public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-19 07:45:00 +02:00
Code Issues Projects Releases Wiki Activity

Deploy website - based on 5f2f95e118

Browse Source
This commit is contained in:
gh-actions
2023-09-08 08:53:09 +00:00
parent 345155caa9
commit daad885c23
78 changed files with 164 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/next/configuration/session_storage/index.html
+12 -3
View File
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.ecd96000.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.6831aa45.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.7f27a1af.js" as="script">
</head>
<body>
@@ -21,14 +21,23 @@ back the client for storage, as in the <a href="#cookie-storage">Cookie storage<
to the user as the cookie value instead.</p><p>A ticket is composed as the following:</p><p><code>{CookieName}-{ticketID}.{secret}</code></p><p>Where:</p><ul><li>The <code>CookieName</code> is the OAuth2 cookie name (_oauth2_proxy by default)</li><li>The <code>ticketID</code> is a 128 bit random number, hex-encoded</li><li>The <code>secret</code> is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.</li><li>The pair of <code>{CookieName}-{ticketID}</code> comprises a ticket handle, and thus, the redis key
to which the session is stored. The encoded session is encrypted with the secret and stored
in redis via the <code>SETEX</code> command.</li></ul><p>Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
disclosure.</p><h4 class="anchor anchorWithStickyNavbar_mojV" id="usage">Usage<a class="hash-link" href="#usage" title="Direct link to heading">​</a></h4><p>When using the redis store, specify <code>--session-store-type=redis</code> as well as the Redis connection URL, via
disclosure.</p><p>Additionally the browser only has to send a short Cookie with every request and not the whole JWT, which can get quite big.</p><p>Two settings are used to configure the OAuth2 Proxy cookie lifetime:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--cookie-refresh duration refresh the cookie after this duration; 0 to disable</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">--cookie-expire duration expire timeframe for cookie 168h0m0s</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>The &quot;cookie-expire&quot; value should be equal to the lifetime of the Refresh-Token that is issued by the OAuth2 authorization server.
If it expires earlier and is deleted by the browser, OAuth2 Proxy cannot find the stored Refresh-Tokens in Redis and thus cannot start
the refresh flow to get new Access-Tokens. If it is longer, it might be that the old Refresh-Token will be found in Redis but has already
expired.</p><p>The &quot;cookie-refresh&quot; value controls when OAuth2 Proxy tries to refresh an Access-Token. If it is set to &quot;0&quot;, the
Access-Token will never be refreshed, even it is already expired and there would be a valid Refresh-Token in the
available. If set, OAuth2 Proxy will refresh the Access-Token after this many seconds even if it is still valid.
Of course, it will also be refreshed after it has expired, as long as a Refresh Token is available.</p><p>Caveat: It can happen that the Access-Token is valid for e.g. &quot;1m&quot; and a request happens after exactly &quot;59s&quot;.
It would pass OAuth2 Proxy and be forwarded to the backend but is just expired when the backend tries to validate
it. This is especially relevant if the backend uses the JWT to make requests to other backends.
For this reason, it&#x27;s advised to set the cookie-refresh a couple of seconds less than the Access-Token lifespan.</p><p>Recommended settings:</p><ul><li>cookie<!-- -->_<!-- -->refresh := Access-Token lifespan - 1m</li><li>cookie<!-- -->_<!-- -->expire := Refresh-Token lifespan (i.e. Keycloak&#x27;s client<!-- -->_<!-- -->session<!-- -->_<!-- -->idle)</li></ul><h4 class="anchor anchorWithStickyNavbar_mojV" id="usage">Usage<a class="hash-link" href="#usage" title="Direct link to heading">​</a></h4><p>When using the redis store, specify <code>--session-store-type=redis</code> as well as the Redis connection URL, via
<code>--redis-connection-url=redis://host[:port][/db-number]</code>.</p><p>You may also configure the store for Redis Sentinel. In this case, you will want to use the
<code>--redis-use-sentinel=true</code> flag, as well as configure the flags <code>--redis-sentinel-master-name</code>
and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p><p>Note, if Redis timeout option is set to non-zero, the <code>--redis-connection-idle-timeout</code>
must be less than <a href="https://redis.io/docs/reference/clients/#client-timeouts" target="_blank" rel="noopener noreferrer">Redis timeout option</a>. For example: if either redis.conf includes
<code>timeout 15</code> or using <code>CONFIG SET timeout 15</code> the <code>--redis-connection-idle-timeout</code> must be at least <code>--redis-connection-idle-timeout=14</code></p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 OAuth2 Proxy.</div></div></div></footer></div>
<script src="/oauth2-proxy/assets/js/runtime~main.ecd96000.js"></script>
<script src="/oauth2-proxy/assets/js/runtime~main.6831aa45.js"></script>
<script src="/oauth2-proxy/assets/js/main.7f27a1af.js"></script>
</body>
</html>