From 723f6cc5d50a4f250df546557691c89e6891bdc7 Mon Sep 17 00:00:00 2001 From: Felix Stupp Date: Wed, 31 Aug 2022 21:08:02 +0000 Subject: [PATCH] docs/conf/overview: Add hint about cookie prefixes to --cookie-name (#1744) * docs/conf/overview: Add hint about cookie prefixes to --cookie-name Cookie Prefixes further restricts the possibilities of session attacks because supporting clients will only accept cookies with one of the prefix if certain requirements were meet, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes * Backport cookie prefixes to older docs Co-authored-by: Joel Speed --- docs/docs/configuration/overview.md | 2 +- docs/versioned_docs/version-6.1.x/configuration/overview.md | 2 +- docs/versioned_docs/version-7.0.x/configuration/overview.md | 2 +- docs/versioned_docs/version-7.1.x/configuration/overview.md | 2 +- docs/versioned_docs/version-7.2.x/configuration/overview.md | 2 +- docs/versioned_docs/version-7.3.x/configuration/overview.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/docs/configuration/overview.md b/docs/docs/configuration/overview.md index bf36bd59..a2772fa4 100644 --- a/docs/docs/configuration/overview.md +++ b/docs/docs/configuration/overview.md @@ -89,7 +89,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/ | `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | | | `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s | | `--cookie-httponly` | bool | set HttpOnly cookie flag | true | -| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` | +| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` | | `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` | | `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | | | `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | | diff --git a/docs/versioned_docs/version-6.1.x/configuration/overview.md b/docs/versioned_docs/version-6.1.x/configuration/overview.md index 5c0cbf95..6810be75 100644 --- a/docs/versioned_docs/version-6.1.x/configuration/overview.md +++ b/docs/versioned_docs/version-6.1.x/configuration/overview.md @@ -88,7 +88,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/ | `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | | | `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s | | `--cookie-httponly` | bool | set HttpOnly cookie flag | true | -| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` | +| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` | | `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` | | `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | | | `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | | diff --git a/docs/versioned_docs/version-7.0.x/configuration/overview.md b/docs/versioned_docs/version-7.0.x/configuration/overview.md index b77a5517..ed433edd 100644 --- a/docs/versioned_docs/version-7.0.x/configuration/overview.md +++ b/docs/versioned_docs/version-7.0.x/configuration/overview.md @@ -88,7 +88,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/ | `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | | | `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s | | `--cookie-httponly` | bool | set HttpOnly cookie flag | true | -| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` | +| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` | | `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` | | `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | | | `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | | diff --git a/docs/versioned_docs/version-7.1.x/configuration/overview.md b/docs/versioned_docs/version-7.1.x/configuration/overview.md index 9a2113e7..3121e6b2 100644 --- a/docs/versioned_docs/version-7.1.x/configuration/overview.md +++ b/docs/versioned_docs/version-7.1.x/configuration/overview.md @@ -33,7 +33,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/ | `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | | | `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s | | `--cookie-httponly` | bool | set HttpOnly cookie flag | true | -| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` | +| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` | | `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` | | `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | | | `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | | diff --git a/docs/versioned_docs/version-7.2.x/configuration/overview.md b/docs/versioned_docs/version-7.2.x/configuration/overview.md index 092fb7dc..9ca8f036 100644 --- a/docs/versioned_docs/version-7.2.x/configuration/overview.md +++ b/docs/versioned_docs/version-7.2.x/configuration/overview.md @@ -88,7 +88,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/ | `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | | | `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s | | `--cookie-httponly` | bool | set HttpOnly cookie flag | true | -| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` | +| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` | | `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` | | `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | | | `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | | diff --git a/docs/versioned_docs/version-7.3.x/configuration/overview.md b/docs/versioned_docs/version-7.3.x/configuration/overview.md index 00c59ca5..d58a2d11 100644 --- a/docs/versioned_docs/version-7.3.x/configuration/overview.md +++ b/docs/versioned_docs/version-7.3.x/configuration/overview.md @@ -89,7 +89,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/ | `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | | | `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s | | `--cookie-httponly` | bool | set HttpOnly cookie flag | true | -| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` | +| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` | | `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` | | `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | | | `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |