public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-22 04:32:02 +02:00
Code Issues Projects Releases Wiki Activity

release: v7.15.5 (#3553)

Browse Source 
* update to release version v7.15.5

* Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: blakeroberts-wk <blake.roberts@workiva.com>

* Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

* Merge commit from fork

* fix: validate trusted IP proxy headers

Respect trusted proxy boundaries before using real-client-IP headers for authentication bypass decisions and safely traverse X-Forwarded-For chains.

Signed-off-by: Jan Larwig <jan@larwig.com>

* fix: trusted-ip header bypass

Signed-off-by: Jan Larwig <jan@larwig.com>

* docs: add changelog entry

Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>

---------

Signed-off-by: Jan Larwig <jan@larwig.com>
Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>

* docs: changelog for v7.15.5

Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>

* docs: update order of owners for prow

Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>

* ci: make the linter happy again

Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>

---------

Signed-off-by: Jan Larwig <jan@larwig.com>
Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
Co-authored-by: blakeroberts-wk <blake.roberts@workiva.com>
Co-authored-by: Jan Larwig <jan.larwig@digits.schwarz>
This commit is contained in:
github-actions[bot]
2026-10-01 11:01:25 +02:00
committed by GitHub
co-authored by blakeroberts-wk Jan Larwig Jan Larwig
parent e05f04ef08
commit bea3f04bf8
27 changed files with 1360 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/versioned_docs/version-7.15.x/configuration/integrations/index.md
+5
View File
@@ -32,6 +32,11 @@ When integrating with Kubernetes web UIs, make sure to:
Most integrations require the following OAuth2 Proxy configuration:
- `--reverse-proxy=true`: Required to correctly handle `X-Forwarded-*` headers
- `--trusted-proxy-ip=<proxy CIDR>`: Restricts forwarded headers, including
client identity used by `--trusted-ip`, to the reverse proxies' addresses or
networks. Include the direct peer and every trusted hop that can appear in
XFF. Without this option, all source addresses are trusted for backwards
compatibility.
- **Session storage**: For production deployments with large tokens due to a lot of claims like AD groups, use `--session-store-type=redis`
For provider-specific configuration, see the [OAuth Provider Configuration](../providers/index.md) documentation.