaMhrh7py7MNM38IFvU1RfrGKacCEe2DRRfQ==",
2440+ "version": "3.3.2",
2441+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-debug/-/plugin-debug-3.3.2.tgz",
2442+ "integrity": "sha512-oBIBmwtaB+YS0XlmZ3gCO+cMbsGvIYuAKkAopoCh0arVjtlyPbejzPrHuCoRHB9G7abjNZw7zoONOR8+8LM5+Q==",
24282443 "dependencies": {
2429− "@docusaurus/core": "3.1.1",
2430− "@docusaurus/types": "3.1.1",
2431− "@docusaurus/utils": "3.1.1",
2444+ "@docusaurus/core": "3.3.2",
2445+ "@docusaurus/types": "3.3.2",
2446+ "@docusaurus/utils": "3.3.2",
24322447 "fs-extra": "^11.1.1",
24332448 "react-json-view-lite": "^1.2.0",
24342449 "tslib": "^2.6.0"
@@ -2442,13 +2457,13 @@
24422457 }
24432458 },
24442459 "node_modules/@docusaurus/plugin-google-analytics": {
2445− "version": "3.1.1",
2446− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-3.1.1.tgz",
2447− "integrity": "sha512-+q2UpWTqVi8GdlLoSlD5bS/YpxW+QMoBwrPrUH/NpvpuOi0Of7MTotsQf9JWd3hymZxl2uu1o3PIrbpxfeDFDQ==",
2460+ "version": "3.3.2",
2461+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-3.3.2.tgz",
2462+ "integrity": "sha512-jXhrEIhYPSClMBK6/IA8qf1/FBoxqGXZvg7EuBax9HaK9+kL3L0TJIlatd8jQJOMtds8mKw806TOCc3rtEad1A==",
24482463 "dependencies": {
2449− "@docusaurus/core": "3.1.1",
2450− "@docusaurus/types": "3.1.1",
2451− "@docusaurus/utils-validation": "3.1.1",
2464+ "@docusaurus/core": "3.3.2",
2465+ "@docusaurus/types": "3.3.2",
2466+ "@docusaurus/utils-validation": "3.3.2",
24522467 "tslib": "^2.6.0"
24532468 },
24542469 "engines": {
@@ -2460,13 +2475,13 @@
24602475 }
24612476 },
24622477 "node_modules/@docusaurus/plugin-google-gtag": {
2463− "version": "3.1.1",
2464− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-3.1.1.tgz",
2465− "integrity": "sha512-0mMPiBBlQ5LFHTtjxuvt/6yzh8v7OxLi3CbeEsxXZpUzcKO/GC7UA1VOWUoBeQzQL508J12HTAlR3IBU9OofSw==",
2478+ "version": "3.3.2",
2479+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-3.3.2.tgz",
2480+ "integrity": "sha512-vcrKOHGbIDjVnNMrfbNpRQR1x6Jvcrb48kVzpBAOsKbj9rXZm/idjVAXRaewwobHdOrJkfWS/UJoxzK8wyLRBQ==",
24662481 "dependencies": {
2467− "@docusaurus/core": "3.1.1",
2468− "@docusaurus/types": "3.1.1",
2469− "@docusaurus/utils-validation": "3.1.1",
2482+ "@docusaurus/core": "3.3.2",
2483+ "@docusaurus/types": "3.3.2",
2484+ "@docusaurus/utils-validation": "3.3.2",
24702485 "@types/gtag.js": "^0.0.12",
24712486 "tslib": "^2.6.0"
24722487 },
@@ -2479,13 +2494,13 @@
24792494 }
24802495 },
24812496 "node_modules/@docusaurus/plugin-google-tag-manager": {
2482− "version": "3.1.1",
2483− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-3.1.1.tgz",
2484− "integrity": "sha512-d07bsrMLdDIryDtY17DgqYUbjkswZQr8cLWl4tzXrt5OR/T/zxC1SYKajzB3fd87zTu5W5klV5GmUwcNSMXQXA==",
2497+ "version": "3.3.2",
2498+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-3.3.2.tgz",
2499+ "integrity": "sha512-ldkR58Fdeks0vC+HQ+L+bGFSJsotQsipXD+iKXQFvkOfmPIV6QbHRd7IIcm5b6UtwOiK33PylNS++gjyLUmaGw==",
24852500 "dependencies": {
2486− "@docusaurus/core": "3.1.1",
2487− "@docusaurus/types": "3.1.1",
2488− "@docusaurus/utils-validation": "3.1.1",
2501+ "@docusaurus/core": "3.3.2",
2502+ "@docusaurus/types": "3.3.2",
2503+ "@docusaurus/utils-validation": "3.3.2",
24892504 "tslib": "^2.6.0"
24902505 },
24912506 "engines": {
@@ -2497,16 +2512,16 @@
24972512 }
24982513 },
24992514 "node_modules/@docusaurus/plugin-sitemap": {
2500− "version": "3.1.1",
2501− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-sitemap/-/plugin-sitemap-3.1.1.tgz",
2502− "integrity": "sha512-iJ4hCaMmDaUqRv131XJdt/C/jJQx8UreDWTRqZKtNydvZVh/o4yXGRRFOplea1D9b/zpwL1Y+ZDwX7xMhIOTmg==",
2503− "dependencies": {
2504− "@docusaurus/core": "3.1.1",
2505− "@docusaurus/logger": "3.1.1",
2506− "@docusaurus/types": "3.1.1",
2507− "@docusaurus/utils": "3.1.1",
2508− "@docusaurus/utils-common": "3.1.1",
2509− "@docusaurus/utils-validation": "3.1.1",
2515+ "version": "3.3.2",
2516+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-sitemap/-/plugin-sitemap-3.3.2.tgz",
2517+ "integrity": "sha512-/ZI1+bwZBhAgC30inBsHe3qY9LOZS+79fRGkNdTcGHRMcdAp6Vw2pCd1gzlxd/xU+HXsNP6cLmTOrggmRp3Ujg==",
2518+ "dependencies": {
2519+ "@docusaurus/core": "3.3.2",
2520+ "@docusaurus/logger": "3.3.2",
2521+ "@docusaurus/types": "3.3.2",
2522+ "@docusaurus/utils": "3.3.2",
2523+ "@docusaurus/utils-common": "3.3.2",
2524+ "@docusaurus/utils-validation": "3.3.2",
25102525 "fs-extra": "^11.1.1",
25112526 "sitemap": "^7.1.1",
25122527 "tslib": "^2.6.0"
@@ -2520,23 +2535,23 @@
25202535 }
25212536 },
25222537 "node_modules/@docusaurus/preset-classic": {
2523− "version": "3.1.1",
2524− "resolved": "https://registry.npmjs.org/@docusaurus/preset-classic/-/preset-classic-3.1.1.tgz",
2525− "integrity": "sha512-jG4ys/hWYf69iaN/xOmF+3kjs4Nnz1Ay3CjFLDtYa8KdxbmUhArA9HmP26ru5N0wbVWhY+6kmpYhTJpez5wTyg==",
2526− "dependencies": {
2527− "@docusaurus/core": "3.1.1",
2528− "@docusaurus/plugin-content-blog": "3.1.1",
2529− "@docusaurus/plugin-content-docs": "3.1.1",
2530− "@docusaurus/plugin-content-pages": "3.1.1",
2531− "@docusaurus/plugin-debug": "3.1.1",
2532− "@docusaurus/plugin-google-analytics": "3.1.1",
2533− "@docusaurus/plugin-google-gtag": "3.1.1",
2534− "@docusaurus/plugin-google-tag-manager": "3.1.1",
2535− "@docusaurus/plugin-sitemap": "3.1.1",
2536− "@docusaurus/theme-classic": "3.1.1",
2537− "@docusaurus/theme-common": "3.1.1",
2538− "@docusaurus/theme-search-algolia": "3.1.1",
2539− "@docusaurus/types": "3.1.1"
2538+ "version": "3.3.2",
2539+ "resolved": "https://registry.npmjs.org/@docusaurus/preset-classic/-/preset-classic-3.3.2.tgz",
2540+ "integrity": "sha512-1SDS7YIUN1Pg3BmD6TOTjhB7RSBHJRpgIRKx9TpxqyDrJ92sqtZhomDc6UYoMMLQNF2wHFZZVGFjxJhw2VpL+Q==",
2541+ "dependencies": {
2542+ "@docusaurus/core": "3.3.2",
2543+ "@docusaurus/plugin-content-blog": "3.3.2",
2544+ "@docusaurus/plugin-content-docs": "3.3.2",
2545+ "@docusaurus/plugin-content-pages": "3.3.2",
2546+ "@docusaurus/plugin-debug": "3.3.2",
2547+ "@docusaurus/plugin-google-analytics": "3.3.2",
2548+ "@docusaurus/plugin-google-gtag": "3.3.2",
2549+ "@docusaurus/plugin-google-tag-manager": "3.3.2",
2550+ "@docusaurus/plugin-sitemap": "3.3.2",
2551+ "@docusaurus/theme-classic": "3.3.2",
2552+ "@docusaurus/theme-common": "3.3.2",
2553+ "@docusaurus/theme-search-algolia": "3.3.2",
2554+ "@docusaurus/types": "3.3.2"
25402555 },
25412556 "engines": {
25422557 "node": ">=18.0"
@@ -2546,35 +2561,23 @@
25462561 "react-dom": "^18.0.0"
25472562 }
25482563 },
2549− "node_modules/@docusaurus/react-loadable": {
2550− "version": "5.5.2",
2551− "resolved": "https://registry.npmjs.org/@docusaurus/react-loadable/-/react-loadable-5.5.2.tgz",
2552− "integrity": "sha512-A3dYjdBGuy0IGT+wyLIGIKLRE+sAk1iNk0f1HjNDysO7u8lhL4N3VEm+FAubmJbAztn94F7MxBTPmnixbiyFdQ==",
2553− "dependencies": {
2554− "@types/react": "*",
2555− "prop-types": "^15.6.2"
2556− },
2557− "peerDependencies": {
2558− "react": "*"
2559− }
2560− },
25612564 "node_modules/@docusaurus/theme-classic": {
2562− "version": "3.1.1",
2563− "resolved": "https://registry.npmjs.org/@docusaurus/theme-classic/-/theme-classic-3.1.1.tgz",
2564− "integrity": "sha512-GiPE/jbWM8Qv1A14lk6s9fhc0LhPEQ00eIczRO4QL2nAQJZXkjPG6zaVx+1cZxPFWbAsqSjKe2lqkwF3fGkQ7Q==",
2565− "dependencies": {
2566− "@docusaurus/core": "3.1.1",
2567− "@docusaurus/mdx-loader": "3.1.1",
2568− "@docusaurus/module-type-aliases": "3.1.1",
2569− "@docusaurus/plugin-content-blog": "3.1.1",
2570− "@docusaurus/plugin-content-docs": "3.1.1",
2571− "@docusaurus/plugin-content-pages": "3.1.1",
2572− "@docusaurus/theme-common": "3.1.1",
2573− "@docusaurus/theme-translations": "3.1.1",
2574− "@docusaurus/types": "3.1.1",
2575− "@docusaurus/utils": "3.1.1",
2576− "@docusaurus/utils-common": "3.1.1",
2577− "@docusaurus/utils-validation": "3.1.1",
2565+ "version": "3.3.2",
2566+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-classic/-/theme-classic-3.3.2.tgz",
2567+ "integrity": "sha512-gepHFcsluIkPb4Im9ukkiO4lXrai671wzS3cKQkY9BXQgdVwsdPf/KS0Vs4Xlb0F10fTz+T3gNjkxNEgSN9M0A==",
2568+ "dependencies": {
2569+ "@docusaurus/core": "3.3.2",
2570+ "@docusaurus/mdx-loader": "3.3.2",
2571+ "@docusaurus/module-type-aliases": "3.3.2",
2572+ "@docusaurus/plugin-content-blog": "3.3.2",
2573+ "@docusaurus/plugin-content-docs": "3.3.2",
2574+ "@docusaurus/plugin-content-pages": "3.3.2",
2575+ "@docusaurus/theme-common": "3.3.2",
2576+ "@docusaurus/theme-translations": "3.3.2",
2577+ "@docusaurus/types": "3.3.2",
2578+ "@docusaurus/utils": "3.3.2",
2579+ "@docusaurus/utils-common": "3.3.2",
2580+ "@docusaurus/utils-validation": "3.3.2",
25782581 "@mdx-js/react": "^3.0.0",
25792582 "clsx": "^2.0.0",
25802583 "copy-text-to-clipboard": "^3.2.0",
@@ -2598,17 +2601,17 @@
25982601 }
25992602 },
26002603 "node_modules/@docusaurus/theme-common": {
2601− "version": "3.1.1",
2602− "resolved": "https://registry.npmjs.org/@docusaurus/theme-common/-/theme-common-3.1.1.tgz",
2603− "integrity": "sha512-38urZfeMhN70YaXkwIGXmcUcv2CEYK/2l4b05GkJPrbEbgpsIZM3Xc+Js2ehBGGZmfZq8GjjQ5RNQYG+MYzCYg==",
2604− "dependencies": {
2605− "@docusaurus/mdx-loader": "3.1.1",
2606− "@docusaurus/module-type-aliases": "3.1.1",
2607− "@docusaurus/plugin-content-blog": "3.1.1",
2608− "@docusaurus/plugin-content-docs": "3.1.1",
2609− "@docusaurus/plugin-content-pages": "3.1.1",
2610− "@docusaurus/utils": "3.1.1",
2611− "@docusaurus/utils-common": "3.1.1",
2604+ "version": "3.3.2",
2605+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-common/-/theme-common-3.3.2.tgz",
2606+ "integrity": "sha512-kXqSaL/sQqo4uAMQ4fHnvRZrH45Xz2OdJ3ABXDS7YVGPSDTBC8cLebFrRR4YF9EowUHto1UC/EIklJZQMG/usA==",
2607+ "dependencies": {
2608+ "@docusaurus/mdx-loader": "3.3.2",
2609+ "@docusaurus/module-type-aliases": "3.3.2",
2610+ "@docusaurus/plugin-content-blog": "3.3.2",
2611+ "@docusaurus/plugin-content-docs": "3.3.2",
2612+ "@docusaurus/plugin-content-pages": "3.3.2",
2613+ "@docusaurus/utils": "3.3.2",
2614+ "@docusaurus/utils-common": "3.3.2",
26122615 "@types/history": "^4.7.11",
26132616 "@types/react": "*",
26142617 "@types/react-router-config": "*",
@@ -2627,15 +2630,15 @@
26272630 }
26282631 },
26292632 "node_modules/@docusaurus/theme-mermaid": {
2630− "version": "3.1.1",
2631− "resolved": "https://registry.npmjs.org/@docusaurus/theme-mermaid/-/theme-mermaid-3.1.1.tgz",
2632− "integrity": "sha512-O6u9/7QX/ZapV4HJJSzNs0Jir1KA/LRLORWYeDvbGswqZNusj6q4iLELrKIClysJ3PB3zWUzyKtI/wjIKiV1vA==",
2633− "dependencies": {
2634− "@docusaurus/core": "3.1.1",
2635− "@docusaurus/module-type-aliases": "3.1.1",
2636− "@docusaurus/theme-common": "3.1.1",
2637− "@docusaurus/types": "3.1.1",
2638− "@docusaurus/utils-validation": "3.1.1",
2633+ "version": "3.3.2",
2634+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-mermaid/-/theme-mermaid-3.3.2.tgz",
2635+ "integrity": "sha512-JY6q7owe5S5iH2N9oTjNDkqmuPW/+4j/zrX46Xag4RYOzt+WtMkeJilbzak8QGG8I2wDJXjUvX7Lu/jWuDAwUg==",
2636+ "dependencies": {
2637+ "@docusaurus/core": "3.3.2",
2638+ "@docusaurus/module-type-aliases": "3.3.2",
2639+ "@docusaurus/theme-common": "3.3.2",
2640+ "@docusaurus/types": "3.3.2",
2641+ "@docusaurus/utils-validation": "3.3.2",
26392642 "mermaid": "^10.4.0",
26402643 "tslib": "^2.6.0"
26412644 },
@@ -2648,18 +2651,18 @@
26482651 }
26492652 },
26502653 "node_modules/@docusaurus/theme-search-algolia": {
2651− "version": "3.1.1",
2652− "resolved": "https://registry.npmjs.org/@docusaurus/theme-search-algolia/-/theme-search-algolia-3.1.1.tgz",
2653− "integrity": "sha512-tBH9VY5EpRctVdaAhT+b1BY8y5dyHVZGFXyCHgTrvcXQy5CV4q7serEX7U3SveNT9zksmchPyct6i1sFDC4Z5g==",
2654+ "version": "3.3.2",
2655+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-search-algolia/-/theme-search-algolia-3.3.2.tgz",
2656+ "integrity": "sha512-qLkfCl29VNBnF1MWiL9IyOQaHxUvicZp69hISyq/xMsNvFKHFOaOfk9xezYod2Q9xx3xxUh9t/QPigIei2tX4w==",
26542657 "dependencies": {
26552658 "@docsearch/react": "^3.5.2",
2656− "@docusaurus/core": "3.1.1",
2657− "@docusaurus/logger": "3.1.1",
2658− "@docusaurus/plugin-content-docs": "3.1.1",
2659− "@docusaurus/theme-common": "3.1.1",
2660− "@docusaurus/theme-translations": "3.1.1",
2661− "@docusaurus/utils": "3.1.1",
2662− "@docusaurus/utils-validation": "3.1.1",
2659+ "@docusaurus/core": "3.3.2",
2660+ "@docusaurus/logger": "3.3.2",
2661+ "@docusaurus/plugin-content-docs": "3.3.2",
2662+ "@docusaurus/theme-common": "3.3.2",
2663+ "@docusaurus/theme-translations": "3.3.2",
2664+ "@docusaurus/utils": "3.3.2",
2665+ "@docusaurus/utils-validation": "3.3.2",
26632666 "algoliasearch": "^4.18.0",
26642667 "algoliasearch-helper": "^3.13.3",
26652668 "clsx": "^2.0.0",
@@ -2678,9 +2681,9 @@
26782681 }
26792682 },
26802683 "node_modules/@docusaurus/theme-translations": {
2681− "version": "3.1.1",
2682− "resolved": "https://registry.npmjs.org/@docusaurus/theme-translations/-/theme-translations-3.1.1.tgz",
2683− "integrity": "sha512-xvWQFwjxHphpJq5fgk37FXCDdAa2o+r7FX8IpMg+bGZBNXyWBu3MjZ+G4+eUVNpDhVinTc+j6ucL0Ain5KCGrg==",
2684+ "version": "3.3.2",
2685+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-translations/-/theme-translations-3.3.2.tgz",
2686+ "integrity": "sha512-bPuiUG7Z8sNpGuTdGnmKl/oIPeTwKr0AXLGu9KaP6+UFfRZiyWbWE87ti97RrevB2ffojEdvchNujparR3jEZQ==",
26842687 "dependencies": {
26852688 "fs-extra": "^11.1.1",
26862689 "tslib": "^2.6.0"
@@ -2690,9 +2693,9 @@
26902693 }
26912694 },
26922695 "node_modules/@docusaurus/types": {
2693− "version": "3.1.1",
2694− "resolved": "https://registry.npmjs.org/@docusaurus/types/-/types-3.1.1.tgz",
2695− "integrity": "sha512-grBqOLnubUecgKFXN9q3uit2HFbCxTWX4Fam3ZFbMN0sWX9wOcDoA7lwdX/8AmeL20Oc4kQvWVgNrsT8bKRvzg==",
2696+ "version": "3.3.2",
2697+ "resolved": "https://registry.npmjs.org/@docusaurus/types/-/types-3.3.2.tgz",
2698+ "integrity": "sha512-5p201S7AZhliRxTU7uMKtSsoC8mgPA9bs9b5NQg1IRdRxJfflursXNVsgc3PcMqiUTul/v1s3k3rXXFlRE890w==",
26962699 "dependencies": {
26972700 "@mdx-js/mdx": "^3.0.0",
26982701 "@types/history": "^4.7.11",
@@ -2710,12 +2713,13 @@
27102713 }
27112714 },
27122715 "node_modules/@docusaurus/utils": {
2713− "version": "3.1.1",
2714− "resolved": "https://registry.npmjs.org/@docusaurus/utils/-/utils-3.1.1.tgz",
2715− "integrity": "sha512-ZJfJa5cJQtRYtqijsPEnAZoduW6sjAQ7ZCWSZavLcV10Fw0Z3gSaPKA/B4micvj2afRZ4gZxT7KfYqe5H8Cetg==",
2716+ "version": "3.3.2",
2717+ "resolved": "https://registry.npmjs.org/@docusaurus/utils/-/utils-3.3.2.tgz",
2718+ "integrity": "sha512-f4YMnBVymtkSxONv4Y8js3Gez9IgHX+Lcg6YRMOjVbq8sgCcdYK1lf6SObAuz5qB/mxiSK7tW0M9aaiIaUSUJg==",
27162719 "dependencies": {
2717− "@docusaurus/logger": "3.1.1",
2718− "@svgr/webpack": "^6.5.1",
2720+ "@docusaurus/logger": "3.3.2",
2721+ "@docusaurus/utils-common": "3.3.2",
2722+ "@svgr/webpack": "^8.1.0",
27192723 "escape-string-regexp": "^4.0.0",
27202724 "file-loader": "^6.2.0",
27212725 "fs-extra": "^11.1.1",
@@ -2726,6 +2730,7 @@
27262730 "js-yaml": "^4.1.0",
27272731 "lodash": "^4.17.21",
27282732 "micromatch": "^4.0.5",
2733+ "prompts": "^2.4.2",
27292734 "resolve-pathname": "^3.0.0",
27302735 "shelljs": "^0.8.5",
27312736 "tslib": "^2.6.0",
@@ -2745,9 +2750,9 @@
27452750 }
27462751 },
27472752 "node_modules/@docusaurus/utils-common": {
2748− "version": "3.1.1",
2749− "resolved": "https://registry.npmjs.org/@docusaurus/utils-common/-/utils-common-3.1.1.tgz",
2750− "integrity": "sha512-eGne3olsIoNfPug5ixjepZAIxeYFzHHnor55Wb2P57jNbtVaFvij/T+MS8U0dtZRFi50QU+UPmRrXdVUM8uyMg==",
2753+ "version": "3.3.2",
2754+ "resolved": "https://registry.npmjs.org/@docusaurus/utils-common/-/utils-common-3.3.2.tgz",
2755+ "integrity": "sha512-QWFTLEkPYsejJsLStgtmetMFIA3pM8EPexcZ4WZ7b++gO5jGVH7zsipREnCHzk6+eDgeaXfkR6UPaTt86bp8Og==",
27512756 "dependencies": {
27522757 "tslib": "^2.6.0"
27532758 },
@@ -2764,12 +2769,13 @@
27642769 }
27652770 },
27662771 "node_modules/@docusaurus/utils-validation": {
2767− "version": "3.1.1",
2768− "resolved": "https://registry.npmjs.org/@docusaurus/utils-validation/-/utils-validation-3.1.1.tgz",
2769− "integrity": "sha512-KlY4P9YVDnwL+nExvlIpu79abfEv6ZCHuOX4ZQ+gtip+Wxj0daccdReIWWtqxM/Fb5Cz1nQvUCc7VEtT8IBUAA==",
2772+ "version": "3.3.2",
2773+ "resolved": "https://registry.npmjs.org/@docusaurus/utils-validation/-/utils-validation-3.3.2.tgz",
2774+ "integrity": "sha512-itDgFs5+cbW9REuC7NdXals4V6++KifgVMzoGOOOSIifBQw+8ULhy86u5e1lnptVL0sv8oAjq2alO7I40GR7pA==",
27702775 "dependencies": {
2771− "@docusaurus/logger": "3.1.1",
2772− "@docusaurus/utils": "3.1.1",
2776+ "@docusaurus/logger": "3.3.2",
2777+ "@docusaurus/utils": "3.3.2",
2778+ "@docusaurus/utils-common": "3.3.2",
27732779 "joi": "^17.9.2",
27742780 "js-yaml": "^4.1.0",
27752781 "tslib": "^2.6.0"
@@ -3162,25 +3168,12 @@
31623168 "micromark-util-symbol": "^1.0.1"
31633169 }
31643170 },
3165− "node_modules/@slorber/static-site-generator-webpack-plugin": {
3166− "version": "4.0.7",
3167− "resolved": "https://registry.npmjs.org/@slorber/static-site-generator-webpack-plugin/-/static-site-generator-webpack-plugin-4.0.7.tgz",
3168− "integrity": "sha512-Ug7x6z5lwrz0WqdnNFOMYrDQNTPAprvHLSh6+/fmml3qUiz6l5eq+2MzLKWtn/q5K5NpSiFsZTP/fck/3vjSxA==",
3169− "dependencies": {
3170− "eval": "^0.1.8",
3171− "p-map": "^4.0.0",
3172− "webpack-sources": "^3.2.2"
3173− },
3174− "engines": {
3175− "node": ">=14"
3176− }
3177− },
31783171 "node_modules/@svgr/babel-plugin-add-jsx-attribute": {
3179− "version": "6.5.1",
3180− "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-add-jsx-attribute/-/babel-plugin-add-jsx-attribute-6.5.1.tgz",
3181− "integrity": "sha512-9PYGcXrAxitycIjRmZB+Q0JaN07GZIWaTBIGQzfaZv+qr1n8X1XUEJ5rZ/vx6OVD9RRYlrNnXWExQXcmZeD/BQ==",
3172+ "version": "8.0.0",
3173+ "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-add-jsx-attribute/-/babel-plugin-add-jsx-attribute-8.0.0.tgz",
3174+ "integrity": "sha512-b9MIk7yhdS1pMCZM8VeNfUlSKVRhsHZNMl5O9SfaX0l0t5wjdgu4IDzGB8bpnGBBOjGST3rRFVsaaEtI4W6f7g==",
31823175 "engines": {
3183− "node": ">=10"
3176+ "node": ">=14"
31843177 },
31853178 "funding": {
31863179 "type": "github",
@@ -3221,11 +3214,11 @@
32213214 }
32223215 },
32233216 "node_modules/@svgr/babel-plugin-replace-jsx-attribute-value": {
3224− "version": "6.5.1",
3225− "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-replace-jsx-attribute-value/-/babel-plugin-replace-jsx-attribute-value-6.5.1.tgz",
3226− "integrity": "sha512-8DPaVVE3fd5JKuIC29dqyMB54sA6mfgki2H2+swh+zNJoynC8pMPzOkidqHOSc6Wj032fhl8Z0TVn1GiPpAiJg==",
3217+ "version": "8.0.0",
3218+ "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-replace-jsx-attribute-value/-/babel-plugin-replace-jsx-attribute-value-8.0.0.tgz",
3219+ "integrity": "sha512-KVQ+PtIjb1BuYT3ht8M5KbzWBhdAjjUPdlMtpuw/VjT8coTrItWX6Qafl9+ji831JaJcu6PJNKCV0bp01lBNzQ==",
32273220 "engines": {
3228− "node": ">=10"
3221+ "node": ">=14"
32293222 },
32303223 "funding": {
32313224 "type": "github",
@@ -3236,11 +3229,11 @@
32363229 }
32373230 },
32383231 "node_modules/@svgr/babel-plugin-svg-dynamic-title": {
3239− "version": "6.5.1",
3240− "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-svg-dynamic-title/-/babel-plugin-svg-dynamic-title-6.5.1.tgz",
3241− "integrity": "sha512-FwOEi0Il72iAzlkaHrlemVurgSQRDFbk0OC8dSvD5fSBPHltNh7JtLsxmZUhjYBZo2PpcU/RJvvi6Q0l7O7ogw==",
3232+ "version": "8.0.0",
3233+ "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-svg-dynamic-title/-/babel-plugin-svg-dynamic-title-8.0.0.tgz",
3234+ "integrity": "sha512-omNiKqwjNmOQJ2v6ge4SErBbkooV2aAWwaPFs2vUY7p7GhVkzRkJ00kILXQvRhA6miHnNpXv7MRnnSjdRjK8og==",
32423235 "engines": {
3243− "node": ">=10"
3236+ "node": ">=14"
32443237 },
32453238 "funding": {
32463239 "type": "github",
@@ -3251,11 +3244,11 @@
32513244 }
32523245 },
32533246 "node_modules/@svgr/babel-plugin-svg-em-dimensions": {
3254− "version": "6.5.1",
3255− "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-svg-em-dimensions/-/babel-plugin-svg-em-dimensions-6.5.1.tgz",
3256− "integrity": "sha512-gWGsiwjb4tw+ITOJ86ndY/DZZ6cuXMNE/SjcDRg+HLuCmwpcjOktwRF9WgAiycTqJD/QXqL2f8IzE2Rzh7aVXA==",
3247+ "version": "8.0.0",
3248+ "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-svg-em-dimensions/-/babel-plugin-svg-em-dimensions-8.0.0.tgz",
3249+ "integrity": "sha512-mURHYnu6Iw3UBTbhGwE/vsngtCIbHE43xCRK7kCw4t01xyGqb2Pd+WXekRRoFOBIY29ZoOhUCTEweDMdrjfi9g==",
32573250 "engines": {
3258− "node": ">=10"
3251+ "node": ">=14"
32593252 },
32603253 "funding": {
32613254 "type": "github",
@@ -3266,11 +3259,11 @@
32663259 }
32673260 },
32683261 "node_modules/@svgr/babel-plugin-transform-react-native-svg": {
3269− "version": "6.5.1",
3270− "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-transform-react-native-svg/-/babel-plugin-transform-react-native-svg-6.5.1.tgz",
3271− "integrity": "sha512-2jT3nTayyYP7kI6aGutkyfJ7UMGtuguD72OjeGLwVNyfPRBD8zQthlvL+fAbAKk5n9ZNcvFkp/b1lZ7VsYqVJg==",
3262+ "version": "8.1.0",
3263+ "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-transform-react-native-svg/-/babel-plugin-transform-react-native-svg-8.1.0.tgz",
3264+ "integrity": "sha512-Tx8T58CHo+7nwJ+EhUwx3LfdNSG9R2OKfaIXXs5soiy5HtgoAEkDay9LIimLOcG8dJQH1wPZp/cnAv6S9CrR1Q==",
32723265 "engines": {
3273− "node": ">=10"
3266+ "node": ">=14"
32743267 },
32753268 "funding": {
32763269 "type": "github",
@@ -3281,9 +3274,9 @@
32813274 }
32823275 },
32833276 "node_modules/@svgr/babel-plugin-transform-svg-component": {
3284− "version": "6.5.1",
3285− "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-transform-svg-component/-/babel-plugin-transform-svg-component-6.5.1.tgz",
3286− "integrity": "sha512-a1p6LF5Jt33O3rZoVRBqdxL350oge54iZWHNI6LJB5tQ7EelvD/Mb1mfBiZNAan0dt4i3VArkFRjA4iObuNykQ==",
3277+ "version": "8.0.0",
3278+ "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-transform-svg-component/-/babel-plugin-transform-svg-component-8.0.0.tgz",
3279+ "integrity": "sha512-DFx8xa3cZXTdb/k3kfPeaixecQLgKh5NVBMwD0AQxOzcZawK4oo1Jh9LbrcACUivsCA7TLG8eeWgrDXjTMhRmw==",
32873280 "engines": {
32883281 "node": ">=12"
32893282 },
@@ -3296,21 +3289,21 @@
32963289 }
32973290 },
32983291 "node_modules/@svgr/babel-preset": {
3299− "version": "6.5.1",
3300− "resolved": "https://registry.npmjs.org/@svgr/babel-preset/-/babel-preset-6.5.1.tgz",
3301− "integrity": "sha512-6127fvO/FF2oi5EzSQOAjo1LE3OtNVh11R+/8FXa+mHx1ptAaS4cknIjnUA7e6j6fwGGJ17NzaTJFUwOV2zwCw==",
3292+ "version": "8.1.0",
3293+ "resolved": "https://registry.npmjs.org/@svgr/babel-preset/-/babel-preset-8.1.0.tgz",
3294+ "integrity": "sha512-7EYDbHE7MxHpv4sxvnVPngw5fuR6pw79SkcrILHJ/iMpuKySNCl5W1qcwPEpU+LgyRXOaAFgH0KhwD18wwg6ug==",
33023295 "dependencies": {
3303− "@svgr/babel-plugin-add-jsx-attribute": "^6.5.1",
3304− "@svgr/babel-plugin-remove-jsx-attribute": "*",
3305− "@svgr/babel-plugin-remove-jsx-empty-expression": "*",
3306− "@svgr/babel-plugin-replace-jsx-attribute-value": "^6.5.1",
3307− "@svgr/babel-plugin-svg-dynamic-title": "^6.5.1",
3308− "@svgr/babel-plugin-svg-em-dimensions": "^6.5.1",
3309− "@svgr/babel-plugin-transform-react-native-svg": "^6.5.1",
3310− "@svgr/babel-plugin-transform-svg-component": "^6.5.1"
3296+ "@svgr/babel-plugin-add-jsx-attribute": "8.0.0",
3297+ "@svgr/babel-plugin-remove-jsx-attribute": "8.0.0",
3298+ "@svgr/babel-plugin-remove-jsx-empty-expression": "8.0.0",
3299+ "@svgr/babel-plugin-replace-jsx-attribute-value": "8.0.0",
3300+ "@svgr/babel-plugin-svg-dynamic-title": "8.0.0",
3301+ "@svgr/babel-plugin-svg-em-dimensions": "8.0.0",
3302+ "@svgr/babel-plugin-transform-react-native-svg": "8.1.0",
3303+ "@svgr/babel-plugin-transform-svg-component": "8.0.0"
33113304 },
33123305 "engines": {
3313− "node": ">=10"
3306+ "node": ">=14"
33143307 },
33153308 "funding": {
33163309 "type": "github",
@@ -3321,18 +3314,18 @@
33213314 }
33223315 },
33233316 "node_modules/@svgr/core": {
3324− "version": "6.5.1",
3325− "resolved": "https://registry.npmjs.org/@svgr/core/-/core-6.5.1.tgz",
3326− "integrity": "sha512-/xdLSWxK5QkqG524ONSjvg3V/FkNyCv538OIBdQqPNaAta3AsXj/Bd2FbvR87yMbXO2hFSWiAe/Q6IkVPDw+mw==",
3317+ "version": "8.1.0",
3318+ "resolved": "https://registry.npmjs.org/@svgr/core/-/core-8.1.0.tgz",
3319+ "integrity": "sha512-8QqtOQT5ACVlmsvKOJNEaWmRPmcojMOzCz4Hs2BGG/toAp/K38LcsMRyLp349glq5AzJbCEeimEoxaX6v/fLrA==",
33273320 "dependencies": {
3328− "@babel/core": "^7.19.6",
3329− "@svgr/babel-preset": "^6.5.1",
3330− "@svgr/plugin-jsx": "^6.5.1",
3321+ "@babel/core": "^7.21.3",
3322+ "@svgr/babel-preset": "8.1.0",
33313323 "camelcase": "^6.2.0",
3332− "cosmiconfig": "^7.0.1"
3324+ "cosmiconfig": "^8.1.3",
3325+ "snake-case": "^3.0.4"
33333326 },
33343327 "engines": {
3335− "node": ">=10"
3328+ "node": ">=14"
33363329 },
33373330 "funding": {
33383331 "type": "github",
@@ -3340,15 +3333,15 @@
33403333 }
33413334 },
33423335 "node_modules/@svgr/hast-util-to-babel-ast": {
3343− "version": "6.5.1",
3344− "resolved": "https://registry.npmjs.org/@svgr/hast-util-to-babel-ast/-/hast-util-to-babel-ast-6.5.1.tgz",
3345− "integrity": "sha512-1hnUxxjd83EAxbL4a0JDJoD3Dao3hmjvyvyEV8PzWmLK3B9m9NPlW7GKjFyoWE8nM7HnXzPcmmSyOW8yOddSXw==",
3336+ "version": "8.0.0",
3337+ "resolved": "https://registry.npmjs.org/@svgr/hast-util-to-babel-ast/-/hast-util-to-babel-ast-8.0.0.tgz",
3338+ "integrity": "sha512-EbDKwO9GpfWP4jN9sGdYwPBU0kdomaPIL2Eu4YwmgP+sJeXT+L7bMwJUBnhzfH8Q2qMBqZ4fJwpCyYsAN3mt2Q==",
33463339 "dependencies": {
3347− "@babel/types": "^7.20.0",
3340+ "@babel/types": "^7.21.3",
33483341 "entities": "^4.4.0"
33493342 },
33503343 "engines": {
3351− "node": ">=10"
3344+ "node": ">=14"
33523345 },
33533346 "funding": {
33543347 "type": "github",
@@ -3356,37 +3349,37 @@
33563349 }
33573350 },
33583351 "node_modules/@svgr/plugin-jsx": {
3359− "version": "6.5.1",
3360− "resolved": "https://registry.npmjs.org/@svgr/plugin-jsx/-/plugin-jsx-6.5.1.tgz",
3361− "integrity": "sha512-+UdQxI3jgtSjCykNSlEMuy1jSRQlGC7pqBCPvkG/2dATdWo082zHTTK3uhnAju2/6XpE6B5mZ3z4Z8Ns01S8Gw==",
3352+ "version": "8.1.0",
3353+ "resolved": "https://registry.npmjs.org/@svgr/plugin-jsx/-/plugin-jsx-8.1.0.tgz",
3354+ "integrity": "sha512-0xiIyBsLlr8quN+WyuxooNW9RJ0Dpr8uOnH/xrCVO8GLUcwHISwj1AG0k+LFzteTkAA0GbX0kj9q6Dk70PTiPA==",
