@@ -5,7 +5,7 @@ title: Overview
55
66`oauth2-proxy` can be configured via [command line options](#command-line-options), [environment variables](#environment-variables) or [config file](#config-file) (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).
77
8−### Generating a Cookie Secret
8+## Generating a Cookie Secret
99
1010To generate a strong cookie secret use one of the below commands:
1111
@@ -15,220 +15,319 @@ import TabItem from '@theme/TabItem';
1515<Tabs defaultValue="python">
1616 <TabItem value="python" label="Python">
1717
18− ```shell
19− python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
20− ```
21−
18+```shell
19+python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
20+```
21+
2222 </TabItem>
2323 <TabItem value="bash" label="Bash">
2424
25− ```shell
26− dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
27− ```
28−
25+```shell
26+dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
27+```
28+
2929 </TabItem>
3030 <TabItem value="openssl" label="OpenSSL">
3131
32− ```shell
33− openssl rand -base64 32 | tr -- '+/' '-_'
34− ```
32+```shell
33+openssl rand -base64 32 | tr -- '+/' '-_'
34+```
3535
3636 </TabItem>
3737 <TabItem value="powershell" label="PowerShell">
3838
39− ```powershell
40− # Add System.Web assembly to session, just in case
41− Add-Type -AssemblyName System.Web
42− [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
43− ```
39+```powershell
40+# Add System.Web assembly to session, just in case
41+Add-Type -AssemblyName System.Web
42+[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
43+```
4444
4545 </TabItem>
4646 <TabItem value="terraform" label="Terraform">
4747
48− ```hcl
49− # Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
50− resource "random_password" "cookie_secret" {
51− length = 32
52− override_special = "-_"
53− }
54− ```
48+```hcl
49+# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
50+resource "random_password" "cookie_secret" {
51+ length = 32
52+ override_special = "-_"
53+}
54+```
5555
5656 </TabItem>
5757</Tabs>
5858
59−### Config File
59+## Config File
6060
6161Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
6262
6363An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
6464
65+## Config Options
66+
6567### Command Line Options
6668
67−| Option | Type | Description | Default |
68−| ------ | ---- | ----------- | ------- |
69−| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
70−| `--allow-query-semicolons` | bool | allow the use of semicolons in query args ([required for some legacy applications](https://github.com/golang/go/issues/25192)) | `false` |
71−| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
72−| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
73−| `--auth-logging` | bool | Log authentication attempts | true |
74−| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
75−| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
76−| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
77−| `--backend-logout-url` | string | URL to perform backend logout, if you use `{id_token}` in the url it will be replaced by the actual `id_token` of the user session | |
78−| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
79−| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
80−| `--client-secret` | string | the OAuth Client Secret | |
81−| `--client-secret-file` | string | the file with OAuth Client Secret | |
82−| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
83−| `--config` | string | path to config file | |
84−| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
85−| `--cookie-expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
86−| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
87−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
88−| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
89−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
90−| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
91−| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
92−| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
93−| `--cookie-csrf-per-request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
94−| `--cookie-csrf-expire` | duration | expire timeframe for CSRF cookie | 15m |
95−| `--custom-templates-dir` | string | path to custom html templates | |
96−| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. |
97−| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
98−| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
99−| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
100−| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
101−| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
102−| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
103−| `--force-https` | bool | enforce https redirect | `false` |
104−| `--force-json-errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
105−| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
106−| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
107−| `--github-org` | string | restrict logins to members of this organisation | |
108−| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
109−| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
110−| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
111−| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
112−| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
113−| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
114−| `--google-admin-email` | string | the google admin to impersonate for api calls | |
115−| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
116−| `--google-service-account-json` | string | the path to the service account json credentials | |
117−| `--google-use-application-default-credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
118−| `--google-target-principal` | bool | the target principal to impersonate when using ADC | defaults to the service account configured for ADC |
119−| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
120−| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
121−| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
122−| `--https-address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
123−| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
124−| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
125−| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
126−| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
127−| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
128−| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
129−| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
