diff --git a/CHANGELOG.md b/CHANGELOG.md
index 48444f1e..21e84fbc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@
- [#1988](https://github.com/oauth2-proxy/oauth2-proxy/pull/1988) Ensure sign-in page background is uniform throughout the page
- [#2010](https://github.com/oauth2-proxy/oauth2-proxy/pull/2010) Log the difference between invalid email and not authorized session
- [#2013](https://github.com/oauth2-proxy/oauth2-proxy/pull/2013) Upgrade alpine to version 3.17.2 and library dependencies (@miguelborges99)
+- [#2025](https://github.com/oauth2-proxy/oauth2-proxy/pull/2025) Embed static stylesheets and dependencies
- [#2028](https://github.com/oauth2-proxy/oauth2-proxy/pull/2028) Update golang.org/x/net to v0.7.0 ato address GHSA-vvpx-j8f3-3w6h
- [#2047](https://github.com/oauth2-proxy/oauth2-proxy/pull/2047) CVE-2022-41717: DoS in Go net/http may lead to DoS (@miguelborges99
- [#2133](https://github.com/oauth2-proxy/oauth2-proxy/pull/2133) Use X-Forwarded-Uri if it exists for pathRegex match
diff --git a/docs/docs/features/endpoints.md b/docs/docs/features/endpoints.md
index 43f4e4cf..65f546fc 100644
--- a/docs/docs/features/endpoints.md
+++ b/docs/docs/features/endpoints.md
@@ -15,6 +15,7 @@ OAuth2 Proxy responds directly to the following endpoints. All other endpoints w
- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
- /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](../configuration/overview.md#configuring-for-use-with-the-nginx-auth_request-directive)
+- /oauth2/static/\* - stylesheets and other dependencies used in the sign_in and error pages
### Sign out
diff --git a/oauthproxy.go b/oauthproxy.go
index bdb911fc..5813ce28 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -2,6 +2,7 @@ package main
import (
"context"
+ "embed"
"encoding/json"
"errors"
"fmt"
@@ -51,6 +52,7 @@ const (
oauthCallbackPath = "/callback"
authOnlyPath = "/auth"
userInfoPath = "/userinfo"
+ staticPathPrefix = "/static/"
)
var (
@@ -59,6 +61,9 @@ var (
// ErrAccessDenied means the user should receive a 401 Unauthorized response
ErrAccessDenied = errors.New("access denied")
+
+ //go:embed static/*
+ staticFiles embed.FS
)
// allowedRoute manages method + path based allowlists
@@ -335,6 +340,9 @@ func (p *OAuthProxy) buildProxySubrouter(s *mux.Router) {
s.Path(oauthStartPath).HandlerFunc(p.OAuthStart)
s.Path(oauthCallbackPath).HandlerFunc(p.OAuthCallback)
+ // Static file paths
+ s.PathPrefix(staticPathPrefix).Handler(http.StripPrefix(p.ProxyPrefix, http.FileServer(http.FS(staticFiles))))
+
// The userinfo endpoint needs to load sessions before handling the request
s.Path(userInfoPath).Handler(p.sessionChain.ThenFunc(p.UserInfo))
}
diff --git a/pkg/app/pagewriter/error.html b/pkg/app/pagewriter/error.html
index a346b2b3..be8bca92 100644
--- a/pkg/app/pagewriter/error.html
+++ b/pkg/app/pagewriter/error.html
@@ -5,8 +5,8 @@
{{.StatusCode}} {{.Title}}
-
-
+
+