33623355 "dependencies": {
3363− "@babel/core": "^7.19.6",
3364− "@svgr/babel-preset": "^6.5.1",
3365− "@svgr/hast-util-to-babel-ast": "^6.5.1",
3356+ "@babel/core": "^7.21.3",
3357+ "@svgr/babel-preset": "8.1.0",
3358+ "@svgr/hast-util-to-babel-ast": "8.0.0",
33663359 "svg-parser": "^2.0.4"
33673360 },
33683361 "engines": {
3369− "node": ">=10"
3362+ "node": ">=14"
33703363 },
33713364 "funding": {
33723365 "type": "github",
33733366 "url": "https://github.com/sponsors/gregberge"
33743367 },
33753368 "peerDependencies": {
3376− "@svgr/core": "^6.0.0"
3369+ "@svgr/core": "*"
33773370 }
33783371 },
33793372 "node_modules/@svgr/plugin-svgo": {
3380− "version": "6.5.1",
3381− "resolved": "https://registry.npmjs.org/@svgr/plugin-svgo/-/plugin-svgo-6.5.1.tgz",
3382− "integrity": "sha512-omvZKf8ixP9z6GWgwbtmP9qQMPX4ODXi+wzbVZgomNFsUIlHA1sf4fThdwTWSsZGgvGAG6yE+b/F5gWUkcZ/iQ==",
3373+ "version": "8.1.0",
3374+ "resolved": "https://registry.npmjs.org/@svgr/plugin-svgo/-/plugin-svgo-8.1.0.tgz",
3375+ "integrity": "sha512-Ywtl837OGO9pTLIN/onoWLmDQ4zFUycI1g76vuKGEz6evR/ZTJlJuz3G/fIkb6OVBJ2g0o6CGJzaEjfmEo3AHA==",
33833376 "dependencies": {
3384− "cosmiconfig": "^7.0.1",
3385− "deepmerge": "^4.2.2",
3386− "svgo": "^2.8.0"
3377+ "cosmiconfig": "^8.1.3",
3378+ "deepmerge": "^4.3.1",
3379+ "svgo": "^3.0.2"
33873380 },
33883381 "engines": {
3389− "node": ">=10"
3382+ "node": ">=14"
33903383 },
33913384 "funding": {
33923385 "type": "github",
@@ -3397,21 +3390,21 @@
33973390 }
33983391 },
33993392 "node_modules/@svgr/webpack": {
3400− "version": "6.5.1",
3401− "resolved": "https://registry.npmjs.org/@svgr/webpack/-/webpack-6.5.1.tgz",
3402− "integrity": "sha512-cQ/AsnBkXPkEK8cLbv4Dm7JGXq2XrumKnL1dRpJD9rIO2fTIlJI9a1uCciYG1F2aUsox/hJQyNGbt3soDxSRkA==",
3393+ "version": "8.1.0",
3394+ "resolved": "https://registry.npmjs.org/@svgr/webpack/-/webpack-8.1.0.tgz",
3395+ "integrity": "sha512-LnhVjMWyMQV9ZmeEy26maJk+8HTIbd59cH4F2MJ439k9DqejRisfFNGAPvRYlKETuh9LrImlS8aKsBgKjMA8WA==",
34033396 "dependencies": {
3404− "@babel/core": "^7.19.6",
3405− "@babel/plugin-transform-react-constant-elements": "^7.18.12",
3406− "@babel/preset-env": "^7.19.4",
3397+ "@babel/core": "^7.21.3",
3398+ "@babel/plugin-transform-react-constant-elements": "^7.21.3",
3399+ "@babel/preset-env": "^7.20.2",
34073400 "@babel/preset-react": "^7.18.6",
3408− "@babel/preset-typescript": "^7.18.6",
3409− "@svgr/core": "^6.5.1",
3410− "@svgr/plugin-jsx": "^6.5.1",
3411− "@svgr/plugin-svgo": "^6.5.1"
3401+ "@babel/preset-typescript": "^7.21.0",
3402+ "@svgr/core": "8.1.0",
3403+ "@svgr/plugin-jsx": "8.1.0",
3404+ "@svgr/plugin-svgo": "8.1.0"
34123405 },
34133406 "engines": {
3414− "node": ">=10"
3407+ "node": ">=14"
34153408 },
34163409 "funding": {
34173410 "type": "github",
@@ -4082,30 +4075,31 @@
40824075 }
40834076 },
40844077 "node_modules/algoliasearch": {
4085− "version": "4.22.1",
4086− "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-4.22.1.tgz",
4087− "integrity": "sha512-jwydKFQJKIx9kIZ8Jm44SdpigFwRGPESaxZBaHSV0XWN2yBJAOT4mT7ppvlrpA4UGzz92pqFnVKr/kaZXrcreg==",
4088− "dependencies": {
4089− "@algolia/cache-browser-local-storage": "4.22.1",
4090− "@algolia/cache-common": "4.22.1",
4091− "@algolia/cache-in-memory": "4.22.1",
4092− "@algolia/client-account": "4.22.1",
4093− "@algolia/client-analytics": "4.22.1",
4094− "@algolia/client-common": "4.22.1",
4095− "@algolia/client-personalization": "4.22.1",
4096− "@algolia/client-search": "4.22.1",
4097− "@algolia/logger-common": "4.22.1",
4098− "@algolia/logger-console": "4.22.1",
4099− "@algolia/requester-browser-xhr": "4.22.1",
4100− "@algolia/requester-common": "4.22.1",
4101− "@algolia/requester-node-http": "4.22.1",
4102− "@algolia/transporter": "4.22.1"
4078+ "version": "4.23.3",
4079+ "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-4.23.3.tgz",
4080+ "integrity": "sha512-Le/3YgNvjW9zxIQMRhUHuhiUjAlKY/zsdZpfq4dlLqg6mEm0nL6yk+7f2hDOtLpxsgE4jSzDmvHL7nXdBp5feg==",
4081+ "dependencies": {
4082+ "@algolia/cache-browser-local-storage": "4.23.3",
4083+ "@algolia/cache-common": "4.23.3",
4084+ "@algolia/cache-in-memory": "4.23.3",
4085+ "@algolia/client-account": "4.23.3",
4086+ "@algolia/client-analytics": "4.23.3",
4087+ "@algolia/client-common": "4.23.3",
4088+ "@algolia/client-personalization": "4.23.3",
4089+ "@algolia/client-search": "4.23.3",
4090+ "@algolia/logger-common": "4.23.3",
4091+ "@algolia/logger-console": "4.23.3",
4092+ "@algolia/recommend": "4.23.3",
4093+ "@algolia/requester-browser-xhr": "4.23.3",
4094+ "@algolia/requester-common": "4.23.3",
4095+ "@algolia/requester-node-http": "4.23.3",
4096+ "@algolia/transporter": "4.23.3"
41034097 }
41044098 },
41054099 "node_modules/algoliasearch-helper": {
4106− "version": "3.16.1",
4107− "resolved": "https://registry.npmjs.org/algoliasearch-helper/-/algoliasearch-helper-3.16.1.tgz",
4108− "integrity": "sha512-qxAHVjjmT7USVvrM8q6gZGaJlCK1fl4APfdAA7o8O6iXEc68G0xMNrzRkxoB/HmhhvyHnoteS/iMTiHiTcQQcg==",
4100+ "version": "3.19.0",
4101+ "resolved": "https://registry.npmjs.org/algoliasearch-helper/-/algoliasearch-helper-3.19.0.tgz",
4102+ "integrity": "sha512-AaSb5DZDMZmDQyIy6lf4aL0OZGgyIdqvLIIvSuVQOIOqfhrYSY7TvotIFI2x0Q3cP3xUpTd7lI1astUC4aXBJw==",
41094103 "dependencies": {
41104104 "@algolia/events": "^4.0.1"
41114105 },
@@ -4224,9 +4218,9 @@
42244218 }
42254219 },
42264220 "node_modules/autoprefixer": {
4227− "version": "10.4.16",
4228− "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.16.tgz",
4229− "integrity": "sha512-7vd3UC6xKp0HLfua5IjZlcXvGAGy7cBAXTg2lyQ/8WpNhd6SiZ8Be+xm3FyBSYJx5GKcpRCzBh7RH4/0dnY+uQ==",
4221+ "version": "10.4.19",
4222+ "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.19.tgz",
4223+ "integrity": "sha512-BaENR2+zBZ8xXhM4pUaKUxlVdxZ0EZhjvbopwnXmxRUfqDmwSpC2lAi/QXvx7NRdPCo1WKEcEF6mV64si1z4Ew==",
42304224 "funding": [
42314225 {
42324226 "type": "opencollective",
@@ -4242,9 +4236,9 @@
42424236 }
42434237 ],
42444238 "dependencies": {
4245− "browserslist": "^4.21.10",
4246− "caniuse-lite": "^1.0.30001538",
4247− "fraction.js": "^4.3.6",
4239+ "browserslist": "^4.23.0",
4240+ "caniuse-lite": "^1.0.30001599",
4241+ "fraction.js": "^4.3.7",
42484242 "normalize-range": "^0.1.2",
42494243 "picocolors": "^1.0.0",
42504244 "postcss-value-parser": "^4.2.0"
@@ -4363,12 +4357,12 @@
43634357 }
43644358 },
43654359 "node_modules/body-parser": {
4366− "version": "1.20.1",
4367− "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.1.tgz",
4368− "integrity": "sha512-jWi7abTbYwajOytWCQc37VulmWiRae5RyTpaCyDcS5/lMdtwSz5lOpDE67srw/HYe35f1z3fDQw+3txg7gNtWw==",
4360+ "version": "1.20.2",
4361+ "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",
4362+ "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6R7ajOPw0g/J1PvK4qNy7s5bA==",
43694363 "dependencies": {
43704364 "bytes": "3.1.2",
4371− "content-type": "~1.0.4",
4365+ "content-type": "~1.0.5",
43724366 "debug": "2.6.9",
43734367 "depd": "2.0.0",
43744368 "destroy": "1.2.0",
@@ -4376,7 +4370,7 @@
43764370 "iconv-lite": "0.4.24",
43774371 "on-finished": "2.4.1",
43784372 "qs": "6.11.0",
4379− "raw-body": "2.5.1",
4373+ "raw-body": "2.5.2",
43804374 "type-is": "~1.6.18",
43814375 "unpipe": "1.0.0"
43824376 },
@@ -4462,9 +4456,9 @@
44624456 }
44634457 },
44644458 "node_modules/browserslist": {
4465− "version": "4.22.2",
4466− "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.22.2.tgz",
4467− "integrity": "sha512-0UgcrvQmBDvZHFGdYUehrCNIazki7/lUP3kkoi/r3YB2amZbFM9J43ZRkJTXBUZK4gmx56+Sqk9+Vs9mwZx9+A==",
4459+ "version": "4.23.0",
4460+ "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.23.0.tgz",
4461+ "integrity": "sha512-QW8HiM1shhT2GuzkvklfjcKDiWFXHOeFCIA/huJPwHsslwcydgk7X+z2zXpEijP98UCY7HbubZt5J2Zgvf0CaQ==",
44684462 "funding": [
44694463 {
44704464 "type": "opencollective",
@@ -4480,8 +4474,8 @@
44804474 }
44814475 ],
44824476 "dependencies": {
4483− "caniuse-lite": "^1.0.30001565",
4484− "electron-to-chromium": "^1.4.601",
4477+ "caniuse-lite": "^1.0.30001587",
4478+ "electron-to-chromium": "^1.4.668",
44854479 "node-releases": "^2.0.14",
44864480 "update-browserslist-db": "^1.0.13"
44874481 },
@@ -4542,13 +4536,18 @@
45424536 }
45434537 },
45444538 "node_modules/call-bind": {
4545− "version": "1.0.5",
4546− "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.5.tgz",
4547− "integrity": "sha512-C3nQxfFZxFRVoJoGKKI8y3MOEo129NQ+FgQ08iye+Mk4zNZZGdjfs06bVTr+DBSlA66Q2VEcMki/cUCP4SercQ==",
4539+ "version": "1.0.7",
4540+ "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.7.tgz",
4541+ "integrity": "sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w==",
45484542 "dependencies": {
4543+ "es-define-property": "^1.0.0",
4544+ "es-errors": "^1.3.0",
45494545 "function-bind": "^1.1.2",
4550− "get-intrinsic": "^1.2.1",
4551− "set-function-length": "^1.1.1"
4546+ "get-intrinsic": "^1.2.4",
4547+ "set-function-length": "^1.2.1"
4548+ },
4549+ "engines": {
4550+ "node": ">= 0.4"
45524551 },
45534552 "funding": {
45544553 "url": "https://github.com/sponsors/ljharb"
@@ -4594,9 +4593,9 @@
45944593 }
45954594 },
45964595 "node_modules/caniuse-lite": {
4597− "version": "1.0.30001576",
4598− "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001576.tgz",
4599− "integrity": "sha512-ff5BdakGe2P3SQsMsiqmt1Lc8221NR1VzHj5jXN5vBny9A6fpze94HiVV/n7XRosOlsShJcvMv5mdnpjOGCEgg==",
4596+ "version": "1.0.30001617",
4597+ "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001617.tgz",
4598+ "integrity": "sha512-mLyjzNI9I+Pix8zwcrpxEbGlfqOkF9kM3ptzmKNw5tizSyYwMe+nGLTqMK9cO+0E+Bh6TsBxNAaHWEM8xwSsmA==",
46004599 "funding": [
46014600 {
46024601 "type": "opencollective",
@@ -5052,9 +5051,9 @@
50525051 "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="
50535052 },
50545053 "node_modules/cookie": {
5055− "version": "0.5.0",
5056− "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
5057− "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
5054+ "version": "0.6.0",
5055+ "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
5056+ "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
50585057 "engines": {
50595058 "node": ">= 0.6"
50605059 }
@@ -5184,18 +5183,28 @@
51845183 }
51855184 },
51865185 "node_modules/cosmiconfig": {
5187− "version": "7.1.0",
5188− "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz",
5189− "integrity": "sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==",
5186+ "version": "8.3.6",
5187+ "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-8.3.6.tgz",
5188+ "integrity": "sha512-kcZ6+W5QzcJ3P1Mt+83OUv/oHFqZHIx8DuxG6eZ5RGMERoLqp4BuGjhHLYGK+Kf5XVkQvqBSmAy/nGWN3qDgEA==",
51905189 "dependencies": {
5191− "@types/parse-json": "^4.0.0",
5192− "import-fresh": "^3.2.1",
5193− "parse-json": "^5.0.0",
5194− "path-type": "^4.0.0",
5195− "yaml": "^1.10.0"
5190+ "import-fresh": "^3.3.0",
5191+ "js-yaml": "^4.1.0",
5192+ "parse-json": "^5.2.0",
5193+ "path-type": "^4.0.0"
51965194 },
51975195 "engines": {
5198− "node": ">=10"
5196+ "node": ">=14"
5197+ },
5198+ "funding": {
5199+ "url": "https://github.com/sponsors/d-fischer"
5200+ },
5201+ "peerDependencies": {
5202+ "typescript": ">=4.9.5"
5203+ },
5204+ "peerDependenciesMeta": {
5205+ "typescript": {
5206+ "optional": true
5207+ }
51995208 }
52005209 },
52015210 "node_modules/cross-spawn": {
@@ -5237,11 +5246,11 @@
52375246 }
52385247 },
52395248 "node_modules/css-declaration-sorter": {
5240− "version": "6.4.1",
5241− "resolved": "https://registry.npmjs.org/css-declaration-sorter/-/css-declaration-sorter-6.4.1.tgz",
5242− "integrity": "sha512-rtdthzxKuyq6IzqX6jEcIzQF/YqccluefyCYheovBOLhFT/drQA9zj/UbRAa9J7C0o6EG6u3E6g+vKkay7/k3g==",
5249+ "version": "7.2.0",
5250+ "resolved": "https://registry.npmjs.org/css-declaration-sorter/-/css-declaration-sorter-7.2.0.tgz",
5251+ "integrity": "sha512-h70rUM+3PNFuaBDTLe8wF/cdWu+dOZmb7pJt8Z2sedYbAcQVQV/tEchueg3GWxwqS0cxtbxmaHEdkNACqcvsow==",
52435252 "engines": {
5244− "node": "^10 || ^12 || >=14"
5253+ "node": "^14 || ^16 || >=18"
52455254 },
52465255 "peerDependencies": {
52475256 "postcss": "^8.0.9"
@@ -5273,16 +5282,16 @@
52735282 }
52745283 },
52755284 "node_modules/css-minimizer-webpack-plugin": {
5276− "version": "4.2.2",
5277− "resolved": "https://registry.npmjs.org/css-minimizer-webpack-plugin/-/css-minimizer-webpack-plugin-4.2.2.tgz",
5278− "integrity": "sha512-s3Of/4jKfw1Hj9CxEO1E5oXhQAxlayuHO2y/ML+C6I9sQ7FdzfEV6QgMLN3vI+qFsjJGIAFLKtQK7t8BOXAIyA==",
5285+ "version": "5.0.1",
5286+ "resolved": "https://registry.npmjs.org/css-minimizer-webpack-plugin/-/css-minimizer-webpack-plugin-5.0.1.tgz",
5287+ "integrity": "sha512-3caImjKFQkS+ws1TGcFn0V1HyDJFq1Euy589JlD6/3rV2kj+w7r5G9WDMgSHvpvXHNZ2calVypZWuEDQd9wfLg==",
52795288 "dependencies": {
5280− "cssnano": "^5.1.8",
5281− "jest-worker": "^29.1.2",
5282− "postcss": "^8.4.17",
5283− "schema-utils": "^4.0.0",
5284− "serialize-javascript": "^6.0.0",
5285− "source-map": "^0.6.1"
5289+ "@jridgewell/trace-mapping": "^0.3.18",
5290+ "cssnano": "^6.0.1",
5291+ "jest-worker": "^29.4.3",
5292+ "postcss": "^8.4.24",
5293+ "schema-utils": "^4.0.1",
5294+ "serialize-javascript": "^6.0.1"
52865295 },
52875296 "engines": {
52885297 "node": ">= 14.15.0"
@@ -5315,14 +5324,6 @@
53155324 }
53165325 }
53175326 },
5318− "node_modules/css-minimizer-webpack-plugin/node_modules/source-map": {
5319− "version": "0.6.1",
5320− "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
5321− "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
5322− "engines": {
5323− "node": ">=0.10.0"
5324− }
5325− },
53265327 "node_modules/css-select": {
53275328 "version": "5.1.0",
53285329 "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.1.0.tgz",
@@ -5339,23 +5340,15 @@
53395340 }
53405341 },
53415342 "node_modules/css-tree": {
5342− "version": "1.1.3",
5343− "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-1.1.3.tgz",
5344− "integrity": "sha512-tRpdppF7TRazZrjJ6v3stzv93qxRcSsFmW6cX0Zm2NVKpxE1WV1HblnghVv9TreireHkqI/VDEsfolRF1p6y7Q==",
5343+ "version": "2.3.1",
5344+ "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-2.3.1.tgz",
5345+ "integrity": "sha512-6Fv1DV/TYw//QF5IzQdqsNDjx/wc8TrMBZsqjL9eW01tWb7R7k/mq+/VXfJCl7SoD5emsJop9cOByJZfs8hYIw==",
53455346 "dependencies": {
5346− "mdn-data": "2.0.14",
5347− "source-map": "^0.6.1"
5347+ "mdn-data": "2.0.30",
5348+ "source-map-js": "^1.0.1"
53485349 },
53495350 "engines": {
5350− "node": ">=8.0.0"
5351− }
5352− },
5353− "node_modules/css-tree/node_modules/source-map": {
5354− "version": "0.6.1",
5355− "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
5356− "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
5357− "engines": {
5358− "node": ">=0.10.0"
5351+ "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
53595352 }
53605353 },
53615354 "node_modules/css-what": {
@@ -5381,108 +5374,128 @@
53815374 }
53825375 },
53835376 "node_modules/cssnano": {
5384− "version": "5.1.15",
5385− "resolved": "https://registry.npmjs.org/cssnano/-/cssnano-5.1.15.tgz",
5386− "integrity": "sha512-j+BKgDcLDQA+eDifLx0EO4XSA56b7uut3BQFH+wbSaSTuGLuiyTa/wbRYthUXX8LC9mLg+WWKe8h+qJuwTAbHw==",
5377+ "version": "6.1.2",
5378+ "resolved": "https://registry.npmjs.org/cssnano/-/cssnano-6.1.2.tgz",
5379+ "integrity": "sha512-rYk5UeX7VAM/u0lNqewCdasdtPK81CgX8wJFLEIXHbV2oldWRgJAsZrdhRXkV1NJzA2g850KiFm9mMU2HxNxMA==",
53875380 "dependencies": {
5388− "cssnano-preset-default": "^5.2.14",
5389− "lilconfig": "^2.0.3",
5390− "yaml": "^1.10.2"
5381+ "cssnano-preset-default": "^6.1.2",
5382+ "lilconfig": "^3.1.1"
53915383 },
53925384 "engines": {
5393− "node": "^10 || ^12 || >=14.0"
5385+ "node": "^14 || ^16 || >=18.0"
53945386 },
53955387 "funding": {
53965388 "type": "opencollective",
53975389 "url": "https://opencollective.com/cssnano"
53985390 },
53995391 "peerDependencies": {
5400− "postcss": "^8.2.15"
5392+ "postcss": "^8.4.31"
54015393 }
54025394 },
54035395 "node_modules/cssnano-preset-advanced": {
5404− "version": "5.3.10",
5405− "resolved": "https://registry.npmjs.org/cssnano-preset-advanced/-/cssnano-preset-advanced-5.3.10.tgz",
5406− "integrity": "sha512-fnYJyCS9jgMU+cmHO1rPSPf9axbQyD7iUhLO5Df6O4G+fKIOMps+ZbU0PdGFejFBBZ3Pftf18fn1eG7MAPUSWQ==",
5396+ "version": "6.1.2",
5397+ "resolved": "https://registry.npmjs.org/cssnano-preset-advanced/-/cssnano-preset-advanced-6.1.2.tgz",
5398+ "integrity": "sha512-Nhao7eD8ph2DoHolEzQs5CfRpiEP0xa1HBdnFZ82kvqdmbwVBUr2r1QuQ4t1pi+D1ZpqpcO4T+wy/7RxzJ/WPQ==",
54075399 "dependencies": {
5408− "autoprefixer": "^10.4.12",
5409− "cssnano-preset-default": "^5.2.14",
5410− "postcss-discard-unused": "^5.1.0",
5411− "postcss-merge-idents": "^5.1.1",
5412− "postcss-reduce-idents": "^5.2.0",
5413− "postcss-zindex": "^5.1.0"
5400+ "autoprefixer": "^10.4.19",
5401+ "browserslist": "^4.23.0",
5402+ "cssnano-preset-default": "^6.1.2",
5403+ "postcss-discard-unused": "^6.0.5",
5404+ "postcss-merge-idents": "^6.0.3",
5405+ "postcss-reduce-idents": "^6.0.3",
5406+ "postcss-zindex": "^6.0.2"
54145407 },
54155408 "engines": {
5416− "node": "^10 || ^12 || >=14.0"
5409+ "node": "^14 || ^16 || >=18.0"
54175410 },
54185411 "peerDependencies": {
5419− "postcss": "^8.2.15"
5412+ "postcss": "^8.4.31"
54205413 }
54215414 },
54225415 "node_modules/cssnano-preset-default": {
5423− "version": "5.2.14",
5424− "resolved": "https://registry.npmjs.org/cssnano-preset-default/-/cssnano-preset-default-5.2.14.tgz",
5425− "integrity": "sha512-t0SFesj/ZV2OTylqQVOrFgEh5uanxbO6ZAdeCrNsUQ6fVuXwYTxJPNAGvGTxHbD68ldIJNec7PyYZDBrfDQ+6A==",
5426− "dependencies": {
5427− "css-declaration-sorter": "^6.3.1",
5428− "cssnano-utils": "^3.1.0",
5429− "postcss-calc": "^8.2.3",
5430− "postcss-colormin": "^5.3.1",
5431− "postcss-convert-values": "^5.1.3",
5432− "postcss-discard-comments": "^5.1.2",
5433− "postcss-discard-duplicates": "^5.1.0",
5434− "postcss-discard-empty": "^5.1.1",
5435− "postcss-discard-overridden": "^5.1.0",
5436− "postcss-merge-longhand": "^5.1.7",
5437− "postcss-merge-rules": "^5.1.4",
5438− "postcss-minify-font-values": "^5.1.0",
5439− "postcss-minify-gradients": "^5.1.1",
5440− "postcss-minify-params": "^5.1.4",
5441− "postcss-minify-selectors": "^5.2.1",
5442− "postcss-normalize-charset": "^5.1.0",
5443− "postcss-normalize-display-values": "^5.1.0",
5444− "postcss-normalize-positions": "^5.1.1",
5445− "postcss-normalize-repeat-style": "^5.1.1",
5446− "postcss-normalize-string": "^5.1.0",
5447− "postcss-normalize-timing-functions": "^5.1.0",
5448− "postcss-normalize-unicode": "^5.1.1",
5449− "postcss-normalize-url": "^5.1.0",
5450− "postcss-normalize-whitespace": "^5.1.1",
5451− "postcss-ordered-values": "^5.1.3",
5452− "postcss-reduce-initial": "^5.1.2",
5453− "postcss-reduce-transforms": "^5.1.0",
5454− "postcss-svgo": "^5.1.0",
5455− "postcss-unique-selectors": "^5.1.1"
5456− },
5457− "engines": {
5458− "node": "^10 || ^12 || >=14.0"
5459− },
5460− "peerDependencies": {
5461− "postcss": "^8.2.15"
5416+ "version": "6.1.2",
5417+ "resolved": "https://registry.npmjs.org/cssnano-preset-default/-/cssnano-preset-default-6.1.2.tgz",
5418+ "integrity": "sha512-1C0C+eNaeN8OcHQa193aRgYexyJtU8XwbdieEjClw+J9d94E41LwT6ivKH0WT+fYwYWB0Zp3I3IZ7tI/BbUbrg==",
5419+ "dependencies": {
5420+ "browserslist": "^4.23.0",
5421+ "css-declaration-sorter": "^7.2.0",
5422+ "cssnano-utils": "^4.0.2",
5423+ "postcss-calc": "^9.0.1",
5424+ "postcss-colormin": "^6.1.0",
5425+ "postcss-convert-values": "^6.1.0",
5426+ "postcss-discard-comments": "^6.0.2",
5427+ "postcss-discard-duplicates": "^6.0.3",
5428+ "postcss-discard-empty": "^6.0.3",
5429+ "postcss-discard-overridden": "^6.0.2",
5430+ "postcss-merge-longhand": "^6.0.5",
5431+ "postcss-merge-rules": "^6.1.1",
5432+ "postcss-minify-font-values": "^6.1.0",
5433+ "postcss-minify-gradients": "^6.0.3",
5434+ "postcss-minify-params": "^6.1.0",
5435+ "postcss-minify-selectors": "^6.0.4",
5436+ "postcss-normalize-charset": "^6.0.2",
5437+ "postcss-normalize-display-values": "^6.0.2",
5438+ "postcss-normalize-positions": "^6.0.2",
5439+ "postcss-normalize-repeat-style": "^6.0.2",
5440+ "postcss-normalize-string": "^6.0.2",
5441+ "postcss-normalize-timing-functions": "^6.0.2",
5442+ "postcss-normalize-unicode": "^6.1.0",
5443+ "postcss-normalize-url": "^6.0.2",
5444+ "postcss-normalize-whitespace": "^6.0.2",
5445+ "postcss-ordered-values": "^6.0.2",
5446+ "postcss-reduce-initial": "^6.1.0",
5447+ "postcss-reduce-transforms": "^6.0.2",
5448+ "postcss-svgo": "^6.0.3",
5449+ "postcss-unique-selectors": "^6.0.4"
5450+ },
5451+ "engines": {
5452+ "node": "^14 || ^16 || >=18.0"
5453+ },
5454+ "peerDependencies": {
5455+ "postcss": "^8.4.31"
54625456 }
54635457 },
54645458 "node_modules/cssnano-utils": {
5465− "version": "3.1.0",
5466− "resolved": "https://registry.npmjs.org/cssnano-utils/-/cssnano-utils-3.1.0.tgz",
5467− "integrity": "sha512-JQNR19/YZhz4psLX/rQ9M83e3z2Wf/HdJbryzte4a3NSuafyp9w/I4U+hx5C2S9g41qlstH7DEWnZaaj83OuEA==",
5459+ "version": "4.0.2",
5460+ "resolved": "https://registry.npmjs.org/cssnano-utils/-/cssnano-utils-4.0.2.tgz",
5461+ "integrity": "sha512-ZR1jHg+wZ8o4c3zqf1SIUSTIvm/9mU343FMR6Obe/unskbvpGhZOo1J6d/r8D1pzkRQYuwbcH3hToOuoA2G7oQ==",
54685462 "engines": {
5469− "node": "^10 || ^12 || >=14.0"
5463+ "node": "^14 || ^16 || >=18.0"
54705464 },
54715465 "peerDependencies": {
5472− "postcss": "^8.2.15"
5466+ "postcss": "^8.4.31"
54735467 }
54745468 },
54755469 "node_modules/csso": {
5476− "version": "4.2.0",
5477− "resolved": "https://registry.npmjs.org/csso/-/csso-4.2.0.tgz",
5478− "integrity": "sha512-wvlcdIbf6pwKEk7vHj8/Bkc0B4ylXZruLvOgs9doS5eOsOpuodOV2zJChSpkp+pRpYQLQMeF04nr3Z68Sta9jA==",
5470+ "version": "5.0.5",
5471+ "resolved": "https://registry.npmjs.org/csso/-/csso-5.0.5.tgz",
5472+ "integrity": "sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ==",
54795473 "dependencies": {
5480− "css-tree": "^1.1.2"
5474+ "css-tree": "~2.2.0"
54815475 },
54825476 "engines": {
5483− "node": ">=8.0.0"
5477+ "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0",
5478+ "npm": ">=7.0.0"
5479+ }
5480+ },
5481+ "node_modules/csso/node_modules/css-tree": {
5482+ "version": "2.2.1",
5483+ "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-2.2.1.tgz",
5484+ "integrity": "sha512-OA0mILzGc1kCOCSJerOeqDxDQ4HOh+G8NbOJFOTgOCzpw7fCBubk0fEyxp8AgOL/jvLgYA/uV0cMbe43ElF1JA==",
5485+ "dependencies": {
5486+ "mdn-data": "2.0.28",
5487+ "source-map-js": "^1.0.1"
5488+ },
5489+ "engines": {
5490+ "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0",
5491+ "npm": ">=7.0.0"
54845492 }
54855493 },
5494+ "node_modules/csso/node_modules/mdn-data": {
5495+ "version": "2.0.28",
5496+ "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.28.tgz",
5497+ "integrity": "sha512-aylIc7Z9y4yzHYAJNuESG3hfhC+0Ibp/MAMiaOZgNv4pmEdFyfZhhhny4MNiAfWdBQ1RQ2mfDWmM1x8SvGyp8g=="
5498+ },
54865499 "node_modules/csstype": {
54875500 "version": "3.1.3",
54885501 "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.3.tgz",
@@ -6067,16 +6080,19 @@
60676080 }
60686081 },
60696082 "node_modules/define-data-property": {
6070− "version": "1.1.1",
6071− "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.1.tgz",
6072− "integrity": "sha512-E7uGkTzkk1d0ByLeSc6ZsFS79Axg+m1P/VsgYsxHgiuc3tFSj+MjMIwe90FC4lOAZzNBdY7kkO2P2wKdsQ1vgQ==",
6083+ "version": "1.1.4",
6084+ "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
6085+ "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
60736086 "dependencies": {
6074− "get-intrinsic": "^1.2.1",
6075− "gopd": "^1.0.1",
6076− "has-property-descriptors": "^1.0.0"
6087+ "es-define-property": "^1.0.0",
6088+ "es-errors": "^1.3.0",
6089+ "gopd": "^1.0.1"
60776090 },
60786091 "engines": {
60796092 "node": ">= 0.4"
6093+ },
6094+ "funding": {
6095+ "url": "https://github.com/sponsors/ljharb"
60806096 }
60816097 },
60826098 "node_modules/define-lazy-prop": {
@@ -6357,9 +6373,9 @@
63576373 "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="
63586374 },
63596375 "node_modules/electron-to-chromium": {
6360− "version": "1.4.630",
6361− "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.630.tgz",
6362− "integrity": "sha512-osHqhtjojpCsACVnuD11xO5g9xaCyw7Qqn/C2KParkMv42i8jrJJgx3g7mkHfpxwhy9MnOJr8+pKOdZ7qzgizg=="
6376+ "version": "1.4.761",
6377+ "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.761.tgz",
6378+ "integrity": "sha512-PIbxpiJGx6Bb8dQaonNc6CGTRlVntdLg/2nMa1YhnrwYOORY9a3ZgGN0UQYE6lAcj/lkyduJN7BPt/JiY+jAQQ=="
63636379 },
63646380 "node_modules/elkjs": {
63656381 "version": "0.8.2",
@@ -6432,6 +6448,25 @@
64326448 "is-arrayish": "^0.2.1"
64336449 }
64346450 },
6451+ "node_modules/es-define-property": {
6452+ "version": "1.0.0",
6453+ "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.0.tgz",
6454+ "integrity": "sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ==",
6455+ "dependencies": {
6456+ "get-intrinsic": "^1.2.4"
6457+ },
6458+ "engines": {
6459+ "node": ">= 0.4"
6460+ }
6461+ },
6462+ "node_modules/es-errors": {
6463+ "version": "1.3.0",
6464+ "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
6465+ "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
6466+ "engines": {
6467+ "node": ">= 0.4"
6468+ }
6469+ },
64356470 "node_modules/es-module-lexer": {
64366471 "version": "1.4.1",
64376472 "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.4.1.tgz",
@@ -6684,16 +6719,16 @@
66846719 }
66856720 },
66866721 "node_modules/express": {
6687− "version": "4.18.2",
6688− "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
6689− "integrity": "sha512-5/PsL6iGPdfQ/lKM1UuielYgv3BUoJfz1aUwU9vHZ+J7gyvwdQXFEBIEIaxeGf0GIcreATNyBExtalisDbuMqQ==",
6722+ "version": "4.19.2",
6723+ "resolved": "https://registry.npmjs.org/express/-/express-4.19.2.tgz",
6724+ "integrity": "sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==",
66906725 "dependencies": {
66916726 "accepts": "~1.3.8",
66926727 "array-flatten": "1.1.1",
6693− "body-parser": "1.20.1",
6728+ "body-parser": "1.20.2",
66946729 "content-disposition": "0.5.4",
66956730 "content-type": "~1.0.4",
6696− "cookie": "0.5.0",
6731+ "cookie": "0.6.0",
66976732 "cookie-signature": "1.0.6",
66986733 "debug": "2.6.9",
66996734 "depd": "2.0.0",
@@ -7004,9 +7039,9 @@
70047039 }
70057040 },
70067041 "node_modules/follow-redirects": {
7007− "version": "1.15.5",
7008− "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.5.tgz",
7009− "integrity": "sha512-vSFWUON1B+yAw1VN4xMfxgn5fTUiaOzAJCKBwIIgT/+7CuGy9+r+5gITvP62j3RmaD5Ph65UaERdOSRGUzZtgw==",
7042+ "version": "1.15.6",
7043+ "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
7044+ "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
70107045 "funding": [
70117046 {
70127047 "type": "individual",
@@ -7237,15 +7272,19 @@
72377272 }
72387273 },
72397274 "node_modules/get-intrinsic": {
7240− "version": "1.2.2",
7241− "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.2.tgz",
7242− "integrity": "sha512-0gSo4ml/0j98Y3lngkFEot/zhiCeWsbYIlZ+uZOVgzLyLaUw7wxUL+nCTP0XJvJg1AXulJRI3UJi8GsbDuxdGA==",
7275+ "version": "1.2.4",
7276+ "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.4.tgz",
7277+ "integrity": "sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ==",
72437278 "dependencies": {
7279+ "es-errors": "^1.3.0",
72447280 "function-bind": "^1.1.2",
72457281 "has-proto": "^1.0.1",
72467282 "has-symbols": "^1.0.3",
72477283 "hasown": "^2.0.0"
72487284 },
7285+ "engines": {
7286+ "node": ">= 0.4"
7287+ },
72497288 "funding": {
72507289 "url": "https://github.com/sponsors/ljharb"
72517290 }
@@ -7503,11 +7542,11 @@
75037542 }
75047543 },
75057544 "node_modules/has-property-descriptors": {
7506− "version": "1.0.1",
7507− "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.1.tgz",
7508− "integrity": "sha512-VsX8eaIewvas0xnvinAe9bw4WfIeODpGYikiWYLH+dma0Jw6KHYqWiWfhQlgOVK8D6PvjubK5Uc4P0iIhIcNVg==",
7545+ "version": "1.0.2",
7546+ "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
7547+ "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
75097548 "dependencies": {
7510− "get-intrinsic": "^1.2.2"
7549+ "es-define-property": "^1.0.0"
75117550 },
75127551 "funding": {
75137552 "url": "https://github.com/sponsors/ljharb"
@@ -8687,11 +8726,14 @@
86878726 }
86888727 },
86898728 "node_modules/lilconfig": {
8690− "version": "2.1.0",
8691− "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
8692− "integrity": "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==",
8729+ "version": "3.1.1",
8730+ "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.1.tgz",
8731+ "integrity": "sha512-O18pf7nyvHTckunPWCV1XUNXU1piu01y2b7ATJ0ppkUkk8ocqVWBrYjJBCwHDjD/ZWcfyrA0P4gKhzWGi5EINQ==",
86938732 "engines": {
8694− "node": ">=10"
8733+ "node": ">=14"
8734+ },
8735+ "funding": {
8736+ "url": "https://github.com/sponsors/antonk52"
86958737 }
86968738 },
86978739 "node_modules/lines-and-columns": {
@@ -9220,9 +9262,9 @@
92209262 }
92219263 },
92229264 "node_modules/mdn-data": {
9223− "version": "2.0.14",
9224− "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.14.tgz",
9225− "integrity": "sha512-dn6wd0uw5GsdswPFfsgMp5NSB0/aDe6fK94YJV/AJDYXL6HVLWBsxeq7js7Ad+mU2K9LAlwpk6kN2D5mwCPVow=="
9265+ "version": "2.0.30",
9266+ "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.30.tgz",
9267+ "integrity": "sha512-GaqWWShW4kv/G9IEucWScBx9G1/vsFZZJUO+tD26M8J8z3Kw5RDQjaoZe03YAClgeS/SWPOcb4nkFBTEi5DUEA=="
92269268 },
92279269 "node_modules/media-typer": {
92289270 "version": "0.3.0",
@@ -11619,17 +11661,6 @@
1161911661 "node": ">=0.10.0"
1162011662 }
1162111663 },
11622− "node_modules/normalize-url": {
11623− "version": "6.1.0",
11624− "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-6.1.0.tgz",
11625− "integrity": "sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==",
11626− "engines": {
11627− "node": ">=10"
11628− },
11629− "funding": {
11630− "url": "https://github.com/sponsors/sindresorhus"
11631− }
11632− },
1163311664 "node_modules/npm-run-path": {
1163411665 "version": "4.0.1",
1163511666 "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
@@ -12119,9 +12150,9 @@
1211912150 }
1212012151 },
1212112152 "node_modules/postcss": {
12122− "version": "8.4.33",
12123− "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.33.tgz",
12124− "integrity": "sha512-Kkpbhhdjw2qQs2O2DGX+8m5OVqEcbB9HRBvuYM9pgrjEFUg30A9LmXNlTAUj4S9kgtGyrMbTzVjH7E+s5Re2yg==",
12153+ "version": "8.4.38",
12154+ "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.38.tgz",
12155+ "integrity": "sha512-Wglpdk03BSfXkHoQa3b/oulrotAkwrlLDRSOb9D0bN86FdRyE9lppSp33aHNPgBa0JKCoB+drFLZkQoRRYae5A==",
1212512156 "funding": [
1212612157 {
1212712158 "type": "opencollective",
@@ -12139,112 +12170,115 @@
1213912170 "dependencies": {
1214012171 "nanoid": "^3.3.7",
1214112172 "picocolors": "^1.0.0",
12142− "source-map-js": "^1.0.2"
12173+ "source-map-js": "^1.2.0"
1214312174 },
1214412175 "engines": {
1214512176 "node": "^10 || ^12 || >=14"
1214612177 }
1214712178 },
1214812179 "node_modules/postcss-calc": {
12149− "version": "8.2.4",
12150− "resolved": "https://registry.npmjs.org/postcss-calc/-/postcss-calc-8.2.4.tgz",
12151− "integrity": "sha512-SmWMSJmB8MRnnULldx0lQIyhSNvuDl9HfrZkaqqE/WHAhToYsAvDq+yAsA/kIyINDszOp3Rh0GFoNuH5Ypsm3Q==",
12180+ "version": "9.0.1",
12181+ "resolved": "https://registry.npmjs.org/postcss-calc/-/postcss-calc-9.0.1.tgz",
12182+ "integrity": "sha512-TipgjGyzP5QzEhsOZUaIkeO5mKeMFpebWzRogWG/ysonUlnHcq5aJe0jOjpfzUU8PeSaBQnrE8ehR0QA5vs8PQ==",
1215212183 "dependencies": {
12153− "postcss-selector-parser": "^6.0.9",
12184+ "postcss-selector-parser": "^6.0.11",
1215412185 "postcss-value-parser": "^4.2.0"
1215512186 },
12187+ "engines": {
12188+ "node": "^14 || ^16 || >=18.0"
12189+ },
1215612190 "peerDependencies": {
1215712191 "postcss": "^8.2.2"
1215812192 }
1215912193 },
1216012194 "node_modules/postcss-colormin": {
12161− "version": "5.3.1",
12162− "resolved": "https://registry.npmjs.org/postcss-colormin/-/postcss-colormin-5.3.1.tgz",
12163− "integrity": "sha512-UsWQG0AqTFQmpBegeLLc1+c3jIqBNB0zlDGRWR+dQ3pRKJL1oeMzyqmH3o2PIfn9MBdNrVPWhDbT769LxCTLJQ==",
12195+ "version": "6.1.0",
12196+ "resolved": "https://registry.npmjs.org/postcss-colormin/-/postcss-colormin-6.1.0.tgz",
12197+ "integrity": "sha512-x9yX7DOxeMAR+BgGVnNSAxmAj98NX/YxEMNFP+SDCEeNLb2r3i6Hh1ksMsnW8Ub5SLCpbescQqn9YEbE9554Sw==",
1216412198 "dependencies": {
12165− "browserslist": "^4.21.4",
12199+ "browserslist": "^4.23.0",
1216612200 "caniuse-api": "^3.0.0",
12167− "colord": "^2.9.1",
12201+ "colord": "^2.9.3",
1216812202 "postcss-value-parser": "^4.2.0"
1216912203 },
1217012204 "engines": {
12171− "node": "^10 || ^12 || >=14.0"
12205+ "node": "^14 || ^16 || >=18.0"
1217212206 },
1217312207 "peerDependencies": {
12174− "postcss": "^8.2.15"
12208+ "postcss": "^8.4.31"
1217512209 }
1217612210 },
1217712211 "node_modules/postcss-convert-values": {
12178− "version": "5.1.3",
12179− "resolved": "https://registry.npmjs.org/postcss-convert-values/-/postcss-convert-values-5.1.3.tgz",
12180− "integrity": "sha512-82pC1xkJZtcJEfiLw6UXnXVXScgtBrjlO5CBmuDQc+dlb88ZYheFsjTn40+zBVi3DkfF7iezO0nJUPLcJK3pvA==",
12212+ "version": "6.1.0",
12213+ "resolved": "https://registry.npmjs.org/postcss-convert-values/-/postcss-convert-values-6.1.0.tgz",
12214+ "integrity": "sha512-zx8IwP/ts9WvUM6NkVSkiU902QZL1bwPhaVaLynPtCsOTqp+ZKbNi+s6XJg3rfqpKGA/oc7Oxk5t8pOQJcwl/w==",
1218112215 "dependencies": {
12182− "browserslist": "^4.21.4",
12216+ "browserslist": "^4.23.0",
1218312217 "postcss-value-parser": "^4.2.0"
1218412218 },
1218512219 "engines": {
12186− "node": "^10 || ^12 || >=14.0"
12220+ "node": "^14 || ^16 || >=18.0"
1218712221 },
1218812222 "peerDependencies": {
12189− "postcss": "^8.2.15"
12223+ "postcss": "^8.4.31"
1219012224 }
1219112225 },
1219212226 "node_modules/postcss-discard-comments": {
12193− "version": "5.1.2",
12194− "resolved": "https://registry.npmjs.org/postcss-discard-comments/-/postcss-discard-comments-5.1.2.tgz",
12195− "integrity": "sha512-+L8208OVbHVF2UQf1iDmRcbdjJkuBF6IS29yBDSiWUIzpYaAhtNl6JYnYm12FnkeCwQqF5LeklOu6rAqgfBZqQ==",
12227+ "version": "6.0.2",
12228+ "resolved": "https://registry.npmjs.org/postcss-discard-comments/-/postcss-discard-comments-6.0.2.tgz",
12229+ "integrity": "sha512-65w/uIqhSBBfQmYnG92FO1mWZjJ4GL5b8atm5Yw2UgrwD7HiNiSSNwJor1eCFGzUgYnN/iIknhNRVqjrrpuglw==",
1219612230 "engines": {
12197− "node": "^10 || ^12 || >=14.0"
12231+ "node": "^14 || ^16 || >=18.0"
1219812232 },
1219912233 "peerDependencies": {
12200− "postcss": "^8.2.15"
12234+ "postcss": "^8.4.31"
1220112235 }
1220212236 },
1220312237 "node_modules/postcss-discard-duplicates": {
12204− "version": "5.1.0",
12205− "resolved": "https://registry.npmjs.org/postcss-discard-duplicates/-/postcss-discard-duplicates-5.1.0.tgz",
12206− "integrity": "sha512-zmX3IoSI2aoenxHV6C7plngHWWhUOV3sP1T8y2ifzxzbtnuhk1EdPwm0S1bIUNaJ2eNbWeGLEwzw8huPD67aQw==",
12238+ "version": "6.0.3",
12239+ "resolved": "https://registry.npmjs.org/postcss-discard-duplicates/-/postcss-discard-duplicates-6.0.3.tgz",
12240+ "integrity": "sha512-+JA0DCvc5XvFAxwx6f/e68gQu/7Z9ud584VLmcgto28eB8FqSFZwtrLwB5Kcp70eIoWP/HXqz4wpo8rD8gpsTw==",
1220712241 "engines": {
12208− "node": "^10 || ^12 || >=14.0"
12242+ "node": "^14 || ^16 || >=18.0"
1220912243 },
1221012244 "peerDependencies": {
12211− "postcss": "^8.2.15"
12245+ "postcss": "^8.4.31"
1221212246 }
1221312247 },
1221412248 "node_modules/postcss-discard-empty": {
12215− "version": "5.1.1",
12216− "resolved": "https://registry.npmjs.org/postcss-discard-empty/-/postcss-discard-empty-5.1.1.tgz",
12217− "integrity": "sha512-zPz4WljiSuLWsI0ir4Mcnr4qQQ5e1Ukc3i7UfE2XcrwKK2LIPIqE5jxMRxO6GbI3cv//ztXDsXwEWT3BHOGh3A==",
12249+ "version": "6.0.3",
12250+ "resolved": "https://registry.npmjs.org/postcss-discard-empty/-/postcss-discard-empty-6.0.3.tgz",
12251+ "integrity": "sha512-znyno9cHKQsK6PtxL5D19Fj9uwSzC2mB74cpT66fhgOadEUPyXFkbgwm5tvc3bt3NAy8ltE5MrghxovZRVnOjQ==",
1221812252 "engines": {
12219− "node": "^10 || ^12 || >=14.0"
12253+ "node": "^14 || ^16 || >=18.0"
1222012254 },
1222112255 "peerDependencies": {
12222− "postcss": "^8.2.15"
12256+ "postcss": "^8.4.31"
1222312257 }
1222412258 },
1222512259 "node_modules/postcss-discard-overridden": {
12226− "version": "5.1.0",
12227− "resolved": "https://registry.npmjs.org/postcss-discard-overridden/-/postcss-discard-overridden-5.1.0.tgz",
12228− "integrity": "sha512-21nOL7RqWR1kasIVdKs8HNqQJhFxLsyRfAnUDm4Fe4t4mCWL9OJiHvlHPjcd8zc5Myu89b/7wZDnOSjFgeWRtw==",
12260+ "version": "6.0.2",
12261+ "resolved": "https://registry.npmjs.org/postcss-discard-overridden/-/postcss-discard-overridden-6.0.2.tgz",
12262+ "integrity": "sha512-j87xzI4LUggC5zND7KdjsI25APtyMuynXZSujByMaav2roV6OZX+8AaCUcZSWqckZpjAjRyFDdpqybgjFO0HJQ==",
1222912263 "engines": {
12230− "node": "^10 || ^12 || >=14.0"
12264+ "node": "^14 || ^16 || >=18.0"
1223112265 },
1223212266 "peerDependencies": {
12233− "postcss": "^8.2.15"
12267+ "postcss": "^8.4.31"
1223412268 }
1223512269 },
1223612270 "node_modules/postcss-discard-unused": {
12237− "version": "5.1.0",
12238− "resolved": "https://registry.npmjs.org/postcss-discard-unused/-/postcss-discard-unused-5.1.0.tgz",
12239− "integrity": "sha512-KwLWymI9hbwXmJa0dkrzpRbSJEh0vVUd7r8t0yOGPcfKzyJJxFM8kLyC5Ev9avji6nY95pOp1W6HqIrfT+0VGw==",
12271+ "version": "6.0.5",
12272+ "resolved": "https://registry.npmjs.org/postcss-discard-unused/-/postcss-discard-unused-6.0.5.tgz",
12273+ "integrity": "sha512-wHalBlRHkaNnNwfC8z+ppX57VhvS+HWgjW508esjdaEYr3Mx7Gnn2xA4R/CKf5+Z9S5qsqC+Uzh4ueENWwCVUA==",
1224012274 "dependencies": {
12241− "postcss-selector-parser": "^6.0.5"
12275+ "postcss-selector-parser": "^6.0.16"
1224212276 },
1224312277 "engines": {
12244− "node": "^10 || ^12 || >=14.0"
12278+ "node": "^14 || ^16 || >=18.0"
1224512279 },
1224612280 "peerDependencies": {
12247− "postcss": "^8.2.15"
12281+ "postcss": "^8.4.31"
1224812282 }
1224912283 },
1225012284 "node_modules/postcss-loader": {
@@ -12268,136 +12302,111 @@
1226812302 "webpack": "^5.0.0"
1226912303 }
1227012304 },
12271− "node_modules/postcss-loader/node_modules/cosmiconfig": {
12272− "version": "8.3.6",
12273− "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-8.3.6.tgz",
12274− "integrity": "sha512-kcZ6+W5QzcJ3P1Mt+83OUv/oHFqZHIx8DuxG6eZ5RGMERoLqp4BuGjhHLYGK+Kf5XVkQvqBSmAy/nGWN3qDgEA==",
12275− "dependencies": {
12276− "import-fresh": "^3.3.0",
12277− "js-yaml": "^4.1.0",
12278− "parse-json": "^5.2.0",
12279− "path-type": "^4.0.0"
12280− },
12281− "engines": {
12282− "node": ">=14"
12283− },
12284− "funding": {
12285− "url": "https://github.com/sponsors/d-fischer"
12286− },
12287− "peerDependencies": {
12288− "typescript": ">=4.9.5"
12289− },
12290− "peerDependenciesMeta": {
12291− "typescript": {
12292− "optional": true
12293− }
12294− }
12295− },
1229612305 "node_modules/postcss-merge-idents": {
12297− "version": "5.1.1",
12298− "resolved": "https://registry.npmjs.org/postcss-merge-idents/-/postcss-merge-idents-5.1.1.tgz",
12299− "integrity": "sha512-pCijL1TREiCoog5nQp7wUe+TUonA2tC2sQ54UGeMmryK3UFGIYKqDyjnqd6RcuI4znFn9hWSLNN8xKE/vWcUQw==",
12306+ "version": "6.0.3",
12307+ "resolved": "https://registry.npmjs.org/postcss-merge-idents/-/postcss-merge-idents-6.0.3.tgz",
12308+ "integrity": "sha512-1oIoAsODUs6IHQZkLQGO15uGEbK3EAl5wi9SS8hs45VgsxQfMnxvt+L+zIr7ifZFIH14cfAeVe2uCTa+SPRa3g==",
1230012309 "dependencies": {
12301− "cssnano-utils": "^3.1.0",
12310+ "cssnano-utils": "^4.0.2",
1230212311 "postcss-value-parser": "^4.2.0"
1230312312 },
1230412313 "engines": {
12305− "node": "^10 || ^12 || >=14.0"
12314+ "node": "^14 || ^16 || >=18.0"
1230612315 },
1230712316 "peerDependencies": {
12308− "postcss": "^8.2.15"
12317+ "postcss": "^8.4.31"
1230912318 }
1231012319 },
1231112320 "node_modules/postcss-merge-longhand": {
12312− "version": "5.1.7",
12313− "resolved": "https://registry.npmjs.org/postcss-merge-longhand/-/postcss-merge-longhand-5.1.7.tgz",
12314− "integrity": "sha512-YCI9gZB+PLNskrK0BB3/2OzPnGhPkBEwmwhfYk1ilBHYVAZB7/tkTHFBAnCrvBBOmeYyMYw3DMjT55SyxMBzjQ==",
12321+ "version": "6.0.5",
12322+ "resolved": "https://registry.npmjs.org/postcss-merge-longhand/-/postcss-merge-longhand-6.0.5.tgz",
12323+ "integrity": "sha512-5LOiordeTfi64QhICp07nzzuTDjNSO8g5Ksdibt44d+uvIIAE1oZdRn8y/W5ZtYgRH/lnLDlvi9F8btZcVzu3w==",
1231512324 "dependencies": {
1231612325 "postcss-value-parser": "^4.2.0",
12317− "stylehacks": "^5.1.1"
12326+ "stylehacks": "^6.1.1"
1231812327 },
1231912328 "engines": {
12320− "node": "^10 || ^12 || >=14.0"
12329+ "node": "^14 || ^16 || >=18.0"
1232112330 },
1232212331 "peerDependencies": {
12323− "postcss": "^8.2.15"
12332+ "postcss": "^8.4.31"
1232412333 }
1232512334 },
1232612335 "node_modules/postcss-merge-rules": {
12327− "version": "5.1.4",
12328− "resolved": "https://registry.npmjs.org/postcss-merge-rules/-/postcss-merge-rules-5.1.4.tgz",
12329− "integrity": "sha512-0R2IuYpgU93y9lhVbO/OylTtKMVcHb67zjWIfCiKR9rWL3GUk1677LAqD/BcHizukdZEjT8Ru3oHRoAYoJy44g==",
12336+ "version": "6.1.1",
12337+ "resolved": "https://registry.npmjs.org/postcss-merge-rules/-/postcss-merge-rules-6.1.1.tgz",
12338+ "integrity": "sha512-KOdWF0gju31AQPZiD+2Ar9Qjowz1LTChSjFFbS+e2sFgc4uHOp3ZvVX4sNeTlk0w2O31ecFGgrFzhO0RSWbWwQ==",
1233012339 "dependencies": {
12331− "browserslist": "^4.21.4",
12340+ "browserslist": "^4.23.0",
1233212341 "caniuse-api": "^3.0.0",
12333− "cssnano-utils": "^3.1.0",
12334− "postcss-selector-parser": "^6.0.5"
12342+ "cssnano-utils": "^4.0.2",
12343+ "postcss-selector-parser": "^6.0.16"
1233512344 },
1233612345 "engines": {
12337− "node": "^10 || ^12 || >=14.0"
12346+ "node": "^14 || ^16 || >=18.0"
1233812347 },
1233912348 "peerDependencies": {
12340− "postcss": "^8.2.15"
12349+ "postcss": "^8.4.31"
1234112350 }
1234212351 },
1234312352 "node_modules/postcss-minify-font-values": {
12344− "version": "5.1.0",
12345− "resolved": "https://registry.npmjs.org/postcss-minify-font-values/-/postcss-minify-font-values-5.1.0.tgz",
12346− "integrity": "sha512-el3mYTgx13ZAPPirSVsHqFzl+BBBDrXvbySvPGFnQcTI4iNslrPaFq4muTkLZmKlGk4gyFAYUBMH30+HurREyA==",
12353+ "version": "6.1.0",
12354+ "resolved": "https://registry.npmjs.org/postcss-minify-font-values/-/postcss-minify-font-values-6.1.0.tgz",
12355+ "integrity": "sha512-gklfI/n+9rTh8nYaSJXlCo3nOKqMNkxuGpTn/Qm0gstL3ywTr9/WRKznE+oy6fvfolH6dF+QM4nCo8yPLdvGJg==",
1234712356 "dependencies": {
1234812357 "postcss-value-parser": "^4.2.0"
1234912358 },
1235012359 "engines": {
12351− "node": "^10 || ^12 || >=14.0"
12360+ "node": "^14 || ^16 || >=18.0"
1235212361 },
1235312362 "peerDependencies": {
12354− "postcss": "^8.2.15"
12363+ "postcss": "^8.4.31"
1235512364 }
1235612365 },
1235712366 "node_modules/postcss-minify-gradients": {
12358− "version": "5.1.1",
12359− "resolved": "https://registry.npmjs.org/postcss-minify-gradients/-/postcss-minify-gradients-5.1.1.tgz",
12360− "integrity": "sha512-VGvXMTpCEo4qHTNSa9A0a3D+dxGFZCYwR6Jokk+/3oB6flu2/PnPXAh2x7x52EkY5xlIHLm+Le8tJxe/7TNhzw==",
12367+ "version": "6.0.3",
12368+ "resolved": "https://registry.npmjs.org/postcss-minify-gradients/-/postcss-minify-gradients-6.0.3.tgz",
12369+ "integrity": "sha512-4KXAHrYlzF0Rr7uc4VrfwDJ2ajrtNEpNEuLxFgwkhFZ56/7gaE4Nr49nLsQDZyUe+ds+kEhf+YAUolJiYXF8+Q==",
1236112370 "dependencies": {
12362− "colord": "^2.9.1",
12363− "cssnano-utils": "^3.1.0",
12371+ "colord": "^2.9.3",
12372+ "cssnano-utils": "^4.0.2",
1236412373 "postcss-value-parser": "^4.2.0"
1236512374 },
1236612375 "engines": {
12367− "node": "^10 || ^12 || >=14.0"
12376+ "node": "^14 || ^16 || >=18.0"
1236812377 },
1236912378 "peerDependencies": {
12370− "postcss": "^8.2.15"
12379+ "postcss": "^8.4.31"
1237112380 }
1237212381 },
1237312382 "node_modules/postcss-minify-params": {
12374− "version": "5.1.4",
12375− "resolved": "https://registry.npmjs.org/postcss-minify-params/-/postcss-minify-params-5.1.4.tgz",
12376− "integrity": "sha512-+mePA3MgdmVmv6g+30rn57USjOGSAyuxUmkfiWpzalZ8aiBkdPYjXWtHuwJGm1v5Ojy0Z0LaSYhHaLJQB0P8Jw==",
12383+ "version": "6.1.0",
12384+ "resolved": "https://registry.npmjs.org/postcss-minify-params/-/postcss-minify-params-6.1.0.tgz",
12385+ "integrity": "sha512-bmSKnDtyyE8ujHQK0RQJDIKhQ20Jq1LYiez54WiaOoBtcSuflfK3Nm596LvbtlFcpipMjgClQGyGr7GAs+H1uA==",
1237712386 "dependencies": {
12378− "browserslist": "^4.21.4",
12379− "cssnano-utils": "^3.1.0",
12387+ "browserslist": "^4.23.0",
12388+ "cssnano-utils": "^4.0.2",
1238012389 "postcss-value-parser": "^4.2.0"
1238112390 },
1238212391 "engines": {
12383− "node": "^10 || ^12 || >=14.0"
12392+ "node": "^14 || ^16 || >=18.0"
1238412393 },
1238512394 "peerDependencies": {
12386− "postcss": "^8.2.15"
12395+ "postcss": "^8.4.31"
1238712396 }
1238812397 },
1238912398 "node_modules/postcss-minify-selectors": {
12390− "version": "5.2.1",
12391− "resolved": "https://registry.npmjs.org/postcss-minify-selectors/-/postcss-minify-selectors-5.2.1.tgz",
12392− "integrity": "sha512-nPJu7OjZJTsVUmPdm2TcaiohIwxP+v8ha9NehQ2ye9szv4orirRU3SDdtUmKH+10nzn0bAyOXZ0UEr7OpvLehg==",
12399+ "version": "6.0.4",
12400+ "resolved": "https://registry.npmjs.org/postcss-minify-selectors/-/postcss-minify-selectors-6.0.4.tgz",
12401+ "integrity": "sha512-L8dZSwNLgK7pjTto9PzWRoMbnLq5vsZSTu8+j1P/2GB8qdtGQfn+K1uSvFgYvgh83cbyxT5m43ZZhUMTJDSClQ==",
1239312402 "dependencies": {
12394− "postcss-selector-parser": "^6.0.5"
12403+ "postcss-selector-parser": "^6.0.16"
1239512404 },
1239612405 "engines": {
12397− "node": "^10 || ^12 || >=14.0"
12406+ "node": "^14 || ^16 || >=18.0"
1239812407 },
1239912408 "peerDependencies": {
12400− "postcss": "^8.2.15"
12409+ "postcss": "^8.4.31"
1240112410 }
1240212411 },
1240312412 "node_modules/postcss-modules-extract-imports": {
@@ -12456,192 +12465,191 @@
1245612465 }
1245712466 },
1245812467 "node_modules/postcss-normalize-charset": {
12459− "version": "5.1.0",
12460− "resolved": "https://registry.npmjs.org/postcss-normalize-charset/-/postcss-normalize-charset-5.1.0.tgz",
12461− "integrity": "sha512-mSgUJ+pd/ldRGVx26p2wz9dNZ7ji6Pn8VWBajMXFf8jk7vUoSrZ2lt/wZR7DtlZYKesmZI680qjr2CeFF2fbUg==",
12468+ "version": "6.0.2",
12469+ "resolved": "https://registry.npmjs.org/postcss-normalize-charset/-/postcss-normalize-charset-6.0.2.tgz",
12470+ "integrity": "sha512-a8N9czmdnrjPHa3DeFlwqst5eaL5W8jYu3EBbTTkI5FHkfMhFZh1EGbku6jhHhIzTA6tquI2P42NtZ59M/H/kQ==",
1246212471 "engines": {
12463− "node": "^10 || ^12 || >=14.0"
12472+ "node": "^14 || ^16 || >=18.0"
1246412473 },
1246512474 "peerDependencies": {
12466− "postcss": "^8.2.15"
12475+ "postcss": "^8.4.31"
1246712476 }
1246812477 },
1246912478 "node_modules/postcss-normalize-display-values": {
12470− "version": "5.1.0",
12471− "resolved": "https://registry.npmjs.org/postcss-normalize-display-values/-/postcss-normalize-display-values-5.1.0.tgz",
12472− "integrity": "sha512-WP4KIM4o2dazQXWmFaqMmcvsKmhdINFblgSeRgn8BJ6vxaMyaJkwAzpPpuvSIoG/rmX3M+IrRZEz2H0glrQNEA==",
12479+ "version": "6.0.2",
12480+ "resolved": "https://registry.npmjs.org/postcss-normalize-display-values/-/postcss-normalize-display-values-6.0.2.tgz",
12481+ "integrity": "sha512-8H04Mxsb82ON/aAkPeq8kcBbAtI5Q2a64X/mnRRfPXBq7XeogoQvReqxEfc0B4WPq1KimjezNC8flUtC3Qz6jg==",
1247312482 "dependencies": {
1247412483 "postcss-value-parser": "^4.2.0"
1247512484 },
1247612485 "engines": {
12477− "node": "^10 || ^12 || >=14.0"
12486+ "node": "^14 || ^16 || >=18.0"
1247812487 },
1247912488 "peerDependencies": {
12480− "postcss": "^8.2.15"
12489+ "postcss": "^8.4.31"
1248112490 }
1248212491 },
1248312492 "node_modules/postcss-normalize-positions": {
12484− "version": "5.1.1",
12485− "resolved": "https://registry.npmjs.org/postcss-normalize-positions/-/postcss-normalize-positions-5.1.1.tgz",
12486− "integrity": "sha512-6UpCb0G4eofTCQLFVuI3EVNZzBNPiIKcA1AKVka+31fTVySphr3VUgAIULBhxZkKgwLImhzMR2Bw1ORK+37INg==",
12493+ "version": "6.0.2",
12494+ "resolved": "https://registry.npmjs.org/postcss-normalize-positions/-/postcss-normalize-positions-6.0.2.tgz",
12495+ "integrity": "sha512-/JFzI441OAB9O7VnLA+RtSNZvQ0NCFZDOtp6QPFo1iIyawyXg0YI3CYM9HBy1WvwCRHnPep/BvI1+dGPKoXx/Q==",
1248712496 "dependencies": {
1248812497 "postcss-value-parser": "^4.2.0"
1248912498 },
1249012499 "engines": {
12491− "node": "^10 || ^12 || >=14.0"
12500+ "node": "^14 || ^16 || >=18.0"
1249212501 },
1249312502 "peerDependencies": {
12494− "postcss": "^8.2.15"
12503+ "postcss": "^8.4.31"
1249512504 }
1249612505 },
1249712506 "node_modules/postcss-normalize-repeat-style": {
12498− "version": "5.1.1",
12499− "resolved": "https://registry.npmjs.org/postcss-normalize-repeat-style/-/postcss-normalize-repeat-style-5.1.1.tgz",
12500− "integrity": "sha512-mFpLspGWkQtBcWIRFLmewo8aC3ImN2i/J3v8YCFUwDnPu3Xz4rLohDO26lGjwNsQxB3YF0KKRwspGzE2JEuS0g==",
12507+ "version": "6.0.2",
12508+ "resolved": "https://registry.npmjs.org/postcss-normalize-repeat-style/-/postcss-normalize-repeat-style-6.0.2.tgz",
12509+ "integrity": "sha512-YdCgsfHkJ2jEXwR4RR3Tm/iOxSfdRt7jplS6XRh9Js9PyCR/aka/FCb6TuHT2U8gQubbm/mPmF6L7FY9d79VwQ==",
1250112510 "dependencies": {
1250212511 "postcss-value-parser": "^4.2.0"
1250312512 },
1250412513 "engines": {
12505− "node": "^10 || ^12 || >=14.0"
12514+ "node": "^14 || ^16 || >=18.0"
1250612515 },
1250712516 "peerDependencies": {
12508− "postcss": "^8.2.15"
12517+ "postcss": "^8.4.31"
1250912518 }
1251012519 },
1251112520 "node_modules/postcss-normalize-string": {
12512− "version": "5.1.0",
12513− "resolved": "https://registry.npmjs.org/postcss-normalize-string/-/postcss-normalize-string-5.1.0.tgz",
12514− "integrity": "sha512-oYiIJOf4T9T1N4i+abeIc7Vgm/xPCGih4bZz5Nm0/ARVJ7K6xrDlLwvwqOydvyL3RHNf8qZk6vo3aatiw/go3w==",
12521+ "version": "6.0.2",
12522+ "resolved": "https://registry.npmjs.org/postcss-normalize-string/-/postcss-normalize-string-6.0.2.tgz",
12523+ "integrity": "sha512-vQZIivlxlfqqMp4L9PZsFE4YUkWniziKjQWUtsxUiVsSSPelQydwS8Wwcuw0+83ZjPWNTl02oxlIvXsmmG+CiQ==",
1251512524 "dependencies": {
1251612525 "postcss-value-parser": "^4.2.0"
1251712526 },
1251812527 "engines": {
12519− "node": "^10 || ^12 || >=14.0"
12528+ "node": "^14 || ^16 || >=18.0"
1252012529 },
1252112530 "peerDependencies": {
12522− "postcss": "^8.2.15"
12531+ "postcss": "^8.4.31"
1252312532 }
1252412533 },
1252512534 "node_modules/postcss-normalize-timing-functions": {
12526− "version": "5.1.0",
12527− "resolved": "https://registry.npmjs.org/postcss-normalize-timing-functions/-/postcss-normalize-timing-functions-5.1.0.tgz",
12528− "integrity": "sha512-DOEkzJ4SAXv5xkHl0Wa9cZLF3WCBhF3o1SKVxKQAa+0pYKlueTpCgvkFAHfk+Y64ezX9+nITGrDZeVGgITJXjg==",
12535+ "version": "6.0.2",
12536+ "resolved": "https://registry.npmjs.org/postcss-normalize-timing-functions/-/postcss-normalize-timing-functions-6.0.2.tgz",
12537+ "integrity": "sha512-a+YrtMox4TBtId/AEwbA03VcJgtyW4dGBizPl7e88cTFULYsprgHWTbfyjSLyHeBcK/Q9JhXkt2ZXiwaVHoMzA==",
1252912538 "dependencies": {
1253012539 "postcss-value-parser": "^4.2.0"
1253112540 },
1253212541 "engines": {
12533− "node": "^10 || ^12 || >=14.0"
12542+ "node": "^14 || ^16 || >=18.0"
1253412543 },
1253512544 "peerDependencies": {
12536− "postcss": "^8.2.15"
12545+ "postcss": "^8.4.31"
1253712546 }
1253812547 },
1253912548 "node_modules/postcss-normalize-unicode": {
12540− "version": "5.1.1",
12541− "resolved": "https://registry.npmjs.org/postcss-normalize-unicode/-/postcss-normalize-unicode-5.1.1.tgz",
12542− "integrity": "sha512-qnCL5jzkNUmKVhZoENp1mJiGNPcsJCs1aaRmURmeJGES23Z/ajaln+EPTD+rBeNkSryI+2WTdW+lwcVdOikrpA==",
12549+ "version": "6.1.0",
12550+ "resolved": "https://registry.npmjs.org/postcss-normalize-unicode/-/postcss-normalize-unicode-6.1.0.tgz",
12551+ "integrity": "sha512-QVC5TQHsVj33otj8/JD869Ndr5Xcc/+fwRh4HAsFsAeygQQXm+0PySrKbr/8tkDKzW+EVT3QkqZMfFrGiossDg==",
1254312552 "dependencies": {
12544− "browserslist": "^4.21.4",
12553+ "browserslist": "^4.23.0",
1254512554 "postcss-value-parser": "^4.2.0"
1254612555 },
1254712556 "engines": {
12548− "node": "^10 || ^12 || >=14.0"
12557+ "node": "^14 || ^16 || >=18.0"
1254912558 },
1255012559 "peerDependencies": {
12551− "postcss": "^8.2.15"
12560+ "postcss": "^8.4.31"
1255212561 }
1255312562 },
1255412563 "node_modules/postcss-normalize-url": {