130−| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
131−| `--login-url` | string | Authentication endpoint | |
132−| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
133−| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
134−| `--insecure-oidc-skip-nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
135−| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
136−| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
137−| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
138−| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
139−| `--oidc-audience-claim` | string | which OIDC claim contains the audience | `"aud"` |
140−| `--oidc-extra-audience` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
141−| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
142−| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
143−| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
144−| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
145−| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
146−| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
147−| `--profile-url` | string | Profile access endpoint | |
148−| `--skip-claims-from-profile-url` | bool | skip request to Profile URL for resolving claims not present in id_token | false |
149−| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
150−| `--provider` | string | OAuth provider | google |
151−| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
152−| `--use-system-trust-store` | bool | Determines if `provider-ca-file` files and the system trust store are used. If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. | false |
153−| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
154−| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
155−| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
156−| `--ready-path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
157−| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
158−| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
159−| `--proxy-websockets` | bool | enables WebSocket proxying | true |
160−| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
161−| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
162−| `--redeem-url` | string | Token redemption endpoint | |
163−| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
164−| `--relative-redirect-url` | bool | allow relative OAuth Redirect URL.` | false |
165−| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
166−| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
167−| `--redis-insecure-skip-tls-verify` | bool | skip TLS verification when connecting to Redis | false |
168−| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
169−| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
170−| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
171−| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
172−| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
173−| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
174−| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Example: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
175−| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
176−| `--request-logging` | bool | Log requests | true |
177−| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
178−| `--resource` | string | The resource that is protected (Azure AD only) | |
179−| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
180−| `--scope` | string | OAuth scope specification | |
181−| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
182−| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
183−| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
184−| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
185−| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
186−| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
187−| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
188−| `--silence-ping-logging` | bool | disable logging of requests to ping & ready endpoints | false |
189−| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
190−| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
191−| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
192−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
193−| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
194−| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
195−| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
196−| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
197−| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
198−| `--standard-logging` | bool | Log standard runtime information | true |
199−| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
200−| `--tls-cert-file` | string | path to certificate file | |
201−| `--tls-cipher-suite` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
202−| `--tls-key-file` | string | path to private key file | |
203−| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
204−| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
205−| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
206−| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
207−| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
208−| `--validate-url` | string | Access token validation endpoint | |
209−| `--version` | n/a | print version string | |
210−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) [^2] | |
211−| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
212−| `--encode-state` | bool | encode the state parameter as UrlEncodedBase64 | false |
213−
214−[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
215−[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URLs protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
216−
217−See below for provider specific options
218−
219−### Upstreams Configuration
69+| Flag | Description |
70+| ---------------- | ------------------------------------------------------- |
71+| `--config` | path to config file |
72+| `--config-test` | test configuration and exit (for CI/CD validation) |
73+| `--version` | print version string |
74+
75+### General Provider Options
76+
77+Provider specific options can be found on their respective subpages.
78+
79+| Flag / Config Field | Type | Description | Default |
80+| --------------------------------------------------------------------------------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
81+| flag: `--acr-values`<br/>toml: `acr_values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
82+| flag: `--allowed-group`<br/>toml: `allowed_groups` | string \| list | Restrict login to members of a group or list of groups. Furthermore, if you aren't setting the `scope` and use `allowed_groups` with the generic OIDC provider the scope `groups` gets added implicitly. | |
83+| flag: `--approval-prompt`<br/>toml: `approval_prompt` | string | OAuth approval_prompt | `"force"` |
84+| flag: `--backend-logout-url`<br/>toml: `backend_logout_url` | string | URL to perform backend logout, if you use `{id_token}` in the url it will be replaced by the actual `id_token` of the user session | |
85+| flag: `--client-id`<br/>toml: `client_id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86+| flag: `--client-secret-file`<br/>toml: `client_secret_file` | string | the file with OAuth Client Secret. The file must contain the secret only, with no trailing newline | |
87+| flag: `--client-secret`<br/>toml: `client_secret` | string | the OAuth Client Secret | |
88+| flag: `--code-challenge-method`<br/>toml: `code_challenge_method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89+| flag: `--insecure-oidc-allow-unverified-email`<br/>toml: `insecure_oidc_allow_unverified_email` | bool | don't fail if an email address in an id_token is not verified | false |
90+| flag: `--insecure-oidc-skip-issuer-verification`<br/>toml: `insecure_oidc_skip_issuer_verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
91+| flag: `--insecure-oidc-skip-nonce`<br/>toml: `insecure_oidc_skip_nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
92+| flag: `--jwt-key-file`<br/>toml: `jwt_key_file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
93+| flag: `--jwt-key`<br/>toml: `jwt_key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
94+| flag: `--login-url`<br/>toml: `login_url` | string | Authentication endpoint | |
95+| flag: `--auth-request-response-mode`<br/>toml: `auth-request-response-mode` | string | Response mode to ask for during authentication request | |
96+| flag: `--oidc-audience-claim`<br/>toml: `oidc_audience_claims` | string | which OIDC claim contains the audience | `"aud"` |
97+| flag: `--oidc-email-claim`<br/>toml: `oidc_email_claim` | string | which OIDC claim contains the user's email | `"email"` |
98+| flag: `--oidc-extra-audience`<br/>toml: `oidc_extra_audiences` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
99+| flag: `--oidc-groups-claim`<br/>toml: `oidc_groups_claim` | string | which OIDC claim contains the user groups | `"groups"` |
100+| flag: `--oidc-issuer-url`<br/>toml: `oidc_issuer_url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
101+| flag: `--oidc-jwks-url`<br/>toml: `oidc_jwks_url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled and public key files are not provided | |
102+| flag: `--oidc-public-key-file`<br/>toml: `oidc_public_key_files` | string | Path to public key file in PEM format to use for verifying JWT tokens (may be given multiple times). Required if OIDC discovery is disabled na JWKS URL isn't provided | |
103+| flag: `--oidc-enabled-signing-alg`<br/>toml: `oidc_enabled_signing_algs` | string \| list | List of allowed JWT signing algorithms. When oidc discovery is enabled, the effective set is the intersection between this list and the provider's discovered supported algorithms. | |
104+| flag: `--profile-url`<br/>toml: `profile_url` | string | Profile access endpoint | |
105+| flag: `--prompt`<br/>toml: `prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
106+| flag: `--provider-ca-file`<br/>toml: `provider_ca_files` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. | |
107+| flag: `--provider-display-name`<br/>toml: `provider_display_name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
108+| flag: `--provider`<br/>toml: `provider` | string | OAuth provider | google |
109+| flag: `--pubjwk-url`<br/>toml: `pubjwk_url` | string | JWK pubkey access endpoint: required by login.gov | |
110+| flag: `--redeem-url`<br/>toml: `redeem_url` | string | Token redemption endpoint | |
111+| flag: `--scope`<br/>toml:`scope` | string | OAuth scope specification. Every provider has a default list of scopes which will be used in case no scope is configured. | |
112+| flag: `--skip-claims-from-profile-url`<br/>toml: `skip_claims_from_profile_url` | bool | skip request to Profile URL for resolving claims not present in id_token | false |
113+| flag: `--skip-oidc-discovery`<br/>toml: `skip_oidc_discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
114+| flag: `--use-system-trust-store`<br/>toml: `use_system_trust_store` | bool | Determines if `provider-ca-file` files and the system trust store are used. If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. | false |
115+| flag: `--validate-url`<br/>toml: `validate_url` | string | Access token validation endpoint | |
116+
117+### Cookie Options
118+
119+| Flag / Config Field | Type | Description | Default |
120+| --------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
121+| flag: `--cookie-csrf-expire`<br/>toml: `cookie_csrf_expire` | duration | expire timeframe for CSRF cookie | 15m |
122+| flag: `--cookie-csrf-per-request`<br/>toml:`cookie_csrf_per_request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
123+| flag: `--cookie-csrf-per-request-limit`<br/>toml: `cookie_csrf_per_request_limit` | int | Sets a limit on the number of CSRF requests cookies that oauth2-proxy will create. The oldest cookie will be removed. Useful if users end up with 431 Request headers too large status codes. Only effective if --cookie-csrf-per-request is true | "infinite" |
124+| flag: `--cookie-csrf-samesite`<br/>toml: `cookie_csrf_samesite` | string | set SameSite CSRF cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). When using the default setting, the CSRF cookie samesite value is taken from the session cookie configuration. | `""` |
125+| flag: `--cookie-domain`<br/>toml: `cookie_domains` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
126+| flag: `--cookie-expire`<br/>toml: `cookie_expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
127+| flag: `--cookie-httponly`<br/>toml: `cookie_httponly` | bool | set HttpOnly cookie flag | true |
128+| flag: `--cookie-name`<br/>toml: `cookie_name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
129+| flag: `--cookie-path`<br/>toml: `cookie_path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
130+| flag: `--cookie-refresh`<br/>toml: `cookie_refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
131+| flag: `--cookie-samesite`<br/>toml: `cookie_samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
