In reverse-proxy / forward_auth setups (Caddy `forward_auth`, nginx
`auth_request`), the post-login redirect is built as an absolute URL
`{scheme}://{host}{uri}` and passed to oauth2-proxy via the `rd` query
parameter. The Caddy integration docs require `--reverse-proxy=true` but
do not mention that the host must also be added to `--whitelist-domain`.
Without `--whitelist-domain`, the absolute `rd` was rejected by the
redirect validator and, because the `sign_in`/`start` requests are served
under the proxy prefix, the remaining redirect strategies collapsed to
"/", silently losing the originally requested URL (and its query) after
login.
When `rd` is an absolute http(s) URL that fails whitelist validation but
targets the same host the request was served on, fall back to its path
component and re-validate it as a relative redirect. This is safe:
- it is a same-origin relative redirect, so it cannot redirect to a
different host;
- the extracted path is still run through the validator, so open-redirect
protections (e.g. "//", "/../") still apply;
- a `rd` pointing at a different, non-whitelisted host is left untouched,
so the other redirect strategies still run unchanged.
Regression tests model the Caddy `forward_auth` sign_in request and
verify that the originally requested path+query is preserved without a
whitelist, that a different non-whitelisted host is still rejected, and
that open-redirect payloads are still blocked.
Fixes#2940
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: 赵鑫亿 <98445030+zhaoxinyi02@users.noreply.github.com>
Embedding css and webfont dependencies allows the application to present
itself correctly in an environment that does not allow downloading the
files from a cdn.
Inspiration taken from #1492 but reworked to make use of embed.FS
simplifying the approach.
* Ensure sign-in page background is uniform throughout the page
Configured banners that take up large amounts of space leave a gap of blank
background between where the body ends and the footer starts. Fix this by
setting the style for the section containing the banner to match the body and
footer
* Add changelog entry
---------
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
* initial commit: add groups to azure
Signed-off-by: andrewphamade@gmail.com <andrewphamade@gmail.com>
* fix deprecations and linting errors
Signed-off-by: Andrew Hamade <andrewphamade@gmail.com>
* remove groups testing from azure provider
Signed-off-by: Andrew Hamade <andrewphamade@gmail.com>
* fix test error
Signed-off-by: Andrew Hamade <andrewphamade@gmail.com>
* verify-generate
Signed-off-by: Andrew Hamade <andrewphamade@gmail.com>
Signed-off-by: andrewphamade@gmail.com <andrewphamade@gmail.com>
Signed-off-by: Andrew Hamade <andrewphamade@gmail.com>
* Add RequestID to the RequestScope
* Expose RequestID to auth & request loggers
* Use the RequestID in templated HTML pages
* Allow customizing the RequestID header
* Document new Request ID support
* Add more cases to scope/requestID tests
* Split Get vs Generate RequestID funtionality
* Add {{.RequestID}} to the request logger tests
* Move RequestID management to RequestScope
* Use HTML escape instead of sanitization for Request ID rendering
赵鑫亿
Jan Larwig
Olivier Mengué
Koen van Zuijlen
Cory Bolar
Andrew Hamade
Alexandru Ciobanu
Valentin Pichard
Miks Kalnins
Philippe
Jordie
Joel Speed
Frederic Pape
Tarvi Pillessaar
Nick Meves