12555− "version": "5.1.0",
12556− "resolved": "https://registry.npmjs.org/postcss-normalize-url/-/postcss-normalize-url-5.1.0.tgz",
12557− "integrity": "sha512-5upGeDO+PVthOxSmds43ZeMeZfKH+/DKgGRD7TElkkyS46JXAUhMzIKiCa7BabPeIy3AQcTkXwVVN7DbqsiCew==",
12564+ "version": "6.0.2",
12565+ "resolved": "https://registry.npmjs.org/postcss-normalize-url/-/postcss-normalize-url-6.0.2.tgz",
12566+ "integrity": "sha512-kVNcWhCeKAzZ8B4pv/DnrU1wNh458zBNp8dh4y5hhxih5RZQ12QWMuQrDgPRw3LRl8mN9vOVfHl7uhvHYMoXsQ==",
1255812567 "dependencies": {
12559− "normalize-url": "^6.0.1",
1256012568 "postcss-value-parser": "^4.2.0"
1256112569 },
1256212570 "engines": {
12563− "node": "^10 || ^12 || >=14.0"
12571+ "node": "^14 || ^16 || >=18.0"
1256412572 },
1256512573 "peerDependencies": {
12566− "postcss": "^8.2.15"
12574+ "postcss": "^8.4.31"
1256712575 }
1256812576 },
1256912577 "node_modules/postcss-normalize-whitespace": {
12570− "version": "5.1.1",
12571− "resolved": "https://registry.npmjs.org/postcss-normalize-whitespace/-/postcss-normalize-whitespace-5.1.1.tgz",
12572− "integrity": "sha512-83ZJ4t3NUDETIHTa3uEg6asWjSBYL5EdkVB0sDncx9ERzOKBVJIUeDO9RyA9Zwtig8El1d79HBp0JEi8wvGQnA==",
12578+ "version": "6.0.2",
12579+ "resolved": "https://registry.npmjs.org/postcss-normalize-whitespace/-/postcss-normalize-whitespace-6.0.2.tgz",
12580+ "integrity": "sha512-sXZ2Nj1icbJOKmdjXVT9pnyHQKiSAyuNQHSgRCUgThn2388Y9cGVDR+E9J9iAYbSbLHI+UUwLVl1Wzco/zgv0Q==",
1257312581 "dependencies": {
1257412582 "postcss-value-parser": "^4.2.0"
1257512583 },
1257612584 "engines": {
12577− "node": "^10 || ^12 || >=14.0"
12585+ "node": "^14 || ^16 || >=18.0"
1257812586 },
1257912587 "peerDependencies": {
12580− "postcss": "^8.2.15"
12588+ "postcss": "^8.4.31"
1258112589 }
1258212590 },
1258312591 "node_modules/postcss-ordered-values": {
12584− "version": "5.1.3",
12585− "resolved": "https://registry.npmjs.org/postcss-ordered-values/-/postcss-ordered-values-5.1.3.tgz",
12586− "integrity": "sha512-9UO79VUhPwEkzbb3RNpqqghc6lcYej1aveQteWY+4POIwlqkYE21HKWaLDF6lWNuqCobEAyTovVhtI32Rbv2RQ==",
12592+ "version": "6.0.2",
12593+ "resolved": "https://registry.npmjs.org/postcss-ordered-values/-/postcss-ordered-values-6.0.2.tgz",
12594+ "integrity": "sha512-VRZSOB+JU32RsEAQrO94QPkClGPKJEL/Z9PCBImXMhIeK5KAYo6slP/hBYlLgrCjFxyqvn5VC81tycFEDBLG1Q==",
1258712595 "dependencies": {
12588− "cssnano-utils": "^3.1.0",
12596+ "cssnano-utils": "^4.0.2",
1258912597 "postcss-value-parser": "^4.2.0"
1259012598 },
1259112599 "engines": {
12592− "node": "^10 || ^12 || >=14.0"
12600+ "node": "^14 || ^16 || >=18.0"
1259312601 },
1259412602 "peerDependencies": {
12595− "postcss": "^8.2.15"
12603+ "postcss": "^8.4.31"
1259612604 }
1259712605 },
1259812606 "node_modules/postcss-reduce-idents": {
12599− "version": "5.2.0",
12600− "resolved": "https://registry.npmjs.org/postcss-reduce-idents/-/postcss-reduce-idents-5.2.0.tgz",
12601− "integrity": "sha512-BTrLjICoSB6gxbc58D5mdBK8OhXRDqud/zodYfdSi52qvDHdMwk+9kB9xsM8yJThH/sZU5A6QVSmMmaN001gIg==",
12607+ "version": "6.0.3",
12608+ "resolved": "https://registry.npmjs.org/postcss-reduce-idents/-/postcss-reduce-idents-6.0.3.tgz",
12609+ "integrity": "sha512-G3yCqZDpsNPoQgbDUy3T0E6hqOQ5xigUtBQyrmq3tn2GxlyiL0yyl7H+T8ulQR6kOcHJ9t7/9H4/R2tv8tJbMA==",
1260212610 "dependencies": {
1260312611 "postcss-value-parser": "^4.2.0"
1260412612 },
1260512613 "engines": {
12606− "node": "^10 || ^12 || >=14.0"
12614+ "node": "^14 || ^16 || >=18.0"
1260712615 },
1260812616 "peerDependencies": {
12609− "postcss": "^8.2.15"
12617+ "postcss": "^8.4.31"
1261012618 }
1261112619 },
1261212620 "node_modules/postcss-reduce-initial": {
12613− "version": "5.1.2",
12614− "resolved": "https://registry.npmjs.org/postcss-reduce-initial/-/postcss-reduce-initial-5.1.2.tgz",
12615− "integrity": "sha512-dE/y2XRaqAi6OvjzD22pjTUQ8eOfc6m/natGHgKFBK9DxFmIm69YmaRVQrGgFlEfc1HePIurY0TmDeROK05rIg==",
12621+ "version": "6.1.0",
12622+ "resolved": "https://registry.npmjs.org/postcss-reduce-initial/-/postcss-reduce-initial-6.1.0.tgz",
12623+ "integrity": "sha512-RarLgBK/CrL1qZags04oKbVbrrVK2wcxhvta3GCxrZO4zveibqbRPmm2VI8sSgCXwoUHEliRSbOfpR0b/VIoiw==",
1261612624 "dependencies": {
12617− "browserslist": "^4.21.4",
12625+ "browserslist": "^4.23.0",
1261812626 "caniuse-api": "^3.0.0"
1261912627 },
1262012628 "engines": {
12621− "node": "^10 || ^12 || >=14.0"
12629+ "node": "^14 || ^16 || >=18.0"
1262212630 },
1262312631 "peerDependencies": {
12624− "postcss": "^8.2.15"
12632+ "postcss": "^8.4.31"
1262512633 }
1262612634 },
1262712635 "node_modules/postcss-reduce-transforms": {
12628− "version": "5.1.0",
12629− "resolved": "https://registry.npmjs.org/postcss-reduce-transforms/-/postcss-reduce-transforms-5.1.0.tgz",
12630− "integrity": "sha512-2fbdbmgir5AvpW9RLtdONx1QoYG2/EtqpNQbFASDlixBbAYuTcJ0dECwlqNqH7VbaUnEnh8SrxOe2sRIn24XyQ==",
12636+ "version": "6.0.2",
12637+ "resolved": "https://registry.npmjs.org/postcss-reduce-transforms/-/postcss-reduce-transforms-6.0.2.tgz",
12638+ "integrity": "sha512-sB+Ya++3Xj1WaT9+5LOOdirAxP7dJZms3GRcYheSPi1PiTMigsxHAdkrbItHxwYHr4kt1zL7mmcHstgMYT+aiA==",
1263112639 "dependencies": {
1263212640 "postcss-value-parser": "^4.2.0"
1263312641 },
1263412642 "engines": {
12635− "node": "^10 || ^12 || >=14.0"
12643+ "node": "^14 || ^16 || >=18.0"
1263612644 },
1263712645 "peerDependencies": {
12638− "postcss": "^8.2.15"
12646+ "postcss": "^8.4.31"
1263912647 }
1264012648 },
1264112649 "node_modules/postcss-selector-parser": {
12642− "version": "6.0.15",
12643− "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.15.tgz",
12644− "integrity": "sha512-rEYkQOMUCEMhsKbK66tbEU9QVIxbhN18YiniAwA7XQYTVBqrBy+P2p5JcdqsHgKM2zWylp8d7J6eszocfds5Sw==",
12650+ "version": "6.0.16",
12651+ "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.16.tgz",
12652+ "integrity": "sha512-A0RVJrX+IUkVZbW3ClroRWurercFhieevHB38sr2+l9eUClMqome3LmEmnhlNy+5Mr2EYN6B2Kaw9wYdd+VHiw==",
1264512653 "dependencies": {
1264612654 "cssesc": "^3.0.0",
1264712655 "util-deprecate": "^1.0.2"
@@ -12651,46 +12659,46 @@
1265112659 }
1265212660 },
1265312661 "node_modules/postcss-sort-media-queries": {
12654− "version": "4.4.1",
12655− "resolved": "https://registry.npmjs.org/postcss-sort-media-queries/-/postcss-sort-media-queries-4.4.1.tgz",
12656− "integrity": "sha512-QDESFzDDGKgpiIh4GYXsSy6sek2yAwQx1JASl5AxBtU1Lq2JfKBljIPNdil989NcSKRQX1ToiaKphImtBuhXWw==",
12662+ "version": "5.2.0",
12663+ "resolved": "https://registry.npmjs.org/postcss-sort-media-queries/-/postcss-sort-media-queries-5.2.0.tgz",
12664+ "integrity": "sha512-AZ5fDMLD8SldlAYlvi8NIqo0+Z8xnXU2ia0jxmuhxAU+Lqt9K+AlmLNJ/zWEnE9x+Zx3qL3+1K20ATgNOr3fAA==",
1265712665 "dependencies": {
12658− "sort-css-media-queries": "2.1.0"
12666+ "sort-css-media-queries": "2.2.0"
1265912667 },
1266012668 "engines": {
12661− "node": ">=10.0.0"
12669+ "node": ">=14.0.0"
1266212670 },
1266312671 "peerDependencies": {
12664− "postcss": "^8.4.16"
12672+ "postcss": "^8.4.23"
1266512673 }
1266612674 },
1266712675 "node_modules/postcss-svgo": {
12668− "version": "5.1.0",
12669− "resolved": "https://registry.npmjs.org/postcss-svgo/-/postcss-svgo-5.1.0.tgz",
12670− "integrity": "sha512-D75KsH1zm5ZrHyxPakAxJWtkyXew5qwS70v56exwvw542d9CRtTo78K0WeFxZB4G7JXKKMbEZtZayTGdIky/eA==",
12676+ "version": "6.0.3",
12677+ "resolved": "https://registry.npmjs.org/postcss-svgo/-/postcss-svgo-6.0.3.tgz",
12678+ "integrity": "sha512-dlrahRmxP22bX6iKEjOM+c8/1p+81asjKT+V5lrgOH944ryx/OHpclnIbGsKVd3uWOXFLYJwCVf0eEkJGvO96g==",
1267112679 "dependencies": {
1267212680 "postcss-value-parser": "^4.2.0",
12673− "svgo": "^2.7.0"
12681+ "svgo": "^3.2.0"
1267412682 },
1267512683 "engines": {
12676− "node": "^10 || ^12 || >=14.0"
12684+ "node": "^14 || ^16 || >= 18"
1267712685 },
1267812686 "peerDependencies": {
12679− "postcss": "^8.2.15"
12687+ "postcss": "^8.4.31"
1268012688 }
1268112689 },
1268212690 "node_modules/postcss-unique-selectors": {
12683− "version": "5.1.1",
12684− "resolved": "https://registry.npmjs.org/postcss-unique-selectors/-/postcss-unique-selectors-5.1.1.tgz",
12685− "integrity": "sha512-5JiODlELrz8L2HwxfPnhOWZYWDxVHWL83ufOv84NrcgipI7TaeRsatAhK4Tr2/ZiYldpK/wBvw5BD3qfaK96GA==",
12691+ "version": "6.0.4",
12692+ "resolved": "https://registry.npmjs.org/postcss-unique-selectors/-/postcss-unique-selectors-6.0.4.tgz",
12693+ "integrity": "sha512-K38OCaIrO8+PzpArzkLKB42dSARtC2tmG6PvD4b1o1Q2E9Os8jzfWFfSy/rixsHwohtsDdFtAWGjFVFUdwYaMg==",
1268612694 "dependencies": {
12687− "postcss-selector-parser": "^6.0.5"
12695+ "postcss-selector-parser": "^6.0.16"
1268812696 },
1268912697 "engines": {
12690− "node": "^10 || ^12 || >=14.0"
12698+ "node": "^14 || ^16 || >=18.0"
1269112699 },
1269212700 "peerDependencies": {
12693− "postcss": "^8.2.15"
12701+ "postcss": "^8.4.31"
1269412702 }
1269512703 },
1269612704 "node_modules/postcss-value-parser": {
@@ -12699,14 +12707,14 @@
1269912707 "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ=="
1270012708 },
1270112709 "node_modules/postcss-zindex": {
12702− "version": "5.1.0",
12703− "resolved": "https://registry.npmjs.org/postcss-zindex/-/postcss-zindex-5.1.0.tgz",
12704− "integrity": "sha512-fgFMf0OtVSBR1va1JNHYgMxYk73yhn/qb4uQDq1DLGYolz8gHCyr/sesEuGUaYs58E3ZJRcpoGuPVoB7Meiq9A==",
12710+ "version": "6.0.2",
12711+ "resolved": "https://registry.npmjs.org/postcss-zindex/-/postcss-zindex-6.0.2.tgz",
12712+ "integrity": "sha512-5BxW9l1evPB/4ZIc+2GobEBoKC+h8gPGCMi+jxsYvd2x0mjq7wazk6DrP71pStqxE9Foxh5TVnonbWpFZzXaYg==",
1270512713 "engines": {
12706− "node": "^10 || ^12 || >=14.0"
12714+ "node": "^14 || ^16 || >=18.0"
1270712715 },
1270812716 "peerDependencies": {
12709− "postcss": "^8.2.15"
12717+ "postcss": "^8.4.31"
1271012718 }
1271112719 },
1271212720 "node_modules/pretty-error": {
@@ -12895,9 +12903,9 @@
1289512903 }
1289612904 },
1289712905 "node_modules/raw-body": {
12898− "version": "2.5.1",
12899− "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.1.tgz",
12900− "integrity": "sha512-qqJBtEyVgS0ZmPGdCFPWJ3FreoqvG4MVQln/kCgF7Olq95IbOp0/BWyMwbdtn4VTvkM8Y7khCQ2Xgk/tcrCXig==",
12906+ "version": "2.5.2",
12907+ "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
12908+ "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==",
1290112909 "dependencies": {
1290212910 "bytes": "3.1.2",
1290312911 "http-errors": "2.0.0",
@@ -13111,9 +13119,9 @@
1311113119 "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="
1311213120 },
1311313121 "node_modules/react-json-view-lite": {
13114− "version": "1.2.1",
13115− "resolved": "https://registry.npmjs.org/react-json-view-lite/-/react-json-view-lite-1.2.1.tgz",
13116− "integrity": "sha512-Itc0g86fytOmKZoIoJyGgvNqohWSbh3NXIKNgH6W6FT9PC1ck4xas1tT3Rr/b3UlFXyA9Jjaw9QSXdZy2JwGMQ==",
13122+ "version": "1.4.0",
13123+ "resolved": "https://registry.npmjs.org/react-json-view-lite/-/react-json-view-lite-1.4.0.tgz",
13124+ "integrity": "sha512-wh6F6uJyYAmQ4fK0e8dSQMEWuvTs2Wr3el3sLD9bambX1+pSWUVXIz1RFaoy3TI1mZ0FqdpKq9YgbgTTgyrmXA==",
1311713125 "engines": {
1311813126 "node": ">=14"
1311913127 },
@@ -13123,12 +13131,11 @@
1312313131 },
1312413132 "node_modules/react-loadable": {
1312513133 "name": "@docusaurus/react-loadable",
13126− "version": "5.5.2",
13127− "resolved": "https://registry.npmjs.org/@docusaurus/react-loadable/-/react-loadable-5.5.2.tgz",
13128− "integrity": "sha512-A3dYjdBGuy0IGT+wyLIGIKLRE+sAk1iNk0f1HjNDysO7u8lhL4N3VEm+FAubmJbAztn94F7MxBTPmnixbiyFdQ==",
13134+ "version": "6.0.0",
13135+ "resolved": "https://registry.npmjs.org/@docusaurus/react-loadable/-/react-loadable-6.0.0.tgz",
13136+ "integrity": "sha512-YMMxTUQV/QFSnbgrP3tjDzLHRg7vsbMn8e9HAa8o/1iXoiomo48b7sk/kkmWEuWNDPJVlKSJRB6Y2fHqdJk+SQ==",
1312913137 "dependencies": {
13130− "@types/react": "*",
13131− "prop-types": "^15.6.2"
13138+ "@types/react": "*"
1313213139 },
1313313140 "peerDependencies": {
1313413141 "react": "*"
@@ -14033,14 +14040,16 @@
1403314040 }
1403414041 },
1403514042 "node_modules/set-function-length": {
14036− "version": "1.1.1",
14037− "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.1.1.tgz",
14038− "integrity": "sha512-VoaqjbBJKiWtg4yRcKBQ7g7wnGnLV3M8oLvVWwOk2PdYY6PEFegR1vezXR0tw6fZGF9csVakIRjrJiy2veSBFQ==",
14043+ "version": "1.2.2",
14044+ "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
14045+ "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
1403914046 "dependencies": {
14040− "define-data-property": "^1.1.1",
14041− "get-intrinsic": "^1.2.1",
14047+ "define-data-property": "^1.1.4",
14048+ "es-errors": "^1.3.0",
14049+ "function-bind": "^1.1.2",
14050+ "get-intrinsic": "^1.2.4",
1404214051 "gopd": "^1.0.1",
14043− "has-property-descriptors": "^1.0.0"
14052+ "has-property-descriptors": "^1.0.2"
1404414053 },
1404514054 "engines": {
1404614055 "node": ">= 0.4"
@@ -14111,13 +14120,17 @@
1411114120 }
1411214121 },
1411314122 "node_modules/side-channel": {
14114− "version": "1.0.4",
14115− "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
14116− "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
14123+ "version": "1.0.6",
14124+ "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.6.tgz",
14125+ "integrity": "sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==",
1411714126 "dependencies": {
14118− "call-bind": "^1.0.0",
14119− "get-intrinsic": "^1.0.2",
14120− "object-inspect": "^1.9.0"
14127+ "call-bind": "^1.0.7",
14128+ "es-errors": "^1.3.0",
14129+ "get-intrinsic": "^1.2.4",
14130+ "object-inspect": "^1.13.1"
14131+ },
14132+ "engines": {
14133+ "node": ">= 0.4"
1412114134 },
1412214135 "funding": {
1412314136 "url": "https://github.com/sponsors/ljharb"
@@ -14188,6 +14201,15 @@
1418814201 "node": ">=8"
1418914202 }
1419014203 },
14204+ "node_modules/snake-case": {
14205+ "version": "3.0.4",
14206+ "resolved": "https://registry.npmjs.org/snake-case/-/snake-case-3.0.4.tgz",
14207+ "integrity": "sha512-LAOh4z89bGQvl9pFfNF8V146i7o7/CqFPbqzYgP+yYzDIDeS9HaNFtXABamRW+AQzEVODcvE79ljJ+8a9YSdMg==",
14208+ "dependencies": {
14209+ "dot-case": "^3.0.4",
14210+ "tslib": "^2.0.3"
14211+ }
14212+ },
1419114213 "node_modules/sockjs": {
1419214214 "version": "0.3.24",
1419314215 "resolved": "https://registry.npmjs.org/sockjs/-/sockjs-0.3.24.tgz",
@@ -14199,9 +14221,9 @@
1419914221 }
1420014222 },
1420114223 "node_modules/sort-css-media-queries": {
14202− "version": "2.1.0",
14203− "resolved": "https://registry.npmjs.org/sort-css-media-queries/-/sort-css-media-queries-2.1.0.tgz",
14204− "integrity": "sha512-IeWvo8NkNiY2vVYdPa27MCQiR0MN0M80johAYFVxWWXQ44KU84WNxjslwBHmc/7ZL2ccwkM7/e6S5aiKZXm7jA==",
14224+ "version": "2.2.0",
14225+ "resolved": "https://registry.npmjs.org/sort-css-media-queries/-/sort-css-media-queries-2.2.0.tgz",
14226+ "integrity": "sha512-0xtkGhWCC9MGt/EzgnvbbbKhqWjl1+/rncmhTh5qCpbYguXh6S/qwePfv/JQ8jePXXmqingylxoC49pCkSPIbA==",
1420514227 "engines": {
1420614228 "node": ">= 6.3.0"
1420714229 }
@@ -14215,9 +14237,9 @@
1421514237 }
1421614238 },
1421714239 "node_modules/source-map-js": {
14218− "version": "1.0.2",
14219− "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
14220− "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==",
14240+ "version": "1.2.0",
14241+ "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.0.tgz",
14242+ "integrity": "sha512-itJW8lvSA0TXEphiRoawsCksnlf8SyvmFzIhltqAHluXd88pkCd+cXJVHTDwdCr0IzwptSm035IHQktUu1QUMg==",
1422114243 "engines": {
1422214244 "node": ">=0.10.0"
1422314245 }
@@ -14292,12 +14314,6 @@
1429214314 "url": "https://github.com/sponsors/sindresorhus"
1429314315 }
1429414316 },
14295− "node_modules/stable": {
14296− "version": "0.1.8",
14297− "resolved": "https://registry.npmjs.org/stable/-/stable-0.1.8.tgz",
14298− "integrity": "sha512-ji9qxRnOVfcuLDySj9qzhGSEFVobyt1kIOSkj1qZzYLzq7Tos/oUUWvotUPQLlrsidqsK6tBH89Bc9kL5zHA6w==",
14299− "deprecated": "Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility"
14300− },
1430114317 "node_modules/statuses": {
1430214318 "version": "2.0.1",
1430314319 "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
@@ -14433,18 +14449,18 @@
1443314449 }
1443414450 },
1443514451 "node_modules/stylehacks": {
14436− "version": "5.1.1",
14437− "resolved": "https://registry.npmjs.org/stylehacks/-/stylehacks-5.1.1.tgz",
14438− "integrity": "sha512-sBpcd5Hx7G6seo7b1LkpttvTz7ikD0LlH5RmdcBNb6fFR0Fl7LQwHDFr300q4cwUqi+IYrFGmsIHieMBfnN/Bw==",
14452+ "version": "6.1.1",
14453+ "resolved": "https://registry.npmjs.org/stylehacks/-/stylehacks-6.1.1.tgz",
14454+ "integrity": "sha512-gSTTEQ670cJNoaeIp9KX6lZmm8LJ3jPB5yJmX8Zq/wQxOsAFXV3qjWzHas3YYk1qesuVIyYWWUpZ0vSE/dTSGg==",
1443914455 "dependencies": {
14440− "browserslist": "^4.21.4",
14441− "postcss-selector-parser": "^6.0.4"
14456+ "browserslist": "^4.23.0",
14457+ "postcss-selector-parser": "^6.0.16"
1444214458 },
1444314459 "engines": {
14444− "node": "^10 || ^12 || >=14.0"
14460+ "node": "^14 || ^16 || >=18.0"
1444514461 },
1444614462 "peerDependencies": {
14447− "postcss": "^8.2.15"
14463+ "postcss": "^8.4.31"
1444814464 }
1444914465 },
1445014466 "node_modules/stylis": {
@@ -14480,23 +14496,27 @@
1448014496 "integrity": "sha512-e4hG1hRwoOdRb37cIMSgzNsxyzKfayW6VOflrwvR+/bzrkyxY/31WkbgnQpgtrNp1SdpJvpUAGTa/ZoiPNDuRQ=="
1448114497 },
1448214498 "node_modules/svgo": {
14483− "version": "2.8.0",
14484− "resolved": "https://registry.npmjs.org/svgo/-/svgo-2.8.0.tgz",
14485− "integrity": "sha512-+N/Q9kV1+F+UeWYoSiULYo4xYSDQlTgb+ayMobAXPwMnLvop7oxKMo9OzIrX5x3eS4L4f2UHhc9axXwY8DpChg==",
14499+ "version": "3.3.2",
14500+ "resolved": "https://registry.npmjs.org/svgo/-/svgo-3.3.2.tgz",
14501+ "integrity": "sha512-OoohrmuUlBs8B8o6MB2Aevn+pRIH9zDALSR+6hhqVfa6fRwG/Qw9VUMSMW9VNg2CFc/MTIfabtdOVl9ODIJjpw==",
1448614502 "dependencies": {
1448714503 "@trysound/sax": "0.2.0",
1448814504 "commander": "^7.2.0",
14489− "css-select": "^4.1.3",
14490− "css-tree": "^1.1.3",
14491− "csso": "^4.2.0",
14492− "picocolors": "^1.0.0",
14493− "stable": "^0.1.8"
14505+ "css-select": "^5.1.0",
14506+ "css-tree": "^2.3.1",
14507+ "css-what": "^6.1.0",
14508+ "csso": "^5.0.5",
14509+ "picocolors": "^1.0.0"
1449414510 },
1449514511 "bin": {
1449614512 "svgo": "bin/svgo"
1449714513 },
1449814514 "engines": {
14499− "node": ">=10.13.0"
14515+ "node": ">=14.0.0"
14516+ },
14517+ "funding": {
14518+ "type": "opencollective",
14519+ "url": "https://opencollective.com/svgo"
1450014520 }
1450114521 },
1450214522 "node_modules/svgo/node_modules/commander": {
@@ -14507,69 +14527,6 @@
1450714527 "node": ">= 10"
1450814528 }
1450914529 },
14510− "node_modules/svgo/node_modules/css-select": {
14511− "version": "4.3.0",
14512− "resolved": "https://registry.npmjs.org/css-select/-/css-select-4.3.0.tgz",
14513− "integrity": "sha512-wPpOYtnsVontu2mODhA19JrqWxNsfdatRKd64kmpRbQgh1KtItko5sTnEpPdpSaJszTOhEMlF/RPz28qj4HqhQ==",
14514− "dependencies": {
14515− "boolbase": "^1.0.0",
14516− "css-what": "^6.0.1",
14517− "domhandler": "^4.3.1",
14518− "domutils": "^2.8.0",
14519− "nth-check": "^2.0.1"
14520− },
14521− "funding": {
14522− "url": "https://github.com/sponsors/fb55"
14523− }
14524− },
14525− "node_modules/svgo/node_modules/dom-serializer": {
14526− "version": "1.4.1",
14527− "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-1.4.1.tgz",
14528− "integrity": "sha512-VHwB3KfrcOOkelEG2ZOfxqLZdfkil8PtJi4P8N2MMXucZq2yLp75ClViUlOVwyoHEDjYU433Aq+5zWP61+RGag==",
14529− "dependencies": {
14530− "domelementtype": "^2.0.1",
14531− "domhandler": "^4.2.0",
14532− "entities": "^2.0.0"
14533− },
14534− "funding": {
14535− "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
14536− }
14537− },
14538− "node_modules/svgo/node_modules/domhandler": {
14539− "version": "4.3.1",
14540− "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz",
14541− "integrity": "sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==",
14542− "dependencies": {
14543− "domelementtype": "^2.2.0"
14544− },
14545− "engines": {
14546− "node": ">= 4"
14547− },
14548− "funding": {
14549− "url": "https://github.com/fb55/domhandler?sponsor=1"
14550− }
14551− },
14552− "node_modules/svgo/node_modules/domutils": {
14553− "version": "2.8.0",
14554− "resolved": "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz",
14555− "integrity": "sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==",
14556− "dependencies": {
14557− "dom-serializer": "^1.0.1",
14558− "domelementtype": "^2.2.0",
14559− "domhandler": "^4.2.0"
14560− },
14561− "funding": {
14562− "url": "https://github.com/fb55/domutils?sponsor=1"
14563− }
14564− },
14565− "node_modules/svgo/node_modules/entities": {
14566− "version": "2.2.0",
14567− "resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
14568− "integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==",
14569− "funding": {
14570− "url": "https://github.com/fb55/entities?sponsor=1"
14571− }
14572− },
1457314530 "node_modules/tapable": {
1457414531 "version": "2.2.1",
1457514532 "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.1.tgz",
@@ -15471,9 +15428,9 @@
1547115428 }
1547215429 },
1547315430 "node_modules/webpack-dev-middleware": {
15474− "version": "5.3.3",
15475− "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.3.tgz",
15476− "integrity": "sha512-hj5CYrY0bZLB+eTO+x/j67Pkrquiy7kWepMHmUMoPsmcUaeEnQJqFzHJOyxgWlq746/wUuA64p9ta34Kyb01pA==",
15431+ "version": "5.3.4",
15432+ "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
15433+ "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
1547715434 "dependencies": {
1547815435 "colorette": "^2.0.10",
1547915436 "memfs": "^3.4.3",
docs/package.json+5−5
@@ -14,9 +14,9 @@
1414 "write-heading-ids": "docusaurus write-heading-ids"
1515 },
1616 "dependencies": {
17− "@docusaurus/core": "3.1.1",
18− "@docusaurus/preset-classic": "3.1.1",
19− "@docusaurus/theme-mermaid": "^3.1.0",
17+ "@docusaurus/core": "^3.3.2",
18+ "@docusaurus/preset-classic": "^3.3.2",
19+ "@docusaurus/theme-mermaid": "^3.3.2",
2020 "@easyops-cn/docusaurus-search-local": "^0.40.1",
2121 "@mdx-js/react": "^3.0.0",
2222 "clsx": "^2.0.0",
@@ -25,8 +25,8 @@
2525 "react-dom": "^18.0.0"
2626 },
2727 "devDependencies": {
28− "@docusaurus/module-type-aliases": "3.1.1",
29− "@docusaurus/types": "3.1.1"
28+ "@docusaurus/module-type-aliases": "^3.3.2",
29+ "@docusaurus/types": "^3.3.2"
3030 },
3131 "browserslist": {
3232 "production": [
docs/versioned_docs/version-7.0.x/configuration/overview.md+4−4
@@ -90,7 +90,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
9090| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
9191| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
9292| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
93−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
93+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
9494| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
9595| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
9696| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
@@ -189,12 +189,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
189189| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
190190| `--validate-url` | string | Access token validation endpoint | |
191191| `--version` | n/a | print version string | |
192−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;\[[2](#footnote2)\] | |
192+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;[^2] | |
193193| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
194194
195−\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
195+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
196196
197−\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
197+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
198198
199199See below for provider specific options
200200
docs/versioned_docs/version-7.1.x/configuration/overview.md+162−162
@@ -17,136 +17,136 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
1717
1818### Command Line Options
1919
20−| Option | Type | Description | Default |
21−| ------ | ---- | ----------- | ------- |
22−| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
23−| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
24−| `--auth-logging` | bool | Log authentication attempts | true |
25−| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
26−| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
27−| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
28−| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
29−| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
30−| `--client-secret` | string | the OAuth Client Secret | |
31−| `--client-secret-file` | string | the file with OAuth Client Secret | |
32−| `--config` | string | path to config file | |
33−| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
34−| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
35−| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
36−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
37−| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
38−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
39−| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
40−| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
41−| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
42−| `--custom-templates-dir` | string | path to custom html templates | |
43−| `--custom-sign-in-logo` | string | path to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
44−| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
45−| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
46−| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
47−| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
48−| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
49−| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
50−| `--force-https` | bool | enforce https redirect | `false` |
51−| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
52−| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
53−| `--github-org` | string | restrict logins to members of this organisation | |
54−| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
55−| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
56−| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
57−| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
58−| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
59−| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
60−| `--google-admin-email` | string | the google admin to impersonate for api calls | |
61−| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
62−| `--google-service-account-json` | string | the path to the service account json credentials | |
63−| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
64−| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
65−| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
66−| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
67−| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
68−| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
69−| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
70−| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
71−| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
72−| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
73−| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
74−| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
75−| `--login-url` | string | Authentication endpoint | |
76−| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
77−| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
78−| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
79−| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
80−| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
81−| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
82−| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
83−| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
84−| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
85−| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
86−| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
87−| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
88−| `--profile-url` | string | Profile access endpoint | |
89−| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
90−| `--provider` | string | OAuth provider | google |
91−| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
92−| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
93−| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
94−| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
95−| `--metrics-address` | string | the address /metrics will be served on | `""` |
96−| `--metrics-secure-address` | string | the address /metrics will be served on via HTTPS | `""` |
97−| `--metrics-tls-cert-file` | string | path to certificate file for secure metrics server | `""` |
98−| `--metrics-tls-key-file` | string | path to private key file for secure metrics server | `""` |
99−| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
100−| `--proxy-websockets` | bool | enables WebSocket proxying | true |
101−| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
102−| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
103−| `--redeem-url` | string | Token redemption endpoint | |
104−| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
105−| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
106−| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
107−| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
108−| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
109−| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
110−| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
111−| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
112−| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
113−| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
114−| `--request-logging` | bool | Log requests | true |
115−| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
116−| `--resource` | string | The resource that is protected (Azure AD only) | |
117−| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
118−| `--scope` | string | OAuth scope specification | |
119−| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
120−| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
121−| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
122−| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
123−| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
124−| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
125−| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
126−| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
127−| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
128−| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
129−| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
130−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
131−| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
132−| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
133−| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
134−| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
135−| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
136−| `--standard-logging` | bool | Log standard runtime information | true |
137−| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
138−| `--tls-cert-file` | string | path to certificate file | |
139−| `--tls-key-file` | string | path to private key file | |
140−| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
141−| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
142−| `--validate-url` | string | Access token validation endpoint | |
143−| `--version` | n/a | print version string | |
144−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;\[[2](#footnote2)\] | |
145−| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
146−
147−\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
148−
149−\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
20+| Option | Type | Description | Default |
21+| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
22+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
23+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
24+| `--auth-logging` | bool | Log authentication attempts | true |
25+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
26+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
27+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
28+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
29+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
30+| `--client-secret` | string | the OAuth Client Secret | |
31+| `--client-secret-file` | string | the file with OAuth Client Secret | |
32+| `--config` | string | path to config file | |
33+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
34+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
35+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
36+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
37+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
38+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
39+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
40+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
41+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
42+| `--custom-templates-dir` | string | path to custom html templates | |
43+| `--custom-sign-in-logo` | string | path to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
44+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
45+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
46+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
47+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
48+| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
49+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
50+| `--force-https` | bool | enforce https redirect | `false` |
51+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
52+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
53+| `--github-org` | string | restrict logins to members of this organisation | |
54+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
55+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
56+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
57+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
58+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
59+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
60+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
61+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
62+| `--google-service-account-json` | string | the path to the service account json credentials | |
63+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
64+| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
65+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
66+| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
67+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
68+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
69+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
70+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
71+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
72+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
73+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
74+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
75+| `--login-url` | string | Authentication endpoint | |
76+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
77+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
78+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
79+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
80+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
81+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
82+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
83+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
84+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
85+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
86+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
87+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
88+| `--profile-url` | string | Profile access endpoint | |
89+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
90+| `--provider` | string | OAuth provider | google |
91+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
92+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
93+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
94+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
95+| `--metrics-address` | string | the address /metrics will be served on | `""` |
96+| `--metrics-secure-address` | string | the address /metrics will be served on via HTTPS | `""` |
97+| `--metrics-tls-cert-file` | string | path to certificate file for secure metrics server | `""` |
98+| `--metrics-tls-key-file` | string | path to private key file for secure metrics server | `""` |
99+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
100+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
101+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
102+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
103+| `--redeem-url` | string | Token redemption endpoint | |
104+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
105+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
106+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
107+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
108+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
109+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
110+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
111+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
112+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
113+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
114+| `--request-logging` | bool | Log requests | true |
115+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
116+| `--resource` | string | The resource that is protected (Azure AD only) | |
117+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
118+| `--scope` | string | OAuth scope specification | |
119+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
120+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
121+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
122+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
123+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
124+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
125+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
126+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
127+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
128+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
129+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
130+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
131+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
132+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
133+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
134+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
135+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
136+| `--standard-logging` | bool | Log standard runtime information | true |
137+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
138+| `--tls-cert-file` | string | path to certificate file | |
139+| `--tls-key-file` | string | path to private key file | |
140+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
141+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
142+| `--validate-url` | string | Access token validation endpoint | |
143+| `--version` | n/a | print version string | |
144+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;[^2] | |
145+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
146+
147+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
148+
149+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
150150
151151See below for provider specific options
152152
@@ -205,18 +205,18 @@ The default format is configured as follows:
205205
206206Available variables for auth logging:
207207
208−| Variable | Example | Description |
209−| --- | --- | --- |
210−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
211−| Host | domain.com | The value of the Host header. |
212−| Message | Authenticated via OAuth2 | The details of the auth attempt. |
213−| Protocol | HTTP/1.0 | The request protocol. |
214−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
215−| RequestMethod | GET | The request method. |
216−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
217−| UserAgent | - | The full user agent as reported by the requesting client. |
218−| Username | username@email.com | The email or username of the auth request. |
219−| Status | AuthSuccess | The status of the auth request. See above for details. |
208+| Variable | Example | Description |
209+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
210+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
211+| Host | domain.com | The value of the Host header. |
212+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
213+| Protocol | HTTP/1.0 | The request protocol. |
214+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
215+| RequestMethod | GET | The request method. |
216+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
217+| UserAgent | - | The full user agent as reported by the requesting client. |
218+| Username | username@email.com | The email or username of the auth request. |
219+| Status | AuthSuccess | The status of the auth request. See above for details. |
220220
221221### Request Log Format
222222HTTP request logs will output by default in the below format:
@@ -234,21 +234,21 @@ The default format is configured as follows:
234234
235235Available variables for request logging:
236236
237−| Variable | Example | Description |
238−| --- | --- | --- |
239−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
240−| Host | domain.com | The value of the Host header. |
241−| Protocol | HTTP/1.0 | The request protocol. |
242−| RequestDuration | 0.001 | The time in seconds that a request took to process. |
243−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
244−| RequestMethod | GET | The request method. |
245−| RequestURI | "/oauth2/auth" | The URI path of the request. |
246−| ResponseSize | 12 | The size in bytes of the response. |
247−| StatusCode | 200 | The HTTP status code of the response. |
248−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
249−| Upstream | - | The upstream data of the HTTP request. |
250−| UserAgent | - | The full user agent as reported by the requesting client. |
251−| Username | username@email.com | The email or username of the auth request. |
237+| Variable | Example | Description |
238+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
239+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
240+| Host | domain.com | The value of the Host header. |
241+| Protocol | HTTP/1.0 | The request protocol. |
242+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
243+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
244+| RequestMethod | GET | The request method. |
245+| RequestURI | "/oauth2/auth" | The URI path of the request. |
246+| ResponseSize | 12 | The size in bytes of the response. |
247+| StatusCode | 200 | The HTTP status code of the response. |
248+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
249+| Upstream | - | The upstream data of the HTTP request. |
250+| UserAgent | - | The full user agent as reported by the requesting client. |
251+| Username | username@email.com | The email or username of the auth request. |
252252
253253### Standard Log Format
254254All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
@@ -265,11 +265,11 @@ If you require a different format than that, you can configure it with the `--st
265265
266266Available variables for standard logging:
267267
268−| Variable | Example | Description |
269−| --- | --- | --- |
270−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
271−| File | main.go:40 | The file and line number of the logging statement. |
272−| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
268+| Variable | Example | Description |
269+| --------- | --------------------------------- | -------------------------------------------------- |
270+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
271+| File | main.go:40 | The file and line number of the logging statement. |
272+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
273273
274274## Configuring for use with the Nginx `auth_request` directive
275275
docs/versioned_docs/version-7.2.x/configuration/overview.md+162−162
@@ -72,136 +72,136 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
7272
7373### Command Line Options
7474
75−| Option | Type | Description | Default |
76−| ------ | ---- | ----------- | ------- |
77−| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78−| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
79−| `--auth-logging` | bool | Log authentication attempts | true |
80−| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
81−| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
82−| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
83−| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
84−| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
85−| `--client-secret` | string | the OAuth Client Secret | |
86−| `--client-secret-file` | string | the file with OAuth Client Secret | |
87−| `--config` | string | path to config file | |
88−| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
89−| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
90−| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
91−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
92−| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
93−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
94−| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
95−| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
96−| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
97−| `--custom-templates-dir` | string | path to custom html templates | |
98−| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
99−| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
100−| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
101−| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
102−| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
103−| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
104−| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
105−| `--force-https` | bool | enforce https redirect | `false` |
106−| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
107−| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
108−| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
109−| `--github-org` | string | restrict logins to members of this organisation | |
110−| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
111−| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
112−| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
113−| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
114−| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
115−| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
116−| `--google-admin-email` | string | the google admin to impersonate for api calls | |
117−| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
118−| `--google-service-account-json` | string | the path to the service account json credentials | |
119−| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
120−| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
121−| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
122−| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
123−| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
124−| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
125−| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
126−| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
127−| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
128−| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
129−| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
130−| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
131−| `--login-url` | string | Authentication endpoint | |
132−| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
133−| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
134−| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
135−| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
136−| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
137−| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
138−| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
139−| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
140−| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
141−| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
142−| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
143−| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
144−| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
145−| `--profile-url` | string | Profile access endpoint | |
146−| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
147−| `--provider` | string | OAuth provider | google |
148−| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
149−| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
150−| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
151−| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
152−| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
153−| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
154−| `--proxy-websockets` | bool | enables WebSocket proxying | true |
155−| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
156−| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
157−| `--redeem-url` | string | Token redemption endpoint | |
158−| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
159−| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
160−| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
161−| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
162−| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
163−| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
164−| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
165−| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
166−| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
167−| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
168−| `--request-logging` | bool | Log requests | true |
169−| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
170−| `--resource` | string | The resource that is protected (Azure AD only) | |
171−| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
172−| `--scope` | string | OAuth scope specification | |
173−| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
174−| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
175−| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
176−| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
177−| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
178−| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
179−| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
180−| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
181−| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
182−| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
183−| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
184−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
185−| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
186−| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
187−| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
188−| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
189−| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
190−| `--standard-logging` | bool | Log standard runtime information | true |
191−| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
192−| `--tls-cert-file` | string | path to certificate file | |
193−| `--tls-key-file` | string | path to private key file | |
194−| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
195−| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
196−| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
197−| `--validate-url` | string | Access token validation endpoint | |
198−| `--version` | n/a | print version string | |
199−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;\[[2](#footnote2)\] | |