132+| flag: `--cookie-secret`<br/>toml: `cookie_secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
133+| flag: `--cookie-secret-file`<br/>toml: `cookie_secret_file` | string | File containing the cookie secret (must be raw binary, exactly 16, 24, or 32 bytes). Use dd if=/dev/urandom bs=32 count=1 > cookie.secret to generate | |
134+| flag: `--cookie-secure`<br/>toml: `cookie_secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
135+
136+[^1]: The following providers support `--cookie-refresh`: ADFS, Azure, GitLab, Google, Keycloak and all other Identity Providers which support the full [OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens)
137+
138+### Header Options
139+
140+| Flag / Config Field | Type | Description | Default |
141+| ------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
142+| flag: `--basic-auth-password`<br/>toml: `basic_auth_password` | string | the password to set when passing the HTTP Basic Auth header | |
143+| flag: `--set-xauthrequest`<br/>toml: `set_xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
144+| flag: `--set-authorization-header`<br/>toml: `set_authorization_header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
145+| flag: `--set-basic-auth`<br/>toml: `set_basic_auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
146+| flag: `--skip-auth-strip-headers`<br/>toml: `skip_auth_strip_headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
147+| flag: `--pass-access-token`<br/>toml: `pass_access_token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
148+| flag: `--pass-authorization-header`<br/>toml: `pass_authorization_header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
149+| flag: `--pass-basic-auth`<br/>toml: `pass_basic_auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
150+| flag: `--prefer-email-to-user`<br/>toml: `prefer_email_to_user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
151+| flag: `--pass-user-headers`<br/>toml: `pass_user_headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
152+
153+### Logging Options
154+
155+| Flag / Config Field | Type | Description | Default |
156+| --------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------- | --------------------------------------------------- |
157+| flag: `--auth-logging-format`<br/>toml: `auth_logging_format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
158+| flag: `--auth-logging`<br/>toml: `auth_logging` | bool | Log authentication attempts | true |
159+| flag: `--errors-to-info-log`<br/>toml: `errors_to_info_log` | bool | redirects error-level logging to default log channel instead of stderr | false |
160+| flag: `--exclude-logging-path`<br/>toml: `exclude_logging_paths` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
161+| flag: `--logging-compress`<br/>toml: `logging_compress` | bool | Should rotated log files be compressed using gzip | false |
162+| flag: `--logging-filename`<br/>toml: `logging_filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
163+| flag: `--logging-local-time`<br/>toml: `logging_local_time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
164+| flag: `--logging-max-age`<br/>toml: `logging_max_age` | int | Maximum number of days to retain old log files | 7 |
165+| flag: `--logging-max-backups`<br/>toml: `logging_max_backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
166+| flag: `--logging-max-size`<br/>toml: `logging_max_size` | int | Maximum size in megabytes of the log file before rotation | 100 |
167+| flag: `--request-id-header`<br/>toml: `request_id_header` | string | Request header to use as the request ID in logging | X-Request-Id |
168+| flag: `--request-logging-format`<br/>toml: `request_logging_format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
169+| flag: `--request-logging`<br/>toml: `request_logging` | bool | Log requests | true |
170+| flag: `--silence-ping-logging`<br/>toml: `silence_ping_logging` | bool | disable logging of requests to ping & ready endpoints | false |
171+| flag: `--standard-logging-format`<br/>toml: `standard_logging_format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
172+| flag: `--standard-logging`<br/>toml: `standard_logging` | bool | Log standard runtime information | true |
173+
174+### Page Template Options
175+
176+| Flag / Config Field | Type | Description | Default |
177+| ----------------------------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------- | ------- |
178+| flag: `--banner`<br/>toml: `banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
179+| flag: `--custom-sign-in-logo`<br/>toml: `custom_sign_in_logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. | |
180+| flag: `--custom-templates-dir`<br/>toml: `custom_templates_dir` | string | path to custom html templates | |
181+| flag: `--display-htpasswd-form`<br/>toml: `display_htpasswd_form` | bool | display username / password login form if an htpasswd file is provided | true |
182+| flag: `--footer`<br/>toml: `footer` | string | custom (html) footer string. Use `"-"` to disable default footer. (Can be used to obfuscate the version) | |
183+| flag: `--show-debug-on-error`<br/>toml: `show_debug_on_error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
184+
185+### Probe Options
186+
187+| Flag / Config Field | Type | Description | Default |
188+| ------------------------------------------------------- | ------ | ---------------------------------------------------------- | ----------------------------- |
189+| flag: `--ping-path`<br/>toml: `ping_path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
190+| flag: `--ping-user-agent`<br/>toml: `ping_user_agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
191+| flag: `--ready-path`<br/>toml: `ready_path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
192+| flag: `--gcp-healthchecks`<br/>toml: `gcp_healthchecks` | bool | Enable GCP/GKE healthcheck endpoints (deprecated) | false |
193+
194+### Proxy Options
195+
196+:::warning
197+When `--reverse-proxy` is enabled, configure `--trusted-proxy-ip` to the IPs or CIDR ranges of the reverse proxies that are allowed to send `X-Forwarded-*` headers. If you leave it unset, OAuth2 Proxy currently trusts all source IPs for backwards compatibility, which means a client that can reach OAuth2 Proxy directly may be able to spoof forwarded headers.
198+:::
199+
200+| Flag / Config Field | Type | Description | Default |
201+| ----------------------------------------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
202+| flag: `--allow-query-semicolons`<br/>toml: `allow_query_semicolons` | bool | allow the use of semicolons in query args ([required for some legacy applications](https://github.com/golang/go/issues/25192)) | `false` |
203+| flag: `--api-route`<br/>toml: `api_routes` | string \| list | Requests to these paths must already be authenticated with a cookie, or a JWT if `--skip-jwt-bearer-tokens` is set. No redirect to login will be done. Return 401 if not. Format: path_regex | |
204+| flag: `--authenticated-emails-file`<br/>toml: `authenticated_emails_file` | string | authenticate against emails via file (one per line) | |
205+| flag: `--bearer-token-login-fallback`<br/>toml: `bearer_token_login_fallback` | bool | if `--skip-jwt-bearer-tokens` is set, if a request includes an invalid JWT (expired, malformed, missing required audiences, etc), fall back to normal login redirect as if the token were not sent at all. If false, respond 403 | true |
206+| flag: `--email-domain`<br/>toml: `email_domains` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
207+| flag: `--encode-state`<br/>toml: `encode_state` | bool | encode the state parameter as UrlEncodedBase64 | false |
208+| flag: `--extra-jwt-issuers`<br/>toml: `extra_jwt_issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
209+| flag: `--force-https`<br/>toml: `force_https` | bool | enforce https redirect | `false` |
210+| flag: `--force-json-errors`<br/>toml: `force_json_errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
211+| flag: `--htpasswd-file`<br/>toml: `htpasswd_file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
212+| flag: `--htpasswd-user-group`<br/>toml: `htpasswd_user_groups` | string \| list | the groups to be set on sessions for htpasswd users | |
213+| flag: `--proxy-prefix`<br/>toml: `proxy_prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
214+| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, X-Envoy-External-Address, or CF-Connecting-IP) | X-Real-IP |
215+| flag: `--redirect-url`<br/>toml: `redirect_url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
216+| flag: `--relative-redirect-url`<br/>toml: `relative_redirect_url` | bool | allow relative OAuth Redirect URL.` | false |
217+| flag: `--reverse-proxy`<br/>toml: `reverse_proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
218+| flag: `--trusted-proxy-ip`<br/>toml: `trusted_proxy_ips` | string \| list | list of IPs or CIDR ranges allowed to supply `X-Forwarded-*` headers when `--reverse-proxy` is enabled. If not set, OAuth2 Proxy preserves backwards compatibility by trusting all source IPs (`0.0.0.0/0`, `::/0`) and logs a warning at startup. Configure this to your reverse proxy addresses to prevent forwarded header spoofing. | `"0.0.0.0/0", "::/0"` |
219+| flag: `--signature-key`<br/>toml: `signature_key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
220+| flag: `--skip-auth-preflight`<br/>toml: `skip_auth_preflight` | bool | will skip authentication for OPTIONS requests | false |
221+| flag: `--skip-auth-regex`<br/>toml: `skip_auth_regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times). Path matching is performed against the normalized path only; fragment identifiers (`#`) and their URL-encoded form (`%23`) are stripped before evaluation. | |
222+| flag: `--skip-auth-route`<br/>toml: `skip_auth_routes` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex. Path matching is performed against the normalized path only; fragment identifiers (`#`) and their URL-encoded form (`%23`) are stripped before evaluation. | |
223+| flag: `--skip-jwt-bearer-tokens`<br/>toml: `skip_jwt_bearer_tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
224+| flag: `--skip-provider-button`<br/>toml: `skip_provider_button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
225+| flag: `--ssl-insecure-skip-verify`<br/>toml: `ssl_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
226+| flag: `--trusted-ip`<br/>toml: `trusted_ips` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
227+| flag: `--whitelist-domain`<br/>toml: `whitelist_domains` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) [^2] | |
228+
229+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
230+
231+### Server Options
232+
233+| Flag / Config Field | Type | Description | Default |
234+| ------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
235+| flag: `--http-address`<br/>toml: `http_address` | string | `[http://]<addr>:<port>` or `unix://<path>` or `fd:<int>` (case insensitive) to listen on for HTTP clients. Unix sockets are created with default system umask mode, which can be overridden, e.g. `unix://my-socket,mode=0777`. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
236+| flag: `--https-address`<br/>toml: `https_address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
237+| flag: `--metrics-address`<br/>toml: `metrics_address` | string | the address prometheus metrics will be scraped from | `""` |
238+| flag: `--metrics-secure-address`<br/>toml: `metrics_secure_address` | string | the address prometheus metrics will be scraped from if using HTTPS | `""` |
239+| flag: `--metrics-tls-cert-file`<br/>toml: `metrics_tls_cert_file` | string | path to certificate file for secure metrics server | `""` |
240+| flag: `--metrics-tls-key-file`<br/>toml: `metrics_tls_key_file` | string | path to private key file for secure metrics server | `""` |
241+| flag: `--tls-cert-file`<br/>toml: `tls_cert_file` | string | path to certificate file | |
242+| flag: `--tls-key-file`<br/>toml: `tls_key_file` | string | path to private key file | |
243+| flag: `--tls-cipher-suite`<br/>toml: `tls_cipher_suites` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
244+| flag: `--tls-min-version`<br/>toml: `tls_min_version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
245+
246+### Session Options
247+
248+| Flag / Config Field | Type | Description | Default |
249+| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
250+| flag: `--session-cookie-minimal`<br/>toml: `session_cookie_minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
251+| flag: `--session-store-type`<br/>toml: `session_store_type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
252+| flag: `--redis-cluster-connection-urls`<br/>toml: `redis_cluster_connection_urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
253+| flag: `--redis-connection-url`<br/>toml: `redis_connection_url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
254+| flag: `--redis-ca-path`<br/>toml: `redis_ca_path` | string | Path to a CA certificates file that should be used when connecting to redis. If not specified, the system cert pool is used instead. | |
255+| flag: `--redis-insecure-skip-tls-verify`<br/>toml: `redis_insecure_skip_tls_verify` | bool | skip TLS verification when connecting to Redis | false |
256+| flag: `--redis-password`<br/>toml: `redis_password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
257+| flag: `--redis-sentinel-password`<br/>toml: `redis_sentinel_password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
258+| flag: `--redis-sentinel-master-name`<br/>toml: `redis_sentinel_master_name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
259+| flag: `--redis-sentinel-connection-urls`<br/>toml: `redis_sentinel_connection_urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
260+| flag: `--redis-use-cluster`<br/>toml: `redis_use_cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
261+| flag: `--redis-use-sentinel`<br/>toml: `redis_use_sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
262+| flag: `--redis-connection-idle-timeout`<br/>toml: `redis_connection_idle_timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Example: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
263+
264+### Upstream Options
265+
266+| Flag / Config Field | Type | Description | Default |
267+| ----------------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
268+| flag: `--flush-interval`<br/>toml: `flush_interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
269+| flag: `--pass-host-header`<br/>toml: `pass_host_header` | bool | pass the request Host Header to upstream | true |
270+| flag: `--proxy-websockets`<br/>toml: `proxy_websockets` | bool | enables WebSocket proxying | true |
271+| flag: `--ssl-upstream-insecure-skip-verify`<br/>toml: `ssl_upstream_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
272+| flag: `--disable-keep-alives`<br/>toml: `disable_keep_alives` | bool | disable HTTP keep-alive connections to the upstream server | false |
273+| flag: `--upstream-timeout`<br/>toml: `upstream_timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
274+| flag: `--upstream`<br/>toml: `upstreams` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
275+
276+## Configuration Validation
277+
278+The `--config-test` flag validates your configuration file without starting the proxy server. This is useful for:
279+- **CI/CD pipelines**: Pre-deployment validation
280+- **Configuration management**: Testing before applying changes
281+- **Debugging**: Verifying syntax and required fields
282+
283+### Usage
284+
285+```bash
286+# Test legacy config
287+oauth2-proxy --config /etc/oauth2-proxy.cfg --config-test
288+
289+# Test alpha config
290+oauth2-proxy --config /etc/core.cfg --alpha-config /etc/alpha.yaml --config-test
291+
292+# CI/CD pre-deployment check
293+# Returns with exit code 1 if any validation errors occur
294+oauth2-proxy --config new-config.cfg --config-test
295+```
296+
297+### Exit Codes
298+
299+- **0**: Configuration is valid ✅
300+- **1**: Configuration is invalid (errors printed to stderr) ❌
301+
302+### Validation Coverage
303+
304+The `--config-test` flag performs the **same comprehensive validation** as normal startup, including:
305+- Required fields (client ID, client secret, cookie secret, etc.)
306+- Syntax validation (TOML/YAML parsing)
307+- Provider configuration
308+- Upstream server definitions
309+- Session store connectivity (e.g., Redis network checks if configured)
310+
311+**Note**: Cannot be combined with `--convert-config-to-alpha`.
312+
313+## Upstreams Configuration
220314
221315`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers, unix socket or serve static files from the file system.
222316
223−HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter. . This will forward all authenticated requests to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
317+To configure **HTTP and HTTPS upstreams**, provide such a URL in `--upstream=URL`. The scheme+host portion and the path portion are extracted to configure proxying behavior. When processing incoming requests, the path portion becomes a lookup key for selecting the destination server of the proxied request.
318+
319+* Upstream URLs *without a trailing slash,* like in `--upstream=http://service2.internal/foo`, will match an incoming request exactly to `/foo` in `https://this.o2p.example.com/foo`, and forward the request on to service2.internal, but not match a request to `https://this.o2p.example.com/foo/more` nor ...`.com/food`.
320+* Upstream URLs *with a trailing slash,* like in `--upstream=http://service1.internal/foo/`, will match any incoming request to any incoming requests's path *starting with* `/foo/`, like `/foo/` and `/foo/more` and `/foo/lots/more?etc`.
321+
322+If multiple `--upstream` URLs' paths match an incoming request, the one with the longest matching path (the most specific match) takes priority over shorter (less specific) ones.
224323
225−Unix socket upstreams are configured as `unix:///path/to/unix.sock`.
324+**Unix socket upstreams** are configured as `unix:///path/to/unix.sock`.
226325
227−Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
326+**Static file paths** are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
228327
229328Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
230329
231−### Environment variables
330+## Environment variables
232331
233332Every command line argument can be specified as an environment variable by
234333prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
@@ -238,8 +337,15 @@ environment variable should be plural (trailing `S`).
238337This is particularly useful for storing secrets outside a configuration file
239338or the command line.
240339
241−For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`,
242−and the `--email-domain` flag becomes `OAUTH2_PROXY_EMAIL_DOMAINS`.
340+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`.
341+If a flag has the type `string | list` like the `--email-domain` flag it is
342+available as an environment variable in plural form e.g. `OAUTH2_PROXY_EMAIL_DOMAINS`
343+
344+Values for type `string | list` usually have a plural environment variable name
345+and need to be seperated by `,` e.g.
346+`OAUTH2_PROXY_SKIP_AUTH_ROUTES="GET=^/api/status,POST=^/api/saved_objects/_import"`
347+
348+Please check the type for each [config option](#config-options) first.
243349
244350## Logging Configuration
245351
@@ -253,7 +359,8 @@ Each type of logging has its own configurable format and variables. By default,
253359
254360Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.
