Jan Larwig 0ab0bb01a5 Merge commit from fork ...

* fix: validate trusted IP proxy headers

Respect trusted proxy boundaries before using real-client-IP headers for authentication bypass decisions and safely traverse X-Forwarded-For chains.

Signed-off-by: Jan Larwig <jan@larwig.com>

* fix: trusted-ip header bypass

Signed-off-by: Jan Larwig <jan@larwig.com>

* docs: add changelog entry

Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>

---------

Signed-off-by: Jan Larwig <jan@larwig.com>
Signed-off-by: Jan Larwig <jan.larwig@digits.schwarz>

2026-10-01 10:42:18 +02:00

..

apis

Merge commit from fork

2026-10-01 10:42:18 +02:00

app

Merge commit from fork

2026-04-13 18:22:56 +02:00

authentication

chore(goconsts): use proper constants for http methods

2026-06-08 12:54:58 +02:00

cookies

fix: strip the port from the request host when matching cookie domains (#3546)

2026-09-30 17:31:29 +02:00

encryption

fix(encryption): return an error instead of panicking on a short GCM ciphertext (#3527)

2026-10-01 09:18:17 +02:00

header

revert: secrets as []byte instead of string

2025-11-16 22:38:42 +01:00

ip

Merge commit from fork

2026-10-01 10:42:18 +02:00

logger

Request ID Logging (#1087)

2021-03-21 18:20:57 +00:00

middleware

chore(deps): replace k8s.io/apimachinery/pkg/util/errors with errors.Join (#3552)

2026-09-30 17:26:31 +02:00

providers

chore(deps): replace k8s.io/apimachinery/pkg/util/errors with errors.Join (#3552)

2026-09-30 17:26:31 +02:00

proxyhttp

feat: add support for setting a unix binding's socket file mode (#3376)

2026-03-19 00:08:50 +08:00

requests

Merge commit from fork

2026-10-01 09:30:09 +02:00

sessions

feat: add same site option for csrf cookies (#3347)

2026-03-18 23:14:36 +08:00

upstream

chore(deps): bump Go to 1.26 and migrate upstream reverse proxies to Rewrite

2026-06-08 14:12:56 +02:00

util

feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (#2685)

2026-03-14 12:04:33 +08:00

validation

Merge commit from fork

2026-10-01 10:42:18 +02:00

version

feat: Replace default Go user-agent with oauth2-proxy and version (#2570)

2024-07-14 21:09:17 +01:00

watcher

Fix Linting Errors (#1835)

2022-10-21 11:57:51 +01:00