200−| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
201−
202−\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
203−
204−\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
75+| Option | Type | Description | Default |
76+| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
77+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
79+| `--auth-logging` | bool | Log authentication attempts | true |
80+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
81+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
82+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
83+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
84+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
85+| `--client-secret` | string | the OAuth Client Secret | |
86+| `--client-secret-file` | string | the file with OAuth Client Secret | |
87+| `--config` | string | path to config file | |
88+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
89+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
90+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
91+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
92+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
93+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
94+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
95+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
96+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
97+| `--custom-templates-dir` | string | path to custom html templates | |
98+| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
99+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
100+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
101+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
102+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
103+| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
104+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
105+| `--force-https` | bool | enforce https redirect | `false` |
106+| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
107+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
108+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
109+| `--github-org` | string | restrict logins to members of this organisation | |
110+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
111+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
112+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
113+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
114+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
115+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
116+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
117+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
118+| `--google-service-account-json` | string | the path to the service account json credentials | |
119+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
120+| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
121+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
122+| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
123+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
124+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
125+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
126+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
127+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
128+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
129+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
130+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
131+| `--login-url` | string | Authentication endpoint | |
132+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
133+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
134+| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
135+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
136+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
137+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
138+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
139+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
140+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
141+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
142+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
143+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
144+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
145+| `--profile-url` | string | Profile access endpoint | |
146+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
147+| `--provider` | string | OAuth provider | google |
148+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
149+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
150+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
151+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
152+| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
153+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
154+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
155+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
156+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
157+| `--redeem-url` | string | Token redemption endpoint | |
158+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
159+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
160+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
161+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
162+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
163+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
164+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
165+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
166+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
167+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
168+| `--request-logging` | bool | Log requests | true |
169+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
170+| `--resource` | string | The resource that is protected (Azure AD only) | |
171+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
172+| `--scope` | string | OAuth scope specification | |
173+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
174+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
175+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
176+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
177+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
178+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
179+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
180+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
181+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
182+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
183+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
184+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
185+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
186+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
187+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
188+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
189+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
190+| `--standard-logging` | bool | Log standard runtime information | true |
191+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
192+| `--tls-cert-file` | string | path to certificate file | |
193+| `--tls-key-file` | string | path to private key file | |
194+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
195+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
196+| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
197+| `--validate-url` | string | Access token validation endpoint | |
198+| `--version` | n/a | print version string | |
199+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;[^2] | |
200+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
201+
202+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
203+
204+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
205205
206206See below for provider specific options
207207
@@ -260,18 +260,18 @@ The default format is configured as follows:
260260
261261Available variables for auth logging:
262262
263−| Variable | Example | Description |
264−| --- | --- | --- |
265−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
266−| Host | domain.com | The value of the Host header. |
267−| Message | Authenticated via OAuth2 | The details of the auth attempt. |
268−| Protocol | HTTP/1.0 | The request protocol. |
269−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
270−| RequestMethod | GET | The request method. |
271−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
272−| UserAgent | - | The full user agent as reported by the requesting client. |
273−| Username | username@email.com | The email or username of the auth request. |
274−| Status | AuthSuccess | The status of the auth request. See above for details. |
263+| Variable | Example | Description |
264+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
265+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
266+| Host | domain.com | The value of the Host header. |
267+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
268+| Protocol | HTTP/1.0 | The request protocol. |
269+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
270+| RequestMethod | GET | The request method. |
271+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
272+| UserAgent | - | The full user agent as reported by the requesting client. |
273+| Username | username@email.com | The email or username of the auth request. |
274+| Status | AuthSuccess | The status of the auth request. See above for details. |
275275
276276### Request Log Format
277277HTTP request logs will output by default in the below format:
@@ -289,21 +289,21 @@ The default format is configured as follows:
289289
290290Available variables for request logging:
291291
292−| Variable | Example | Description |
293−| --- | --- | --- |
294−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
295−| Host | domain.com | The value of the Host header. |
296−| Protocol | HTTP/1.0 | The request protocol. |
297−| RequestDuration | 0.001 | The time in seconds that a request took to process. |
298−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
299−| RequestMethod | GET | The request method. |
300−| RequestURI | "/oauth2/auth" | The URI path of the request. |
301−| ResponseSize | 12 | The size in bytes of the response. |
302−| StatusCode | 200 | The HTTP status code of the response. |
303−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
304−| Upstream | - | The upstream data of the HTTP request. |
305−| UserAgent | - | The full user agent as reported by the requesting client. |
306−| Username | username@email.com | The email or username of the auth request. |
292+| Variable | Example | Description |
293+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
294+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
295+| Host | domain.com | The value of the Host header. |
296+| Protocol | HTTP/1.0 | The request protocol. |
297+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
298+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
299+| RequestMethod | GET | The request method. |
300+| RequestURI | "/oauth2/auth" | The URI path of the request. |
301+| ResponseSize | 12 | The size in bytes of the response. |
302+| StatusCode | 200 | The HTTP status code of the response. |
303+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
304+| Upstream | - | The upstream data of the HTTP request. |
305+| UserAgent | - | The full user agent as reported by the requesting client. |
306+| Username | username@email.com | The email or username of the auth request. |
307307
308308### Standard Log Format
309309All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
@@ -320,11 +320,11 @@ If you require a different format than that, you can configure it with the `--st
320320
321321Available variables for standard logging:
322322
323−| Variable | Example | Description |
324−| --- | --- | --- |
325−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
326−| File | main.go:40 | The file and line number of the logging statement. |
327−| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
323+| Variable | Example | Description |
324+| --------- | --------------------------------- | -------------------------------------------------- |
325+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
326+| File | main.go:40 | The file and line number of the logging statement. |
327+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
328328
329329## Configuring for use with the Nginx `auth_request` directive
330330
docs/versioned_docs/version-7.3.x/configuration/overview.md+167−167
@@ -72,141 +72,141 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
7272
7373### Command Line Options
7474
75−| Option | Type | Description | Default |
76−| ------ | ---- | ----------- | ------- |
77−| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78−| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
79−| `--auth-logging` | bool | Log authentication attempts | true |
80−| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
81−| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
82−| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
83−| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
84−| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
85−| `--client-secret` | string | the OAuth Client Secret | |
86−| `--client-secret-file` | string | the file with OAuth Client Secret | |
87−| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
88−| `--config` | string | path to config file | |
89−| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
90−| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
91−| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
92−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
93−| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
94−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
95−| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
96−| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
97−| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
98−| `--custom-templates-dir` | string | path to custom html templates | |
99−| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
100−| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
101−| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
102−| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
103−| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
104−| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
105−| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
106−| `--force-https` | bool | enforce https redirect | `false` |
107−| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
108−| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
109−| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
110−| `--github-org` | string | restrict logins to members of this organisation | |
111−| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
112−| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
113−| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
114−| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
115−| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
116−| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
117−| `--google-admin-email` | string | the google admin to impersonate for api calls | |
118−| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
119−| `--google-service-account-json` | string | the path to the service account json credentials | |
120−| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
121−| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
122−| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
123−| `--https-address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
124−| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
125−| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
126−| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
127−| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
128−| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
129−| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
130−| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
131−| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
132−| `--login-url` | string | Authentication endpoint | |
133−| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
134−| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
135−| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
136−| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
137−| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
138−| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
139−| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
140−| `--oidc-audience-claim` | string | which OIDC claim contains the audience | `"aud"` |
141−| `--oidc-extra-audience` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
142−| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
143−| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
144−| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
145−| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
146−| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
147−| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
148−| `--profile-url` | string | Profile access endpoint | |
149−| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
150−| `--provider` | string | OAuth provider | google |
151−| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
152−| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
153−| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
154−| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
155−| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
156−| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
157−| `--proxy-websockets` | bool | enables WebSocket proxying | true |
158−| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
159−| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
160−| `--redeem-url` | string | Token redemption endpoint | |
161−| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
162−| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
163−| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
164−| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
165−| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
166−| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
167−| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
168−| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
169−| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
170−| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
171−| `--request-logging` | bool | Log requests | true |
172−| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
173−| `--resource` | string | The resource that is protected (Azure AD only) | |
174−| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
175−| `--scope` | string | OAuth scope specification | |
176−| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
177−| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
178−| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
179−| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
180−| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
181−| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
182−| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
183−| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
184−| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
185−| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
186−| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
187−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
188−| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
189−| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
190−| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
191−| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
192−| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
193−| `--standard-logging` | bool | Log standard runtime information | true |
194−| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
195−| `--tls-cert-file` | string | path to certificate file | |
196−| `--tls-key-file` | string | path to private key file | |
197−| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
198−| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
199−| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
200−| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
201−| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
202−| `--validate-url` | string | Access token validation endpoint | |
203−| `--version` | n/a | print version string | |
204−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;\[[2](#footnote2)\] | |
205−| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
206−
207−\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
208−
209−\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
75+| Option | Type | Description | Default |
76+| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
77+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
79+| `--auth-logging` | bool | Log authentication attempts | true |
80+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
81+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
82+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
83+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
84+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
85+| `--client-secret` | string | the OAuth Client Secret | |
86+| `--client-secret-file` | string | the file with OAuth Client Secret | |
87+| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
88+| `--config` | string | path to config file | |
89+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
90+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
91+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
92+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
93+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
94+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
95+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
96+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
97+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
98+| `--custom-templates-dir` | string | path to custom html templates | |
99+| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
100+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
101+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
102+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
103+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
104+| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
105+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
106+| `--force-https` | bool | enforce https redirect | `false` |
107+| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
108+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
109+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
110+| `--github-org` | string | restrict logins to members of this organisation | |
111+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
112+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
113+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
114+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
115+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
116+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
117+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
118+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
119+| `--google-service-account-json` | string | the path to the service account json credentials | |
120+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
121+| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
122+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
123+| `--https-address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
124+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
125+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
126+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
127+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
128+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
129+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
130+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
131+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
132+| `--login-url` | string | Authentication endpoint | |
133+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
134+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
135+| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
136+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
137+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
138+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
139+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
140+| `--oidc-audience-claim` | string | which OIDC claim contains the audience | `"aud"` |
141+| `--oidc-extra-audience` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
142+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
143+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
144+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
145+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
146+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
147+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
148+| `--profile-url` | string | Profile access endpoint | |
149+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
150+| `--provider` | string | OAuth provider | google |
151+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
152+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
153+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
154+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
155+| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
156+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
157+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
158+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
159+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
160+| `--redeem-url` | string | Token redemption endpoint | |
161+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
162+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
163+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
164+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
165+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
166+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
167+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
168+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
169+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
170+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
171+| `--request-logging` | bool | Log requests | true |
172+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
173+| `--resource` | string | The resource that is protected (Azure AD only) | |
174+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
175+| `--scope` | string | OAuth scope specification | |
176+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
177+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
178+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
179+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
180+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
181+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
182+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
183+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
184+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
185+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
186+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
187+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
188+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
189+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
190+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
191+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
192+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
193+| `--standard-logging` | bool | Log standard runtime information | true |
194+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
195+| `--tls-cert-file` | string | path to certificate file | |
196+| `--tls-key-file` | string | path to private key file | |
197+| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
198+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
199+| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
200+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
201+| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
202+| `--validate-url` | string | Access token validation endpoint | |
203+| `--version` | n/a | print version string | |
204+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;[^2] | |
205+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
206+
207+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
208+
209+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
210210
211211See below for provider specific options
212212
@@ -265,18 +265,18 @@ The default format is configured as follows:
265265
266266Available variables for auth logging:
267267
268−| Variable | Example | Description |
269−| --- | --- | --- |
270−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
271−| Host | domain.com | The value of the Host header. |
272−| Message | Authenticated via OAuth2 | The details of the auth attempt. |
273−| Protocol | HTTP/1.0 | The request protocol. |
274−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
275−| RequestMethod | GET | The request method. |
276−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
277−| UserAgent | - | The full user agent as reported by the requesting client. |
278−| Username | username@email.com | The email or username of the auth request. |
279−| Status | AuthSuccess | The status of the auth request. See above for details. |
268+| Variable | Example | Description |
269+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
270+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
271+| Host | domain.com | The value of the Host header. |
272+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
273+| Protocol | HTTP/1.0 | The request protocol. |
274+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
275+| RequestMethod | GET | The request method. |
276+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
277+| UserAgent | - | The full user agent as reported by the requesting client. |
278+| Username | username@email.com | The email or username of the auth request. |
279+| Status | AuthSuccess | The status of the auth request. See above for details. |
280280
281281### Request Log Format
282282HTTP request logs will output by default in the below format:
@@ -294,21 +294,21 @@ The default format is configured as follows:
294294
295295Available variables for request logging:
296296
297−| Variable | Example | Description |
298−| --- | --- | --- |
299−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
300−| Host | domain.com | The value of the Host header. |
301−| Protocol | HTTP/1.0 | The request protocol. |
302−| RequestDuration | 0.001 | The time in seconds that a request took to process. |
303−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
304−| RequestMethod | GET | The request method. |
305−| RequestURI | "/oauth2/auth" | The URI path of the request. |
306−| ResponseSize | 12 | The size in bytes of the response. |
307−| StatusCode | 200 | The HTTP status code of the response. |
308−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
309−| Upstream | - | The upstream data of the HTTP request. |
310−| UserAgent | - | The full user agent as reported by the requesting client. |
311−| Username | username@email.com | The email or username of the auth request. |
297+| Variable | Example | Description |
298+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
299+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
300+| Host | domain.com | The value of the Host header. |
301+| Protocol | HTTP/1.0 | The request protocol. |
302+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
303+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
304+| RequestMethod | GET | The request method. |
305+| RequestURI | "/oauth2/auth" | The URI path of the request. |
306+| ResponseSize | 12 | The size in bytes of the response. |
307+| StatusCode | 200 | The HTTP status code of the response. |
308+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
309+| Upstream | - | The upstream data of the HTTP request. |
310+| UserAgent | - | The full user agent as reported by the requesting client. |
311+| Username | username@email.com | The email or username of the auth request. |
312312
313313### Standard Log Format
314314All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
@@ -325,11 +325,11 @@ If you require a different format than that, you can configure it with the `--st
325325
326326Available variables for standard logging:
327327
328−| Variable | Example | Description |
329−| --- | --- | --- |
330−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
331−| File | main.go:40 | The file and line number of the logging statement. |
332−| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
328+| Variable | Example | Description |
329+| --------- | --------------------------------- | -------------------------------------------------- |
330+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
331+| File | main.go:40 | The file and line number of the logging statement. |
332+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
333333
334334## Configuring for use with the Nginx `auth_request` directive
335335
docs/versioned_docs/version-7.4.x/configuration/overview.md+172−172
@@ -72,146 +72,146 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
7272
7373### Command Line Options
7474
75−| Option | Type | Description | Default |
76−| ------ | ---- | ----------- | ------- |
77−| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78−| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
79−| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
80−| `--auth-logging` | bool | Log authentication attempts | true |
81−| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
82−| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
83−| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
84−| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
85−| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86−| `--client-secret` | string | the OAuth Client Secret | |
87−| `--client-secret-file` | string | the file with OAuth Client Secret | |
88−| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89−| `--config` | string | path to config file | |
90−| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
91−| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
92−| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
93−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
94−| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
95−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
96−| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
97−| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
98−| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
99−| `--cookie-csrf-per-request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
100−| `--cookie-csrf-expire` | duration | expire timeframe for CSRF cookie | 15m |
101−| `--custom-templates-dir` | string | path to custom html templates | |
102−| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
103−| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
104−| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
105−| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
106−| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
107−| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
108−| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
109−| `--force-https` | bool | enforce https redirect | `false` |
110−| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
111−| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
112−| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
113−| `--github-org` | string | restrict logins to members of this organisation | |
114−| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
115−| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
116−| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
117−| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
118−| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
119−| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
120−| `--google-admin-email` | string | the google admin to impersonate for api calls | |
121−| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
122−| `--google-service-account-json` | string | the path to the service account json credentials | |
123−| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
124−| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
125−| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
126−| `--https-address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
127−| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
128−| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
129−| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
130−| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
131−| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
132−| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
133−| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
134−| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
135−| `--login-url` | string | Authentication endpoint | |
136−| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
137−| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
138−| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
139−| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
140−| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
141−| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
142−| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
143−| `--oidc-audience-claim` | string | which OIDC claim contains the audience | `"aud"` |
144−| `--oidc-extra-audience` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
145−| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
146−| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
147−| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
148−| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
149−| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
150−| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
151−| `--profile-url` | string | Profile access endpoint | |
152−| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
153−| `--provider` | string | OAuth provider | google |
154−| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
155−| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
156−| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
157−| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
158−| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
159−| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
160−| `--proxy-websockets` | bool | enables WebSocket proxying | true |
161−| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
162−| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
163−| `--redeem-url` | string | Token redemption endpoint | |
164−| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
165−| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
166−| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
167−| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
168−| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
169−| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
170−| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
171−| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
172−| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
173−| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Exmpale: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
174−| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
175−| `--request-logging` | bool | Log requests | true |
176−| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
177−| `--resource` | string | The resource that is protected (Azure AD only) | |
178−| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
179−| `--scope` | string | OAuth scope specification | |
180−| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
181−| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
182−| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
183−| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
184−| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
185−| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
186−| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
187−| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
188−| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
189−| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
190−| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
191−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
192−| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
193−| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
194−| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
195−| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
196−| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
197−| `--standard-logging` | bool | Log standard runtime information | true |
198−| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
199−| `--tls-cert-file` | string | path to certificate file | |
200−| `--tls-cipher-suite` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
201−| `--tls-key-file` | string | path to private key file | |
202−| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
203−| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
204−| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
205−| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
206−| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
207−| `--validate-url` | string | Access token validation endpoint | |
208−| `--version` | n/a | print version string | |
209−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;\[[2](#footnote2)\] | |
210−| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
211−
212−\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
213−
214−\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
75+| Option | Type | Description | Default |
76+| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
77+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78+| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
79+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
80+| `--auth-logging` | bool | Log authentication attempts | true |
81+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
82+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
83+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
84+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
85+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86+| `--client-secret` | string | the OAuth Client Secret | |
87+| `--client-secret-file` | string | the file with OAuth Client Secret | |
88+| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89+| `--config` | string | path to config file | |
90+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
91+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
92+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
93+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
94+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
95+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
96+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
97+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
98+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
99+| `--cookie-csrf-per-request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
100+| `--cookie-csrf-expire` | duration | expire timeframe for CSRF cookie | 15m |
101+| `--custom-templates-dir` | string | path to custom html templates | |
102+| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
103+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
104+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
105+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
106+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
107+| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
108+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
109+| `--force-https` | bool | enforce https redirect | `false` |
110+| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
111+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
112+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
113+| `--github-org` | string | restrict logins to members of this organisation | |
114+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
115+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
116+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
117+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
118+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
119+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
120+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
121+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
122+| `--google-service-account-json` | string | the path to the service account json credentials | |
123+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
124+| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
125+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
126+| `--https-address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
127+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
128+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
129+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
130+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
131+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
132+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
133+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
134+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
135+| `--login-url` | string | Authentication endpoint | |
136+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
137+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
138+| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
139+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
140+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
141+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
142+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
143+| `--oidc-audience-claim` | string | which OIDC claim contains the audience | `"aud"` |
144+| `--oidc-extra-audience` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
145+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
146+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
147+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
148+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
149+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
150+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
151+| `--profile-url` | string | Profile access endpoint | |
152+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
153+| `--provider` | string | OAuth provider | google |
154+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
155+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
156+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
157+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
158+| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
159+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
160+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
161+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
162+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
163+| `--redeem-url` | string | Token redemption endpoint | |
164+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
165+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
166+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
167+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
168+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
169+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
170+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
171+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
172+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
173+| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Exmpale: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
174+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
175+| `--request-logging` | bool | Log requests | true |
176+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
177+| `--resource` | string | The resource that is protected (Azure AD only) | |
178+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
179+| `--scope` | string | OAuth scope specification | |
180+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
181+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
182+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
183+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
184+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
185+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
186+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
187+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
188+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
189+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
190+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
191+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
192+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
193+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
194+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
195+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
196+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
197+| `--standard-logging` | bool | Log standard runtime information | true |
198+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
199+| `--tls-cert-file` | string | path to certificate file | |
200+| `--tls-cipher-suite` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
201+| `--tls-key-file` | string | path to private key file | |
202+| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
203+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
204+| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
205+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
206+| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
207+| `--validate-url` | string | Access token validation endpoint | |
208+| `--version` | n/a | print version string | |
209+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;[^2] | |
210+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
211+
212+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
213+
214+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
215215
216216See below for provider specific options
217217
@@ -270,18 +270,18 @@ The default format is configured as follows:
270270
271271Available variables for auth logging:
272272
273−| Variable | Example | Description |
274−| --- | --- | --- |
275−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
276−| Host | domain.com | The value of the Host header. |
277−| Message | Authenticated via OAuth2 | The details of the auth attempt. |
278−| Protocol | HTTP/1.0 | The request protocol. |
279−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
280−| RequestMethod | GET | The request method. |
281−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
282−| UserAgent | - | The full user agent as reported by the requesting client. |
283−| Username | username@email.com | The email or username of the auth request. |
284−| Status | AuthSuccess | The status of the auth request. See above for details. |
273+| Variable | Example | Description |
274+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
275+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
276+| Host | domain.com | The value of the Host header. |
277+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
278+| Protocol | HTTP/1.0 | The request protocol. |
279+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
280+| RequestMethod | GET | The request method. |
281+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
282+| UserAgent | - | The full user agent as reported by the requesting client. |
283+| Username | username@email.com | The email or username of the auth request. |
284+| Status | AuthSuccess | The status of the auth request. See above for details. |
285285
286286### Request Log Format
287287HTTP request logs will output by default in the below format:
@@ -299,21 +299,21 @@ The default format is configured as follows:
299299
300300Available variables for request logging:
301301
302−| Variable | Example | Description |
303−| --- | --- | --- |
304−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
305−| Host | domain.com | The value of the Host header. |
306−| Protocol | HTTP/1.0 | The request protocol. |
307−| RequestDuration | 0.001 | The time in seconds that a request took to process. |
308−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
309−| RequestMethod | GET | The request method. |
310−| RequestURI | "/oauth2/auth" | The URI path of the request. |
311−| ResponseSize | 12 | The size in bytes of the response. |
312−| StatusCode | 200 | The HTTP status code of the response. |
313−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
314−| Upstream | - | The upstream data of the HTTP request. |
315−| UserAgent | - | The full user agent as reported by the requesting client. |
316−| Username | username@email.com | The email or username of the auth request. |
302+| Variable | Example | Description |
303+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
304+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
305+| Host | domain.com | The value of the Host header. |
306+| Protocol | HTTP/1.0 | The request protocol. |
307+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
308+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
309+| RequestMethod | GET | The request method. |
310+| RequestURI | "/oauth2/auth" | The URI path of the request. |
311+| ResponseSize | 12 | The size in bytes of the response. |
312+| StatusCode | 200 | The HTTP status code of the response. |
313+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
314+| Upstream | - | The upstream data of the HTTP request. |
315+| UserAgent | - | The full user agent as reported by the requesting client. |
316+| Username | username@email.com | The email or username of the auth request. |
317317
318318### Standard Log Format
319319All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
@@ -330,11 +330,11 @@ If you require a different format than that, you can configure it with the `--st
330330
331331Available variables for standard logging:
332332
333−| Variable | Example | Description |
334−| --- | --- | --- |
335−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
336−| File | main.go:40 | The file and line number of the logging statement. |
337−| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
333+| Variable | Example | Description |
334+| --------- | --------------------------------- | -------------------------------------------------- |
335+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
336+| File | main.go:40 | The file and line number of the logging statement. |
337+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
338338
339339## Configuring for use with the Nginx `auth_request` directive
340340
docs/versioned_docs/version-7.5.x/configuration/overview.md+175−175
@@ -72,149 +72,149 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
7272
7373### Command Line Options
7474
75−| Option | Type | Description | Default |
76−| ------ | ---- | ----------- | ------- |
77−| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78−| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
79−| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
80−| `--auth-logging` | bool | Log authentication attempts | true |
81−| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
82−| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
83−| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
84−| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
85−| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86−| `--client-secret` | string | the OAuth Client Secret | |
87−| `--client-secret-file` | string | the file with OAuth Client Secret | |
88−| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89−| `--config` | string | path to config file | |
90−| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
91−| `--cookie-expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
92−| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
93−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
94−| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
95−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
96−| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
97−| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
98−| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
99−| `--cookie-csrf-per-request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
100−| `--cookie-csrf-expire` | duration | expire timeframe for CSRF cookie | 15m |
101−| `--custom-templates-dir` | string | path to custom html templates | |
102−| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. |
103−| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
104−| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
105−| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
106−| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
107−| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
108−| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
109−| `--force-https` | bool | enforce https redirect | `false` |
110−| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
111−| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
112−| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
113−| `--github-org` | string | restrict logins to members of this organisation | |
114−| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
115−| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
116−| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
117−| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
118−| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
119−| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
120−| `--google-admin-email` | string | the google admin to impersonate for api calls | |
121−| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
122−| `--google-service-account-json` | string | the path to the service account json credentials | |
123−| `--google-use-application-default-credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
124−| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
125−| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
126−| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
127−| `--https-address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
128−| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
129−| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
130−| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
131−| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
132−| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
133−| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
134−| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
135−| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
136−| `--login-url` | string | Authentication endpoint | |
137−| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
138−| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
139−| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
140−| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
141−| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
142−| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
143−| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
144−| `--oidc-audience-claim` | string | which OIDC claim contains the audience | `"aud"` |
145−| `--oidc-extra-audience` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
146−| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
147−| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
148−| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
149−| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
150−| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
151−| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
152−| `--profile-url` | string | Profile access endpoint | |
153−| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
154−| `--provider` | string | OAuth provider | google |
155−| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
156−| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
157−| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
158−| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
159−| `--ready-path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
160−| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
161−| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
162−| `--proxy-websockets` | bool | enables WebSocket proxying | true |
163−| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
164−| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
165−| `--redeem-url` | string | Token redemption endpoint | |
166−| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
167−| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
168−| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
169−| `--redis-insecure-skip-tls-verify` | bool | skip TLS verification when connecting to Redis | false |
170−| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
171−| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
172−| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
173−| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
174−| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
175−| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
176−| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Exmpale: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
177−| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
178−| `--request-logging` | bool | Log requests | true |
179−| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
180−| `--resource` | string | The resource that is protected (Azure AD only) | |
181−| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
182−| `--scope` | string | OAuth scope specification | |
183−| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
184−| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
185−| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
186−| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
187−| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
188−| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
189−| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
190−| `--silence-ping-logging` | bool | disable logging of requests to ping & ready endpoints | false |
191−| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
192−| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
193−| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
194−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
195−| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
196−| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
197−| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
198−| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
199−| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
200−| `--standard-logging` | bool | Log standard runtime information | true |
201−| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
202−| `--tls-cert-file` | string | path to certificate file | |
203−| `--tls-cipher-suite` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
204−| `--tls-key-file` | string | path to private key file | |
205−| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
206−| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
207−| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
208−| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
209−| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
210−| `--validate-url` | string | Access token validation endpoint | |
211−| `--version` | n/a | print version string | |
212−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;\[[2](#footnote2)\] | |
213−| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
214−
215−\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
216−
217−\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
75+| Option | Type | Description | Default |
76+| ---------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
77+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78+| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
79+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
80+| `--auth-logging` | bool | Log authentication attempts | true |
81+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
82+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
83+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
84+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
85+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86+| `--client-secret` | string | the OAuth Client Secret | |
87+| `--client-secret-file` | string | the file with OAuth Client Secret | |
88+| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89+| `--config` | string | path to config file | |
90+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
91+| `--cookie-expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
92+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
93+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
94+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
95+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
96+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
97+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
98+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
99+| `--cookie-csrf-per-request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
100+| `--cookie-csrf-expire` | duration | expire timeframe for CSRF cookie | 15m |
101+| `--custom-templates-dir` | string | path to custom html templates | |
102+| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. |
103+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
104+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
105+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
106+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
107+| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
108+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
109+| `--force-https` | bool | enforce https redirect | `false` |
110+| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
111+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
112+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
113+| `--github-org` | string | restrict logins to members of this organisation | |
114+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
115+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
116+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
117+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
118+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
119+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
120+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
121+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
122+| `--google-service-account-json` | string | the path to the service account json credentials | |
123+| `--google-use-application-default-credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
124+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
125+| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
126+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
127+| `--https-address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
128+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
129+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
130+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
131+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
132+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
133+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
134+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
135+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
136+| `--login-url` | string | Authentication endpoint | |
137+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
138+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
139+| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
140+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
141+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
142+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
143+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
144+| `--oidc-audience-claim` | string | which OIDC claim contains the audience | `"aud"` |
145+| `--oidc-extra-audience` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
146+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
147+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
148+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
149+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
150+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
151+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
152+| `--profile-url` | string | Profile access endpoint | |
153+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
154+| `--provider` | string | OAuth provider | google |
155+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
156+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
157+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
158+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
159+| `--ready-path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
160+| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
161+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
162+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
163+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
164+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
165+| `--redeem-url` | string | Token redemption endpoint | |
166+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
167+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
168+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
169+| `--redis-insecure-skip-tls-verify` | bool | skip TLS verification when connecting to Redis | false |
170+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
171+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
172+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
173+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
174+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
175+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
176+| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Exmpale: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
177+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
178+| `--request-logging` | bool | Log requests | true |
179+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
180+| `--resource` | string | The resource that is protected (Azure AD only) | |
181+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
182+| `--scope` | string | OAuth scope specification | |
183+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
184+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
185+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
186+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
187+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
188+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
189+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
190+| `--silence-ping-logging` | bool | disable logging of requests to ping & ready endpoints | false |
191+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
192+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
193+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
194+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
195+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
196+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
197+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
198+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
199+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
200+| `--standard-logging` | bool | Log standard runtime information | true |
201+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
202+| `--tls-cert-file` | string | path to certificate file | |
203+| `--tls-cipher-suite` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
204+| `--tls-key-file` | string | path to private key file | |
205+| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
206+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
207+| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
208+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
209+| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
210+| `--validate-url` | string | Access token validation endpoint | |
211+| `--version` | n/a | print version string | |
212+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;[^2] | |
213+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
214+
215+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
216+
217+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
218218
219219See below for provider specific options
220220
@@ -273,18 +273,18 @@ The default format is configured as follows:
273273
274274Available variables for auth logging:
275275
276−| Variable | Example | Description |
277−| --- | --- | --- |
278−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
279−| Host | domain.com | The value of the Host header. |
280−| Message | Authenticated via OAuth2 | The details of the auth attempt. |
281−| Protocol | HTTP/1.0 | The request protocol. |
282−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
283−| RequestMethod | GET | The request method. |
284−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
285−| UserAgent | - | The full user agent as reported by the requesting client. |
286−| Username | username@email.com | The email or username of the auth request. |
287−| Status | AuthSuccess | The status of the auth request. See above for details. |
276+| Variable | Example | Description |
277+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
278+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
279+| Host | domain.com | The value of the Host header. |
280+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
281+| Protocol | HTTP/1.0 | The request protocol. |
282+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
283+| RequestMethod | GET | The request method. |
284+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
285+| UserAgent | - | The full user agent as reported by the requesting client. |
286+| Username | username@email.com | The email or username of the auth request. |
287+| Status | AuthSuccess | The status of the auth request. See above for details. |
288288
289289### Request Log Format
290290HTTP request logs will output by default in the below format:
@@ -302,21 +302,21 @@ The default format is configured as follows:
302302
303303Available variables for request logging:
304304
305−| Variable | Example | Description |
306−| --- | --- | --- |
307−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
308−| Host | domain.com | The value of the Host header. |
309−| Protocol | HTTP/1.0 | The request protocol. |
310−| RequestDuration | 0.001 | The time in seconds that a request took to process. |
311−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
312−| RequestMethod | GET | The request method. |
313−| RequestURI | "/oauth2/auth" | The URI path of the request. |
314−| ResponseSize | 12 | The size in bytes of the response. |
315−| StatusCode | 200 | The HTTP status code of the response. |
316−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
317−| Upstream | - | The upstream data of the HTTP request. |
318−| UserAgent | - | The full user agent as reported by the requesting client. |
319−| Username | username@email.com | The email or username of the auth request. |
305+| Variable | Example | Description |
306+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
307+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
308+| Host | domain.com | The value of the Host header. |
309+| Protocol | HTTP/1.0 | The request protocol. |
310+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
311+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
312+| RequestMethod | GET | The request method. |
313+| RequestURI | "/oauth2/auth" | The URI path of the request. |
314+| ResponseSize | 12 | The size in bytes of the response. |
315+| StatusCode | 200 | The HTTP status code of the response. |
316+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
317+| Upstream | - | The upstream data of the HTTP request. |
318+| UserAgent | - | The full user agent as reported by the requesting client. |
319+| Username | username@email.com | The email or username of the auth request. |
320320
321321### Standard Log Format
322322All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
@@ -333,11 +333,11 @@ If you require a different format than that, you can configure it with the `--st
333333
334334Available variables for standard logging:
335335
336−| Variable | Example | Description |
337−| --- | --- | --- |
338−| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
339−| File | main.go:40 | The file and line number of the logging statement. |
340−| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
336+| Variable | Example | Description |
337+| --------- | --------------------------------- | -------------------------------------------------- |
338+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
339+| File | main.go:40 | The file and line number of the logging statement. |
340+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
341341
342342## Configuring for use with the Nginx `auth_request` directive
343343