255361
256−### Auth Log Format
362+## Auth Log Format
363+
257364Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
258365
259366```
@@ -275,20 +382,21 @@ The default format is configured as follows:
275382
276383Available variables for auth logging:
277384
278−| Variable | Example | Description |
279−| --- | --- | --- |
280−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
281−| Host | domain.com | The value of the Host header. |
282−| Message | Authenticated via OAuth2 | The details of the auth attempt. |
283−| Protocol | HTTP/1.0 | The request protocol. |
284−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
285−| RequestMethod | GET | The request method. |
286−| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
287−| UserAgent | - | The full user agent as reported by the requesting client. |
288−| Username | username@email.com | The email or username of the auth request. |
289−| Status | AuthSuccess | The status of the auth request. See above for details. |
290−
291−### Request Log Format
385+| Variable | Example | Description |
386+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
387+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
388+| Host | domain.com | The value of the Host header. |
389+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
390+| Protocol | HTTP/1.0 | The request protocol. |
391+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
392+| RequestMethod | GET | The request method. |
393+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
394+| UserAgent | - | The full user agent as reported by the requesting client. |
395+| Username | username@email.com | The email or username of the auth request. |
396+| Status | AuthSuccess | The status of the auth request. See above for details. |
397+
398+## Request Log Format
399+
292400HTTP request logs will output by default in the below format:
293401
294402```
@@ -304,23 +412,24 @@ The default format is configured as follows:
304412
305413Available variables for request logging:
306414
307−| Variable | Example | Description |
308−| --- | --- | --- |
309−| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
310−| Host | domain.com | The value of the Host header. |
311−| Protocol | HTTP/1.0 | The request protocol. |
312−| RequestDuration | 0.001 | The time in seconds that a request took to process. |
313−| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
314−| RequestMethod | GET | The request method. |
315−| RequestURI | "/oauth2/auth" | The URI path of the request. |
316−| ResponseSize | 12 | The size in bytes of the response. |
317−| StatusCode | 200 | The HTTP status code of the response. |
318−| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
319−| Upstream | - | The upstream data of the HTTP request. |
320−| UserAgent | - | The full user agent as reported by the requesting client. |
321−| Username | username@email.com | The email or username of the auth request. |
322−
323−### Standard Log Format
415+| Variable | Example | Description |
416+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
417+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
418+| Host | domain.com | The value of the Host header. |
419+| Protocol | HTTP/1.0 | The request protocol. |
420+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
421+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
422+| RequestMethod | GET | The request method. |
423+| RequestURI | "/oauth2/auth" | The URI path of the request. |
424+| ResponseSize | 12 | The size in bytes of the response. |
425+| StatusCode | 200 | The HTTP status code of the response. |
426+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
427+| Upstream | - | The upstream data of the HTTP request. |
428+| UserAgent | - | The full user agent as reported by the requesting client. |
429+| Username | username@email.com | The email or username of the auth request. |
430+
431+## Standard Log Format
432+
324433All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
325434
326435```
@@ -335,274 +444,8 @@ If you require a different format than that, you can configure it with the `--st
335444
336445Available variables for standard logging:
337446
338−| Variable | Example | Description |
339−| --- | --- | --- |
340−| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
341−| File | main.go:40 | The file and line number of the logging statement. |
342−| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
343−
344−## Configuring for use with the Nginx `auth_request` directive
345−
346−**This option requires `--reverse-proxy` option to be set.**
347−
348−The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
349−
350−```nginx
351−server {
352− listen 443 ssl;
353− server_name ...;
354− include ssl/ssl.conf;
355−
356− location /oauth2/ {
357− proxy_pass http://127.0.0.1:4180;
358− proxy_set_header Host $host;
359− proxy_set_header X-Real-IP $remote_addr;
360− proxy_set_header X-Auth-Request-Redirect $request_uri;
361− # or, if you are handling multiple domains:
362− # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
363− }
364− location = /oauth2/auth {
365− proxy_pass http://127.0.0.1:4180;
366− proxy_set_header Host $host;
367− proxy_set_header X-Real-IP $remote_addr;
368− proxy_set_header X-Forwarded-Uri $request_uri;
369− # nginx auth_request includes headers but not body
370− proxy_set_header Content-Length "";
371− proxy_pass_request_body off;
372− }
373−
374− location / {
375− auth_request /oauth2/auth;
376− error_page 401 =403 /oauth2/sign_in;
377−
378− # pass information via X-User and X-Email headers to backend,
379− # requires running with --set-xauthrequest flag
380− auth_request_set $user $upstream_http_x_auth_request_user;
381− auth_request_set $email $upstream_http_x_auth_request_email;
382− proxy_set_header X-User $user;
383− proxy_set_header X-Email $email;
384−
385− # if you enabled --pass-access-token, this will pass the token to the backend
386− auth_request_set $token $upstream_http_x_auth_request_access_token;
387− proxy_set_header X-Access-Token $token;
388−
389− # if you enabled --cookie-refresh, this is needed for it to work with auth_request
390− auth_request_set $auth_cookie $upstream_http_set_cookie;
391− add_header Set-Cookie $auth_cookie;
392−
393− # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
394− # limit and so the OAuth2 Proxy splits these into multiple parts.
395− # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
396− # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
397− auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
398−
399− # Extract the Cookie attributes from the first Set-Cookie header and append them
400− # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
401− if ($auth_cookie ~* "(; .*)") {
402− set $auth_cookie_name_0 $auth_cookie;
403− set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
404− }
405−
406− # Send both Set-Cookie headers now if there was a second part
407− if ($auth_cookie_name_upstream_1) {
408− add_header Set-Cookie $auth_cookie_name_0;
409− add_header Set-Cookie $auth_cookie_name_1;
410− }
411−
412− proxy_pass http://backend/;
413− # or "root /path/to/site;" or "fastcgi_pass ..." etc
414− }
415−}
416−```
417−
418−When you use ingress-nginx in Kubernetes, you MUST use `kubernetes/ingress-nginx` (which includes the Lua module) and the following configuration snippet for your `Ingress`.
419−Variables set with `auth_request_set` are not `set`-able in plain nginx config when the location is processed via `proxy_pass` and then may only be processed by Lua.
420−Note that `nginxinc/kubernetes-ingress` does not include the Lua module.
421−
422−```yaml
423−nginx.ingress.kubernetes.io/auth-response-headers: Authorization
424−nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
425−nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
426−nginx.ingress.kubernetes.io/configuration-snippet: |
427− auth_request_set $name_upstream_1 $upstream_cookie_name_1;
428−
429− access_by_lua_block {
430− if ngx.var.name_upstream_1 ~= "" then
431− ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
432− end
433− }
434−```
435−It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
436−
437−You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".
438−
439−## Configuring for use with the Traefik (v2) `ForwardAuth` middleware
440−
441−**This option requires `--reverse-proxy` option to be set.**
442−
443−### ForwardAuth with 401 errors middleware
444−
445−The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
446−
447−```yaml
448−http:
449− routers:
450− a-service:
451− rule: "Host(`a-service.example.com`)"
452− service: a-service-backend
453− middlewares:
454− - oauth-errors
455− - oauth-auth
456− tls:
457− certResolver: default
458− domains:
459− - main: "example.com"
460− sans:
461− - "*.example.com"
462− oauth:
463− rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
464− middlewares:
465− - auth-headers
466− service: oauth-backend
467− tls:
468− certResolver: default
469− domains:
470− - main: "example.com"
471− sans:
472− - "*.example.com"
473−
474− services:
475− a-service-backend:
476− loadBalancer:
477− servers:
478− - url: http://172.16.0.2:7555
479− oauth-backend:
480− loadBalancer:
481− servers:
482− - url: http://172.16.0.1:4180
483−
484− middlewares:
485− auth-headers:
486− headers:
487− sslRedirect: true
488− stsSeconds: 315360000
489− browserXssFilter: true
490− contentTypeNosniff: true
491− forceSTSHeader: true
492− sslHost: example.com
493− stsIncludeSubdomains: true
494− stsPreload: true
495− frameDeny: true
496− oauth-auth:
497− forwardAuth:
498− address: https://oauth.example.com/oauth2/auth
499− trustForwardHeader: true
500− oauth-errors:
501− errors:
502− status:
503− - "401-403"
504− service: oauth-backend
505− query: "/oauth2/sign_in?rd={url}"
506−```
507−
508−### ForwardAuth with static upstreams configuration
509−
510−Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
511−
512−**Following options need to be set on `oauth2-proxy`:**
513−- `--upstream=static://202`: Configures a static response for authenticated sessions
514−- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
515−
516−```yaml
517−http:
518− routers:
519− a-service-route-1:
520− rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
521− service: a-service-backend
522− middlewares:
523− - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
524− tls:
525− certResolver: default
526− domains:
527− - main: "example.com"
528− sans:
529− - "*.example.com"
530− a-service-route-2:
531− rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
532− service: a-service-backend
533− middlewares:
534− - oauth-auth-wo-redirect # unauthenticated session will return a 401
535− tls:
536− certResolver: default
537− domains:
538− - main: "example.com"
539− sans:
540− - "*.example.com"
541− services-oauth2-route:
542− rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
543− middlewares:
544− - auth-headers
545− service: oauth-backend
546− tls:
547− certResolver: default
548− domains:
549− - main: "example.com"
550− sans:
551− - "*.example.com"
552− oauth2-proxy-route:
553− rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
554− middlewares:
555− - auth-headers
556− service: oauth-backend
557− tls:
558− certResolver: default
559− domains:
560− - main: "example.com"
561− sans:
562− - "*.example.com"
563−
564− services:
565− a-service-backend:
566− loadBalancer:
567− servers:
568− - url: http://172.16.0.2:7555
569− b-service-backend:
570− loadBalancer:
571− servers:
572− - url: http://172.16.0.3:7555
573− oauth-backend:
574− loadBalancer:
575− servers:
576− - url: http://172.16.0.1:4180
577−
578− middlewares:
579− auth-headers:
580− headers:
581− sslRedirect: true
582− stsSeconds: 315360000
583− browserXssFilter: true
584− contentTypeNosniff: true
585− forceSTSHeader: true
586− sslHost: example.com
587− stsIncludeSubdomains: true
588− stsPreload: true
589− frameDeny: true
590− oauth-auth-redirect:
591− forwardAuth:
592− address: https://oauth.example.com/
593− trustForwardHeader: true
594− authResponseHeaders:
595− - X-Auth-Request-Access-Token
596− - Authorization
597− oauth-auth-wo-redirect:
598− forwardAuth:
599− address: https://oauth.example.com/oauth2/auth
600− trustForwardHeader: true
601− authResponseHeaders:
602− - X-Auth-Request-Access-Token
603− - Authorization
604−```
605−
606−:::note
607−If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
608−:::
447+| Variable | Example | Description |
448+| --------- | --------------------------------- | -------------------------------------------------- |
449+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
450+| File | main.go:40 | The file and line number of the logging statement. |
451+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |