diff --git a/001ca130.864ff6c9.js b/001ca130.e0bd119c.js
similarity index 98%
rename from 001ca130.864ff6c9.js
rename to 001ca130.e0bd119c.js
index a141eea4..deb6fcec 100644
--- a/001ca130.864ff6c9.js
+++ b/001ca130.e0bd119c.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[3],{57:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return s})),n.d(t,"default",(function(){return p}));var r=n(2),o=n(6),i=(n(0),n(96)),a={id:"endpoints",title:"Endpoints"},c={unversionedId:"features/endpoints",id:"version-7.0.x/features/endpoints",isDocsHomePage:!1,title:"Endpoints",description:"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.",source:"@site/versioned_docs/version-7.0.x/features/endpoints.md",slug:"/features/endpoints",permalink:"/oauth2-proxy/docs/features/endpoints",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/endpoints.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/configuration/alpha-config"},next:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/features/request_signatures"}},s=[{value:"Sign out",id:"sign-out",children:[]}],u={rightToc:s};function p(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(i.b)("p",null,"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2")," prefix can be changed with the ",Object(i.b)("inlineCode",{parentName:"p"},"--proxy-prefix")," config variable."),Object(i.b)("ul",null,Object(i.b)("li",{parentName:"ul"},"/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"http://www.robotstxt.org/"}),"robotstxt.org")," for more info"),Object(i.b)("li",{parentName:"ul"},"/ping - returns a 200 OK response, which is intended for use with health checks"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_out - this URL is used to clear the session cookie"),Object(i.b)("li",{parentName:"ul"},"/oauth2/start - a URL that will redirect to start the OAuth cycle"),Object(i.b)("li",{parentName:"ul"},"/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url."),Object(i.b)("li",{parentName:"ul"},"/oauth2/userinfo - the URL is used to return user's email from the session in JSON format."),Object(i.b)("li",{parentName:"ul"},"/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive"}),"Nginx ",Object(i.b)("inlineCode",{parentName:"a"},"auth_request")," directive"))),Object(i.b)("h3",{id:"sign-out"},"Sign out"),Object(i.b)("p",null,"To sign the user out, redirect them to ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2/sign_out"),". This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the ",Object(i.b)("inlineCode",{parentName:"p"},"rd")," query parameter, i.e. redirect the user to something like (notice the url-encoding!):"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page\n")),Object(i.b)("p",null,"Alternatively, include the redirect URL in the ",Object(i.b)("inlineCode",{parentName:"p"},"X-Auth-Request-Redirect")," header:"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"GET /oauth2/sign_out HTTP/1.1\nX-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page\n...\n")),Object(i.b)("p",null,'(The "sign_out_page" should be the ',Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1"}),Object(i.b)("inlineCode",{parentName:"a"},"end_session_endpoint"))," from ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig"}),"the metadata")," if your OIDC provider supports Session Management and Discovery.)"),Object(i.b)("p",null,"BEWARE that the domain you want to redirect to (",Object(i.b)("inlineCode",{parentName:"p"},"my-oidc-provider.example.com")," in the example) must be added to the ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"../configuration/overview"}),Object(i.b)("inlineCode",{parentName:"a"},"--whitelist-domain"))," configuration option otherwise the redirect will be ignored."))}p.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u<i;u++)a[u]=n[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,n)}h.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[3],{57:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return s})),n.d(t,"default",(function(){return p}));var r=n(2),o=n(6),i=(n(0),n(95)),a={id:"endpoints",title:"Endpoints"},c={unversionedId:"features/endpoints",id:"version-7.0.x/features/endpoints",isDocsHomePage:!1,title:"Endpoints",description:"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.",source:"@site/versioned_docs/version-7.0.x/features/endpoints.md",slug:"/features/endpoints",permalink:"/oauth2-proxy/docs/features/endpoints",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/endpoints.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/configuration/alpha-config"},next:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/features/request_signatures"}},s=[{value:"Sign out",id:"sign-out",children:[]}],u={rightToc:s};function p(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(i.b)("p",null,"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2")," prefix can be changed with the ",Object(i.b)("inlineCode",{parentName:"p"},"--proxy-prefix")," config variable."),Object(i.b)("ul",null,Object(i.b)("li",{parentName:"ul"},"/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"http://www.robotstxt.org/"}),"robotstxt.org")," for more info"),Object(i.b)("li",{parentName:"ul"},"/ping - returns a 200 OK response, which is intended for use with health checks"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_out - this URL is used to clear the session cookie"),Object(i.b)("li",{parentName:"ul"},"/oauth2/start - a URL that will redirect to start the OAuth cycle"),Object(i.b)("li",{parentName:"ul"},"/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url."),Object(i.b)("li",{parentName:"ul"},"/oauth2/userinfo - the URL is used to return user's email from the session in JSON format."),Object(i.b)("li",{parentName:"ul"},"/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive"}),"Nginx ",Object(i.b)("inlineCode",{parentName:"a"},"auth_request")," directive"))),Object(i.b)("h3",{id:"sign-out"},"Sign out"),Object(i.b)("p",null,"To sign the user out, redirect them to ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2/sign_out"),". This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the ",Object(i.b)("inlineCode",{parentName:"p"},"rd")," query parameter, i.e. redirect the user to something like (notice the url-encoding!):"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page\n")),Object(i.b)("p",null,"Alternatively, include the redirect URL in the ",Object(i.b)("inlineCode",{parentName:"p"},"X-Auth-Request-Redirect")," header:"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"GET /oauth2/sign_out HTTP/1.1\nX-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page\n...\n")),Object(i.b)("p",null,'(The "sign_out_page" should be the ',Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1"}),Object(i.b)("inlineCode",{parentName:"a"},"end_session_endpoint"))," from ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig"}),"the metadata")," if your OIDC provider supports Session Management and Discovery.)"),Object(i.b)("p",null,"BEWARE that the domain you want to redirect to (",Object(i.b)("inlineCode",{parentName:"p"},"my-oidc-provider.example.com")," in the example) must be added to the ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"../configuration/overview"}),Object(i.b)("inlineCode",{parentName:"a"},"--whitelist-domain"))," configuration option otherwise the redirect will be ignored."))}p.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u<i;u++)a[u]=n[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,n)}h.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/00691219.5a332c9c.js b/00691219.947d552d.js
similarity index 98%
rename from 00691219.5a332c9c.js
rename to 00691219.947d552d.js
index e7727612..4f73781d 100644
--- a/00691219.5a332c9c.js
+++ b/00691219.947d552d.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[4],{58:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return s}));var r=n(2),o=n(6),a=(n(0),n(96)),i={id:"tls",title:"TLS Configuration"},c={unversionedId:"configuration/tls",id:"version-7.0.x/configuration/tls",isDocsHomePage:!1,title:"TLS Configuration",description:"There are two recommended configurations.",source:"@site/versioned_docs/version-7.0.x/configuration/tls.md",slug:"/configuration/tls",permalink:"/oauth2-proxy/docs/configuration/tls",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/tls.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Session Storage",permalink:"/oauth2-proxy/docs/configuration/session_storage"},next:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/configuration/alpha-config"}},p=[],l={rightToc:p};function s(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("p",null,"There are two recommended configurations."),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with OAuth2 Proxy by providing a ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-cert-file=/path/to/cert.pem")," and ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-key-file=/path/to/cert.key"),"."),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n    --email-domain="yourcompany.com"  \\\n    --upstream=http://127.0.0.1:8080/ \\\n    --tls-cert-file=/path/to/cert.pem \\\n    --tls-key-file=/path/to/cert.key \\\n    --cookie-secret=... \\\n    --cookie-secure=true \\\n    --provider=... \\\n    --client-id=... \\\n    --client-secret=...\n'))),Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://nginx.org/"}),"Nginx")," (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...."),Object(a.b)("p",{parentName:"li"},"Because ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," listens on ",Object(a.b)("inlineCode",{parentName:"p"},"127.0.0.1:4180")," by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use ",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="0.0.0.0:4180"')," or\n",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="http://:4180"'),"."),Object(a.b)("p",{parentName:"li"},"Nginx will listen on port ",Object(a.b)("inlineCode",{parentName:"p"},"443")," and handle SSL connections while proxying to ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on port ",Object(a.b)("inlineCode",{parentName:"p"},"4180"),".\n",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," will then authenticate requests for an upstream application. The external endpoint for this example\nwould be ",Object(a.b)("inlineCode",{parentName:"p"},"https://internal.yourcompany.com/"),"."),Object(a.b)("p",{parentName:"li"},"An example Nginx config follows. Note the use of ",Object(a.b)("inlineCode",{parentName:"p"},"Strict-Transport-Security")," header to pin requests to SSL\nvia ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security"}),"HSTS"),":"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{}),"server {\n    listen 443 default ssl;\n    server_name internal.yourcompany.com;\n    ssl_certificate /path/to/cert.pem;\n    ssl_certificate_key /path/to/cert.key;\n    add_header Strict-Transport-Security max-age=2592000;\n\n    location / {\n        proxy_pass http://127.0.0.1:4180;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Scheme $scheme;\n        proxy_connect_timeout 1;\n        proxy_send_timeout 30;\n        proxy_read_timeout 30;\n    }\n}\n")),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n   --email-domain="yourcompany.com"  \\\n   --upstream=http://127.0.0.1:8080/ \\\n   --cookie-secret=... \\\n   --cookie-secure=true \\\n   --provider=... \\\n   --reverse-proxy=true \\\n   --client-id=... \\\n   --client-secret=...\n')))))}s.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<a;l++)i[l]=n[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[4],{58:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return s}));var r=n(2),o=n(6),a=(n(0),n(95)),i={id:"tls",title:"TLS Configuration"},c={unversionedId:"configuration/tls",id:"version-7.0.x/configuration/tls",isDocsHomePage:!1,title:"TLS Configuration",description:"There are two recommended configurations.",source:"@site/versioned_docs/version-7.0.x/configuration/tls.md",slug:"/configuration/tls",permalink:"/oauth2-proxy/docs/configuration/tls",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/tls.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Session Storage",permalink:"/oauth2-proxy/docs/configuration/session_storage"},next:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/configuration/alpha-config"}},p=[],l={rightToc:p};function s(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("p",null,"There are two recommended configurations."),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with OAuth2 Proxy by providing a ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-cert-file=/path/to/cert.pem")," and ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-key-file=/path/to/cert.key"),"."),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n    --email-domain="yourcompany.com"  \\\n    --upstream=http://127.0.0.1:8080/ \\\n    --tls-cert-file=/path/to/cert.pem \\\n    --tls-key-file=/path/to/cert.key \\\n    --cookie-secret=... \\\n    --cookie-secure=true \\\n    --provider=... \\\n    --client-id=... \\\n    --client-secret=...\n'))),Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://nginx.org/"}),"Nginx")," (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...."),Object(a.b)("p",{parentName:"li"},"Because ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," listens on ",Object(a.b)("inlineCode",{parentName:"p"},"127.0.0.1:4180")," by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use ",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="0.0.0.0:4180"')," or\n",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="http://:4180"'),"."),Object(a.b)("p",{parentName:"li"},"Nginx will listen on port ",Object(a.b)("inlineCode",{parentName:"p"},"443")," and handle SSL connections while proxying to ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on port ",Object(a.b)("inlineCode",{parentName:"p"},"4180"),".\n",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," will then authenticate requests for an upstream application. The external endpoint for this example\nwould be ",Object(a.b)("inlineCode",{parentName:"p"},"https://internal.yourcompany.com/"),"."),Object(a.b)("p",{parentName:"li"},"An example Nginx config follows. Note the use of ",Object(a.b)("inlineCode",{parentName:"p"},"Strict-Transport-Security")," header to pin requests to SSL\nvia ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security"}),"HSTS"),":"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{}),"server {\n    listen 443 default ssl;\n    server_name internal.yourcompany.com;\n    ssl_certificate /path/to/cert.pem;\n    ssl_certificate_key /path/to/cert.key;\n    add_header Strict-Transport-Security max-age=2592000;\n\n    location / {\n        proxy_pass http://127.0.0.1:4180;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Scheme $scheme;\n        proxy_connect_timeout 1;\n        proxy_send_timeout 30;\n        proxy_read_timeout 30;\n    }\n}\n")),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n   --email-domain="yourcompany.com"  \\\n   --upstream=http://127.0.0.1:8080/ \\\n   --cookie-secret=... \\\n   --cookie-secure=true \\\n   --provider=... \\\n   --reverse-proxy=true \\\n   --client-id=... \\\n   --client-secret=...\n')))))}s.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<a;l++)i[l]=n[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/0721a2c0.c40b0d06.js b/0721a2c0.31d87bed.js
similarity index 97%
rename from 0721a2c0.c40b0d06.js
rename to 0721a2c0.31d87bed.js
index 7f845435..3d0a1fad 100644
--- a/0721a2c0.c40b0d06.js
+++ b/0721a2c0.31d87bed.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[5],{59:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return p})),r.d(t,"default",(function(){return u}));var n=r(2),o=r(6),a=(r(0),r(96)),i={id:"installation",title:"Installation",slug:"/"},c={unversionedId:"installation",id:"version-7.0.x/installation",isDocsHomePage:!1,title:"Installation",description:"1.  Choose how to deploy:",source:"@site/versioned_docs/version-7.0.x/installation.md",slug:"/",permalink:"/oauth2-proxy/docs/",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/installation.md",version:"7.0.x",sidebar:"version-7.0.x/docs",next:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"}},p=[],l={rightToc:p};function u(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(n.a)({},l,r,{components:t,mdxType:"MDXLayout"}),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Choose how to deploy:"),Object(a.b)("p",{parentName:"li"},"a. Download ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/releases"}),"Prebuilt Binary")," (current release is ",Object(a.b)("inlineCode",{parentName:"p"},"v7.0.1"),")"),Object(a.b)("p",{parentName:"li"},"b. Build with ",Object(a.b)("inlineCode",{parentName:"p"},"$ go get github.com/oauth2-proxy/oauth2-proxy/v7")," which will put the binary in ",Object(a.b)("inlineCode",{parentName:"p"},"$GOPATH/bin")),Object(a.b)("p",{parentName:"li"},"c. Using the prebuilt docker image ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://quay.io/oauth2-proxy/oauth2-proxy"}),"quay.io/oauth2-proxy/oauth2-proxy")," (AMD64, ARMv6 and ARM64 tags available)"))),Object(a.b)("p",null,"Prebuilt binaries can be validated by extracting the file and verifying it against the ",Object(a.b)("inlineCode",{parentName:"p"},"sha256sum.txt")," checksum file provided for each release starting with version ",Object(a.b)("inlineCode",{parentName:"p"},"v3.0.0"),"."),Object(a.b)("pre",null,Object(a.b)("code",Object(n.a)({parentName:"pre"},{}),"$ sha256sum -c sha256sum.txt 2>&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(a.b)("ol",{start:2},Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return b})),r.d(t,"b",(function(){return m}));var n=r(0),o=r.n(n);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){a(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function p(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},a=Object.keys(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var l=o.a.createContext({}),u=function(e){var t=o.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},d=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||a;return r?o.a.createElement(m,c(c({ref:t},l),{},{components:r})):o.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var a=r.length,i=new Array(a);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l<a;l++)i[l]=r[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[5],{59:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return p})),r.d(t,"default",(function(){return u}));var n=r(2),o=r(6),a=(r(0),r(95)),i={id:"installation",title:"Installation",slug:"/"},c={unversionedId:"installation",id:"version-7.0.x/installation",isDocsHomePage:!1,title:"Installation",description:"1.  Choose how to deploy:",source:"@site/versioned_docs/version-7.0.x/installation.md",slug:"/",permalink:"/oauth2-proxy/docs/",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/installation.md",version:"7.0.x",sidebar:"version-7.0.x/docs",next:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"}},p=[],l={rightToc:p};function u(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(n.a)({},l,r,{components:t,mdxType:"MDXLayout"}),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Choose how to deploy:"),Object(a.b)("p",{parentName:"li"},"a. Download ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/releases"}),"Prebuilt Binary")," (current release is ",Object(a.b)("inlineCode",{parentName:"p"},"v7.0.1"),")"),Object(a.b)("p",{parentName:"li"},"b. Build with ",Object(a.b)("inlineCode",{parentName:"p"},"$ go get github.com/oauth2-proxy/oauth2-proxy/v7")," which will put the binary in ",Object(a.b)("inlineCode",{parentName:"p"},"$GOPATH/bin")),Object(a.b)("p",{parentName:"li"},"c. Using the prebuilt docker image ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://quay.io/oauth2-proxy/oauth2-proxy"}),"quay.io/oauth2-proxy/oauth2-proxy")," (AMD64, ARMv6 and ARM64 tags available)"))),Object(a.b)("p",null,"Prebuilt binaries can be validated by extracting the file and verifying it against the ",Object(a.b)("inlineCode",{parentName:"p"},"sha256sum.txt")," checksum file provided for each release starting with version ",Object(a.b)("inlineCode",{parentName:"p"},"v3.0.0"),"."),Object(a.b)("pre",null,Object(a.b)("code",Object(n.a)({parentName:"pre"},{}),"$ sha256sum -c sha256sum.txt 2>&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(a.b)("ol",{start:2},Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0},95:function(e,t,r){"use strict";r.d(t,"a",(function(){return b})),r.d(t,"b",(function(){return m}));var n=r(0),o=r.n(n);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){a(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function p(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},a=Object.keys(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var l=o.a.createContext({}),u=function(e){var t=o.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},d=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||a;return r?o.a.createElement(m,c(c({ref:t},l),{},{components:r})):o.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var a=r.length,i=new Array(a);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l<a;l++)i[l]=r[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/0f425520.6e17044c.js b/0f425520.f6f59f9b.js
similarity index 99%
rename from 0f425520.6e17044c.js
rename to 0f425520.f6f59f9b.js
index ac53e95f..9ceaeb5a 100644
--- a/0f425520.6e17044c.js
+++ b/0f425520.f6f59f9b.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[6],{60:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),b=(a(0),a(96)),l={id:"overview",title:"Overview"},i={unversionedId:"configuration/overview",id:"configuration/overview",isDocsHomePage:!1,title:"Overview",description:"oauth2-proxy can be configured via config file, command line options or environment variables.",source:"@site/docs/configuration/overview.md",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/next/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md",version:"current",sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/next/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider"}},c=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[]},{value:"Config File",id:"config-file",children:[]},{value:"Command Line Options",id:"command-line-options",children:[]},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[]},{value:"Environment variables",id:"environment-variables",children:[]},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[]},{value:"Request Log Format",id:"request-log-format",children:[]},{value:"Standard Log Format",id:"standard-log-format",children:[]}]},{value:"Configuring for use with the Nginx <code>auth_request</code> directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables"),"."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'path to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-paths")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the groups to be set on sessions for htpasswd users"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]<addr>:<port>")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://<path>")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"<addr>:<port>")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the address prometheus metrics will be scraped from"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"<oauth2>/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/next/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--show-debug-on-error")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://<status_code>")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>\n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),'<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>\n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>\n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n  listen 443 ssl;\n  server_name ...;\n  include ssl/ssl.conf;\n\n  location /oauth2/ {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host                    $host;\n    proxy_set_header X-Real-IP               $remote_addr;\n    proxy_set_header X-Scheme                $scheme;\n    proxy_set_header X-Auth-Request-Redirect $request_uri;\n    # or, if you are handling multiple domains:\n    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n  }\n  location = /oauth2/auth {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host             $host;\n    proxy_set_header X-Real-IP        $remote_addr;\n    proxy_set_header X-Scheme         $scheme;\n    # nginx auth_request includes headers but not body\n    proxy_set_header Content-Length   "";\n    proxy_pass_request_body           off;\n  }\n\n  location / {\n    auth_request /oauth2/auth;\n    error_page 401 = /oauth2/sign_in;\n\n    # pass information via X-User and X-Email headers to backend,\n    # requires running with --set-xauthrequest flag\n    auth_request_set $user   $upstream_http_x_auth_request_user;\n    auth_request_set $email  $upstream_http_x_auth_request_email;\n    proxy_set_header X-User  $user;\n    proxy_set_header X-Email $email;\n\n    # if you enabled --pass-access-token, this will pass the token to the backend\n    auth_request_set $token  $upstream_http_x_auth_request_access_token;\n    proxy_set_header X-Access-Token $token;\n\n    # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n    auth_request_set $auth_cookie $upstream_http_set_cookie;\n    add_header Set-Cookie $auth_cookie;\n\n    # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n    # limit and so the OAuth2 Proxy splits these into multiple parts.\n    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n    # Extract the Cookie attributes from the first Set-Cookie header and append them\n    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n    if ($auth_cookie ~* "(; .*)") {\n        set $auth_cookie_name_0 $auth_cookie;\n        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n    }\n\n    # Send both Set-Cookie headers now if there was a second part\n    if ($auth_cookie_name_upstream_1) {\n        add_header Set-Cookie $auth_cookie_name_0;\n        add_header Set-Cookie $auth_cookie_name_1;\n    }\n\n    proxy_pass http://backend/;\n    # or "root /path/to/site;" or "fastcgi_pass ..." etc\n  }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n  auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n  access_by_lua_block {\n    if ngx.var.name_upstream_1 ~= "" then\n      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n    end\n  }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service:\n      rule: "Host(`a-service.example.com`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-errors\n        - oauth-auth\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth:\n      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n    oauth-errors:\n      errors:\n        status:\n          - "401-403"\n        service: oauth-backend\n        query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service-route-1:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    a-service-route-2:\n      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-wo-redirect # unauthenticated session will return a 401\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    services-oauth2-route:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth2-proxy-route:\n      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    b-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.3:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n    oauth-auth-wo-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},O={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},s=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),s=n,j=p["".concat(l,".").concat(s)]||p[s]||O[s]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=s;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}s.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[6],{60:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),b=(a(0),a(95)),l={id:"overview",title:"Overview"},i={unversionedId:"configuration/overview",id:"configuration/overview",isDocsHomePage:!1,title:"Overview",description:"oauth2-proxy can be configured via config file, command line options or environment variables.",source:"@site/docs/configuration/overview.md",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/next/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md",version:"current",sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/next/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider"}},c=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[]},{value:"Config File",id:"config-file",children:[]},{value:"Command Line Options",id:"command-line-options",children:[]},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[]},{value:"Environment variables",id:"environment-variables",children:[]},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[]},{value:"Request Log Format",id:"request-log-format",children:[]},{value:"Standard Log Format",id:"standard-log-format",children:[]}]},{value:"Configuring for use with the Nginx <code>auth_request</code> directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables"),"."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'path to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-paths")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the groups to be set on sessions for htpasswd users"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]<addr>:<port>")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://<path>")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"<addr>:<port>")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the address prometheus metrics will be scraped from"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"<oauth2>/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/next/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--show-debug-on-error")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://<status_code>")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>\n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),'<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>\n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>\n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n  listen 443 ssl;\n  server_name ...;\n  include ssl/ssl.conf;\n\n  location /oauth2/ {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host                    $host;\n    proxy_set_header X-Real-IP               $remote_addr;\n    proxy_set_header X-Scheme                $scheme;\n    proxy_set_header X-Auth-Request-Redirect $request_uri;\n    # or, if you are handling multiple domains:\n    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n  }\n  location = /oauth2/auth {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host             $host;\n    proxy_set_header X-Real-IP        $remote_addr;\n    proxy_set_header X-Scheme         $scheme;\n    # nginx auth_request includes headers but not body\n    proxy_set_header Content-Length   "";\n    proxy_pass_request_body           off;\n  }\n\n  location / {\n    auth_request /oauth2/auth;\n    error_page 401 = /oauth2/sign_in;\n\n    # pass information via X-User and X-Email headers to backend,\n    # requires running with --set-xauthrequest flag\n    auth_request_set $user   $upstream_http_x_auth_request_user;\n    auth_request_set $email  $upstream_http_x_auth_request_email;\n    proxy_set_header X-User  $user;\n    proxy_set_header X-Email $email;\n\n    # if you enabled --pass-access-token, this will pass the token to the backend\n    auth_request_set $token  $upstream_http_x_auth_request_access_token;\n    proxy_set_header X-Access-Token $token;\n\n    # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n    auth_request_set $auth_cookie $upstream_http_set_cookie;\n    add_header Set-Cookie $auth_cookie;\n\n    # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n    # limit and so the OAuth2 Proxy splits these into multiple parts.\n    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n    # Extract the Cookie attributes from the first Set-Cookie header and append them\n    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n    if ($auth_cookie ~* "(; .*)") {\n        set $auth_cookie_name_0 $auth_cookie;\n        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n    }\n\n    # Send both Set-Cookie headers now if there was a second part\n    if ($auth_cookie_name_upstream_1) {\n        add_header Set-Cookie $auth_cookie_name_0;\n        add_header Set-Cookie $auth_cookie_name_1;\n    }\n\n    proxy_pass http://backend/;\n    # or "root /path/to/site;" or "fastcgi_pass ..." etc\n  }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n  auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n  access_by_lua_block {\n    if ngx.var.name_upstream_1 ~= "" then\n      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n    end\n  }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service:\n      rule: "Host(`a-service.example.com`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-errors\n        - oauth-auth\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth:\n      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n    oauth-errors:\n      errors:\n        status:\n          - "401-403"\n        service: oauth-backend\n        query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service-route-1:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    a-service-route-2:\n      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-wo-redirect # unauthenticated session will return a 401\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    services-oauth2-route:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth2-proxy-route:\n      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    b-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.3:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n    oauth-auth-wo-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},O={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},s=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),s=n,j=p["".concat(l,".").concat(s)]||p[s]||O[s]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=s;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}s.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/1.07b9992e.js b/1.07b9992e.js
new file mode 100644
index 00000000..e57ffcc8
--- /dev/null
+++ b/1.07b9992e.js
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[1],{100:function(e,t,n){"use strict";var r=n(0),o=n.n(r),i=n(13),a=n(103),u=n(9),c=Object(r.createContext)({collectLink:function(){}}),s=n(101),f=function(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&t.indexOf(r)<0&&(n[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var o=0;for(r=Object.getOwnPropertySymbols(e);o<r.length;o++)t.indexOf(r[o])<0&&Object.prototype.propertyIsEnumerable.call(e,r[o])&&(n[r[o]]=e[r[o]])}return n};t.a=function(e){var t,n,l,d=e.isNavLink,p=e.to,v=e.href,h=e.activeClassName,b=e.isActive,g=e["data-noBrokenLinkCheck"],y=f(e,["isNavLink","to","href","activeClassName","isActive","data-noBrokenLinkCheck"]),m=Object(s.b)().withBaseUrl,w=Object(r.useContext)(c),T=p||v,O=Object(a.a)(T),A=null==T?void 0:T.replace("pathname://",""),C=void 0!==A?function(e){return e.startsWith("/")}(n=A)?m(n):n:void 0,j=Object(r.useRef)(!1),E=d?i.e:i.c,S=u.a.canUseIntersectionObserver;Object(r.useEffect)((function(){return!S&&O&&window.docusaurus.prefetch(C),function(){S&&l&&l.disconnect()}}),[C,S,O]);var P=null!==(t=null==C?void 0:C.startsWith("#"))&&void 0!==t&&t,D=!C||!O||P;return C&&O&&!P&&!g&&w.collectLink(C),D?o.a.createElement("a",Object.assign({href:C},T&&!O&&{target:"_blank",rel:"noopener noreferrer"},y)):o.a.createElement(E,Object.assign({},y,{onMouseEnter:function(){j.current||(window.docusaurus.preload(C),j.current=!0)},innerRef:function(e){var t,n;S&&e&&O&&(t=e,n=function(){window.docusaurus.prefetch(C)},(l=new window.IntersectionObserver((function(e){e.forEach((function(e){t===e.target&&(e.isIntersecting||e.intersectionRatio>0)&&(l.unobserve(t),l.disconnect(),n())}))}))).observe(t))},to:C||""},d&&{isActive:b,activeClassName:h}))}},101:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"a",(function(){return a}));var r=n(98),o=n(103);function i(){var e=Object(r.a)().siteConfig,t=(e=void 0===e?{}:e).baseUrl,n=void 0===t?"/":t,i=e.url;return{withBaseUrl:function(e,t){return function(e,t,n,r){var i=void 0===r?{}:r,a=i.forcePrependBaseUrl,u=void 0!==a&&a,c=i.absolute,s=void 0!==c&&c;if(!n)return n;if(n.startsWith("#"))return n;if(Object(o.b)(n))return n;if(u)return t+n;var f=n.startsWith(t)?n:t+n.replace(/^\//,"");return s?e+f:f}(i,n,e,t)}}}function a(e,t){return void 0===t&&(t={}),(0,i().withBaseUrl)(e,t)}},102:function(e,t,n){"use strict";n.r(t);var r=n(13);n.d(t,"MemoryRouter",(function(){return r.d})),n.d(t,"Prompt",(function(){return r.f})),n.d(t,"Redirect",(function(){return r.g})),n.d(t,"Route",(function(){return r.h})),n.d(t,"Router",(function(){return r.i})),n.d(t,"StaticRouter",(function(){return r.j})),n.d(t,"Switch",(function(){return r.k})),n.d(t,"generatePath",(function(){return r.l})),n.d(t,"matchPath",(function(){return r.m})),n.d(t,"useHistory",(function(){return r.n})),n.d(t,"useLocation",(function(){return r.o})),n.d(t,"useParams",(function(){return r.p})),n.d(t,"useRouteMatch",(function(){return r.q})),n.d(t,"withRouter",(function(){return r.r})),n.d(t,"BrowserRouter",(function(){return r.a})),n.d(t,"HashRouter",(function(){return r.b})),n.d(t,"Link",(function(){return r.c})),n.d(t,"NavLink",(function(){return r.e}))},103:function(e,t,n){"use strict";function r(e){return!0===/^(\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return o}))},107:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));var r=n(0),o=n(123),i=n(99);function a(e){void 0===e&&(e="default");var t=Object(i.useDocsData)(e),n=Object(o.b)(),a=n[0],u=n[1],c=a[e].preferredVersionName;return{preferredVersion:c?t.versions.find((function(e){return e.name===c})):null,savePreferredVersionName:Object(r.useCallback)((function(t){u.savePreferredVersion(e,t)}),[u])}}},108:function(e,t,n){"use strict";var r=n(0),o=n.n(r),i=n(135);t.a=function(e){return o.a.createElement(i.a,Object.assign({},e))}},123:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return h}));var r=n(0),o=n.n(r),i=n(96),a=n(99),u=!!a.useAllDocsData,c=function(e){return"docs-preferred-version-"+e},s={save:function(e,t,n){"none"===t||window.localStorage.setItem(c(e),n)},read:function(e,t){return"none"===t?null:window.localStorage.getItem(c(e))},clear:function(e,t){"none"===t||window.localStorage.removeItem(c(e))}};function f(e){var t=e.pluginIds,n=e.versionPersistence,r=e.allDocsData;var o={};return t.forEach((function(e){o[e]=function(e){var t=s.read(e,n);return r[e].versions.some((function(e){return e.name===t}))?{preferredVersionName:t}:(s.clear(e,n),{preferredVersionName:null})}(e)})),o}function l(){var e=Object(a.useAllDocsData)(),t=Object(i.a)().docs.versionPersistence,n=Object(r.useMemo)((function(){return Object.keys(e)}),[e]),o=Object(r.useState)((function(){return function(e){var t={};return e.forEach((function(e){t[e]={preferredVersionName:null}})),t}(n)})),u=o[0],c=o[1];return Object(r.useEffect)((function(){c(f({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]),[u,Object(r.useMemo)((function(){return{savePreferredVersion:function(e,n){s.save(e,t,n),c((function(t){var r;return Object.assign({},t,((r={})[e]={preferredVersionName:n},r))}))}}}),[c])]}var d=Object(r.createContext)(null);function p(e){var t=e.children;return u?o.a.createElement(v,null,t):o.a.createElement(o.a.Fragment,null,t)}function v(e){var t=e.children,n=l();return o.a.createElement(d.Provider,{value:n},t)}function h(){var e=Object(r.useContext)(d);if(!e)throw new Error("Can't find docs preferred context, maybe you forgot to use the DocsPreferredVersionContextProvider ?");return e}},130:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useDocVersionSuggestions=t.useActiveDocContext=t.useActiveVersion=t.useLatestVersion=t.useVersions=t.useActivePluginAndVersion=t.useActivePlugin=t.useDocsData=t.useAllDocsData=void 0;var r=n(102),o=n(131),i=n(132);t.useAllDocsData=function(){return o.useAllPluginInstancesData("docusaurus-plugin-content-docs")},t.useDocsData=function(e){return o.usePluginData("docusaurus-plugin-content-docs",e)},t.useActivePlugin=function(e){void 0===e&&(e={});var n=t.useAllDocsData(),o=r.useLocation().pathname;return i.getActivePlugin(n,o,e)},t.useActivePluginAndVersion=function(e){void 0===e&&(e={});var n=t.useActivePlugin(e),o=r.useLocation().pathname;if(n)return{activePlugin:n,activeVersion:i.getActiveVersion(n.pluginData,o)}},t.useVersions=function(e){return t.useDocsData(e).versions},t.useLatestVersion=function(e){var n=t.useDocsData(e);return i.getLatestVersion(n)},t.useActiveVersion=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getActiveVersion(n,o)},t.useActiveDocContext=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getActiveDocContext(n,o)},t.useDocVersionSuggestions=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getDocVersionSuggestions(n,o)}},131:function(e,t,n){"use strict";n.r(t),n.d(t,"default",(function(){return o})),n.d(t,"useAllPluginInstancesData",(function(){return i})),n.d(t,"usePluginData",(function(){return a}));var r=n(98);function o(){var e=Object(r.a)().globalData;if(!e)throw new Error("Docusaurus global data not found");return e}function i(e){var t=o()[e];if(!t)throw new Error("Docusaurus plugin global data not found for pluginName="+e);return t}function a(e,t){void 0===t&&(t="default");var n=i(e)[t];if(!n)throw new Error("Docusaurus plugin global data not found for pluginName="+e+" and pluginId="+t);return n}},132:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getDocVersionSuggestions=t.getActiveDocContext=t.getActiveVersion=t.getLatestVersion=t.getActivePlugin=void 0;var r=n(102);t.getActivePlugin=function(e,t,n){void 0===n&&(n={});var o=Object.entries(e).find((function(e){e[0];var n=e[1];return!!r.matchPath(t,{path:n.path,exact:!1,strict:!1})})),i=o?{pluginId:o[0],pluginData:o[1]}:void 0;if(!i&&n.failfast)throw new Error("Can't find active docs plugin for pathname="+t+", while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: "+Object.values(e).map((function(e){return e.path})).join(", "));return i},t.getLatestVersion=function(e){return e.versions.find((function(e){return e.isLast}))},t.getActiveVersion=function(e,n){var o=t.getLatestVersion(e);return[].concat(e.versions.filter((function(e){return e!==o})),[o]).find((function(e){return!!r.matchPath(n,{path:e.path,exact:!1,strict:!1})}))},t.getActiveDocContext=function(e,n){var o,i,a=t.getActiveVersion(e,n),u=null==a?void 0:a.docs.find((function(e){return!!r.matchPath(n,{path:e.path,exact:!0,strict:!1})}));return{activeVersion:a,activeDoc:u,alternateDocVersions:u?(o=u.id,i={},e.versions.forEach((function(e){e.docs.forEach((function(t){t.id===o&&(i[e.name]=t)}))})),i):{}}},t.getDocVersionSuggestions=function(e,n){var r=t.getLatestVersion(e),o=t.getActiveDocContext(e,n),i=o.activeVersion!==r;return{latestDocSuggestion:i?null==o?void 0:o.alternateDocVersions[r.name]:void 0,latestVersionSuggestion:i?r:void 0}}},135:function(e,t,n){"use strict";(function(e){n.d(t,"a",(function(){return be}));var r,o,i,a,u=n(7),c=n.n(u),s=n(136),f=n.n(s),l=n(137),d=n.n(l),p=n(0),v=n.n(p),h=n(21),b=n.n(h),g="bodyAttributes",y="htmlAttributes",m="titleAttributes",w={BASE:"base",BODY:"body",HEAD:"head",HTML:"html",LINK:"link",META:"meta",NOSCRIPT:"noscript",SCRIPT:"script",STYLE:"style",TITLE:"title"},T=(Object.keys(w).map((function(e){return w[e]})),"charset"),O="cssText",A="href",C="http-equiv",j="innerHTML",E="itemprop",S="name",P="property",D="rel",L="src",x="target",k={accesskey:"accessKey",charset:"charSet",class:"className",contenteditable:"contentEditable",contextmenu:"contextMenu","http-equiv":"httpEquiv",itemprop:"itemProp",tabindex:"tabIndex"},I="defaultTitle",V="defer",N="encodeSpecialCharacters",M="onChangeClientState",R="titleTemplate",_=Object.keys(k).reduce((function(e,t){return e[k[t]]=t,e}),{}),B=[w.NOSCRIPT,w.SCRIPT,w.STYLE],H="data-react-helmet",U="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},q=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")},F=function(){function e(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,r.key,r)}}return function(t,n,r){return n&&e(t.prototype,n),r&&e(t,r),t}}(),Y=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},W=function(e,t){var n={};for(var r in e)t.indexOf(r)>=0||Object.prototype.hasOwnProperty.call(e,r)&&(n[r]=e[r]);return n},z=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t},K=function(e){var t=!(arguments.length>1&&void 0!==arguments[1])||arguments[1];return!1===t?String(e):String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#x27;")},J=function(e){var t=Z(e,w.TITLE),n=Z(e,R);if(n&&t)return n.replace(/%s/g,(function(){return Array.isArray(t)?t.join(""):t}));var r=Z(e,I);return t||r||void 0},$=function(e){return Z(e,M)||function(){}},G=function(e,t){return t.filter((function(t){return void 0!==t[e]})).map((function(t){return t[e]})).reduce((function(e,t){return Y({},e,t)}),{})},Q=function(e,t){return t.filter((function(e){return void 0!==e[w.BASE]})).map((function(e){return e[w.BASE]})).reverse().reduce((function(t,n){if(!t.length)for(var r=Object.keys(n),o=0;o<r.length;o++){var i=r[o].toLowerCase();if(-1!==e.indexOf(i)&&n[i])return t.concat(n)}return t}),[])},X=function(e,t,n){var r={};return n.filter((function(t){return!!Array.isArray(t[e])||(void 0!==t[e]&&oe("Helmet: "+e+' should be of type "Array". Instead found type "'+U(t[e])+'"'),!1)})).map((function(t){return t[e]})).reverse().reduce((function(e,n){var o={};n.filter((function(e){for(var n=void 0,i=Object.keys(e),a=0;a<i.length;a++){var u=i[a],c=u.toLowerCase();-1===t.indexOf(c)||n===D&&"canonical"===e[n].toLowerCase()||c===D&&"stylesheet"===e[c].toLowerCase()||(n=c),-1===t.indexOf(u)||u!==j&&u!==O&&u!==E||(n=u)}if(!n||!e[n])return!1;var s=e[n].toLowerCase();return r[n]||(r[n]={}),o[n]||(o[n]={}),!r[n][s]&&(o[n][s]=!0,!0)})).reverse().forEach((function(t){return e.push(t)}));for(var i=Object.keys(o),a=0;a<i.length;a++){var u=i[a],c=b()({},r[u],o[u]);r[u]=c}return e}),[]).reverse()},Z=function(e,t){for(var n=e.length-1;n>=0;n--){var r=e[n];if(r.hasOwnProperty(t))return r[t]}return null},ee=(r=Date.now(),function(e){var t=Date.now();t-r>16?(r=t,e(t)):setTimeout((function(){ee(e)}),0)}),te=function(e){return clearTimeout(e)},ne="undefined"!=typeof window?window.requestAnimationFrame&&window.requestAnimationFrame.bind(window)||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||ee:e.requestAnimationFrame||ee,re="undefined"!=typeof window?window.cancelAnimationFrame||window.webkitCancelAnimationFrame||window.mozCancelAnimationFrame||te:e.cancelAnimationFrame||te,oe=function(e){return console&&"function"==typeof console.warn&&console.warn(e)},ie=null,ae=function(e,t){var n=e.baseTag,r=e.bodyAttributes,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.onChangeClientState,s=e.scriptTags,f=e.styleTags,l=e.title,d=e.titleAttributes;se(w.BODY,r),se(w.HTML,o),ce(l,d);var p={baseTag:fe(w.BASE,n),linkTags:fe(w.LINK,i),metaTags:fe(w.META,a),noscriptTags:fe(w.NOSCRIPT,u),scriptTags:fe(w.SCRIPT,s),styleTags:fe(w.STYLE,f)},v={},h={};Object.keys(p).forEach((function(e){var t=p[e],n=t.newTags,r=t.oldTags;n.length&&(v[e]=n),r.length&&(h[e]=p[e].oldTags)})),t&&t(),c(e,v,h)},ue=function(e){return Array.isArray(e)?e.join(""):e},ce=function(e,t){void 0!==e&&document.title!==e&&(document.title=ue(e)),se(w.TITLE,t)},se=function(e,t){var n=document.getElementsByTagName(e)[0];if(n){for(var r=n.getAttribute(H),o=r?r.split(","):[],i=[].concat(o),a=Object.keys(t),u=0;u<a.length;u++){var c=a[u],s=t[c]||"";n.getAttribute(c)!==s&&n.setAttribute(c,s),-1===o.indexOf(c)&&o.push(c);var f=i.indexOf(c);-1!==f&&i.splice(f,1)}for(var l=i.length-1;l>=0;l--)n.removeAttribute(i[l]);o.length===i.length?n.removeAttribute(H):n.getAttribute(H)!==a.join(",")&&n.setAttribute(H,a.join(","))}},fe=function(e,t){var n=document.head||document.querySelector(w.HEAD),r=n.querySelectorAll(e+"["+"data-react-helmet]"),o=Array.prototype.slice.call(r),i=[],a=void 0;return t&&t.length&&t.forEach((function(t){var n=document.createElement(e);for(var r in t)if(t.hasOwnProperty(r))if(r===j)n.innerHTML=t.innerHTML;else if(r===O)n.styleSheet?n.styleSheet.cssText=t.cssText:n.appendChild(document.createTextNode(t.cssText));else{var u=void 0===t[r]?"":t[r];n.setAttribute(r,u)}n.setAttribute(H,"true"),o.some((function(e,t){return a=t,n.isEqualNode(e)}))?o.splice(a,1):i.push(n)})),o.forEach((function(e){return e.parentNode.removeChild(e)})),i.forEach((function(e){return n.appendChild(e)})),{oldTags:o,newTags:i}},le=function(e){return Object.keys(e).reduce((function(t,n){var r=void 0!==e[n]?n+'="'+e[n]+'"':""+n;return t?t+" "+r:r}),"")},de=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[k[n]||n]=e[n],t}),t)},pe=function(e,t,n){switch(e){case w.TITLE:return{toComponent:function(){return e=t.title,n=t.titleAttributes,(r={key:e})[H]=!0,o=de(n,r),[v.a.createElement(w.TITLE,o,e)];var e,n,r,o},toString:function(){return function(e,t,n,r){var o=le(n),i=ue(t);return o?"<"+e+' data-react-helmet="true" '+o+">"+K(i,r)+"</"+e+">":"<"+e+' data-react-helmet="true">'+K(i,r)+"</"+e+">"}(e,t.title,t.titleAttributes,n)}};case g:case y:return{toComponent:function(){return de(t)},toString:function(){return le(t)}};default:return{toComponent:function(){return function(e,t){return t.map((function(t,n){var r,o=((r={key:n})[H]=!0,r);return Object.keys(t).forEach((function(e){var n=k[e]||e;if(n===j||n===O){var r=t.innerHTML||t.cssText;o.dangerouslySetInnerHTML={__html:r}}else o[n]=t[e]})),v.a.createElement(e,o)}))}(e,t)},toString:function(){return function(e,t,n){return t.reduce((function(t,r){var o=Object.keys(r).filter((function(e){return!(e===j||e===O)})).reduce((function(e,t){var o=void 0===r[t]?t:t+'="'+K(r[t],n)+'"';return e?e+" "+o:o}),""),i=r.innerHTML||r.cssText||"",a=-1===B.indexOf(e);return t+"<"+e+' data-react-helmet="true" '+o+(a?"/>":">"+i+"</"+e+">")}),"")}(e,t,n)}}}},ve=function(e){var t=e.baseTag,n=e.bodyAttributes,r=e.encode,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.scriptTags,s=e.styleTags,f=e.title,l=void 0===f?"":f,d=e.titleAttributes;return{base:pe(w.BASE,t,r),bodyAttributes:pe(g,n,r),htmlAttributes:pe(y,o,r),link:pe(w.LINK,i,r),meta:pe(w.META,a,r),noscript:pe(w.NOSCRIPT,u,r),script:pe(w.SCRIPT,c,r),style:pe(w.STYLE,s,r),title:pe(w.TITLE,{title:l,titleAttributes:d},r)}},he=f()((function(e){return{baseTag:Q([A,x],e),bodyAttributes:G(g,e),defer:Z(e,V),encode:Z(e,N),htmlAttributes:G(y,e),linkTags:X(w.LINK,[D,A],e),metaTags:X(w.META,[S,T,C,P,E],e),noscriptTags:X(w.NOSCRIPT,[j],e),onChangeClientState:$(e),scriptTags:X(w.SCRIPT,[L,j],e),styleTags:X(w.STYLE,[O],e),title:J(e),titleAttributes:G(m,e)}}),(function(e){ie&&re(ie),e.defer?ie=ne((function(){ae(e,(function(){ie=null}))})):(ae(e),ie=null)}),ve)((function(){return null})),be=(o=he,a=i=function(e){function t(){return q(this,t),z(this,e.apply(this,arguments))}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(t,e),t.prototype.shouldComponentUpdate=function(e){return!d()(this.props,e)},t.prototype.mapNestedChildrenToProps=function(e,t){if(!t)return null;switch(e.type){case w.SCRIPT:case w.NOSCRIPT:return{innerHTML:t};case w.STYLE:return{cssText:t}}throw new Error("<"+e.type+" /> elements are self-closing and can not contain children. Refer to our API for more information.")},t.prototype.flattenArrayTypeChildren=function(e){var t,n=e.child,r=e.arrayTypeChildren,o=e.newChildProps,i=e.nestedChildren;return Y({},r,((t={})[n.type]=[].concat(r[n.type]||[],[Y({},o,this.mapNestedChildrenToProps(n,i))]),t))},t.prototype.mapObjectTypeChildren=function(e){var t,n,r=e.child,o=e.newProps,i=e.newChildProps,a=e.nestedChildren;switch(r.type){case w.TITLE:return Y({},o,((t={})[r.type]=a,t.titleAttributes=Y({},i),t));case w.BODY:return Y({},o,{bodyAttributes:Y({},i)});case w.HTML:return Y({},o,{htmlAttributes:Y({},i)})}return Y({},o,((n={})[r.type]=Y({},i),n))},t.prototype.mapArrayTypeChildrenToProps=function(e,t){var n=Y({},t);return Object.keys(e).forEach((function(t){var r;n=Y({},n,((r={})[t]=e[t],r))})),n},t.prototype.warnOnInvalidChildren=function(e,t){return!0},t.prototype.mapChildrenToProps=function(e,t){var n=this,r={};return v.a.Children.forEach(e,(function(e){if(e&&e.props){var o=e.props,i=o.children,a=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[_[n]||n]=e[n],t}),t)}(W(o,["children"]));switch(n.warnOnInvalidChildren(e,i),e.type){case w.LINK:case w.META:case w.NOSCRIPT:case w.SCRIPT:case w.STYLE:r=n.flattenArrayTypeChildren({child:e,arrayTypeChildren:r,newChildProps:a,nestedChildren:i});break;default:t=n.mapObjectTypeChildren({child:e,newProps:t,newChildProps:a,nestedChildren:i})}}})),t=this.mapArrayTypeChildrenToProps(r,t)},t.prototype.render=function(){var e=this.props,t=e.children,n=W(e,["children"]),r=Y({},n);return t&&(r=this.mapChildrenToProps(t,r)),v.a.createElement(o,r)},F(t,null,[{key:"canUseDOM",set:function(e){o.canUseDOM=e}}]),t}(v.a.Component),i.propTypes={base:c.a.object,bodyAttributes:c.a.object,children:c.a.oneOfType([c.a.arrayOf(c.a.node),c.a.node]),defaultTitle:c.a.string,defer:c.a.bool,encodeSpecialCharacters:c.a.bool,htmlAttributes:c.a.object,link:c.a.arrayOf(c.a.object),meta:c.a.arrayOf(c.a.object),noscript:c.a.arrayOf(c.a.object),onChangeClientState:c.a.func,script:c.a.arrayOf(c.a.object),style:c.a.arrayOf(c.a.object),title:c.a.string,titleAttributes:c.a.object,titleTemplate:c.a.string},i.defaultProps={defer:!0,encodeSpecialCharacters:!0},i.peek=o.peek,i.rewind=function(){var e=o.rewind();return e||(e=ve({baseTag:[],bodyAttributes:{},encodeSpecialCharacters:!0,htmlAttributes:{},linkTags:[],metaTags:[],noscriptTags:[],scriptTags:[],styleTags:[],title:"",titleAttributes:{}})),e},a);be.renderStatic=be.rewind}).call(this,n(29))},136:function(e,t,n){"use strict";var r,o=n(0),i=(r=o)&&"object"==typeof r&&"default"in r?r.default:r;function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var u=!("undefined"==typeof window||!window.document||!window.document.createElement);e.exports=function(e,t,n){if("function"!=typeof e)throw new Error("Expected reducePropsToState to be a function.");if("function"!=typeof t)throw new Error("Expected handleStateChangeOnClient to be a function.");if(void 0!==n&&"function"!=typeof n)throw new Error("Expected mapStateOnServer to either be undefined or a function.");return function(r){if("function"!=typeof r)throw new Error("Expected WrappedComponent to be a React component.");var c,s=[];function f(){c=e(s.map((function(e){return e.props}))),l.canUseDOM?t(c):n&&(c=n(c))}var l=function(e){var t,n;function o(){return e.apply(this,arguments)||this}n=e,(t=o).prototype=Object.create(n.prototype),t.prototype.constructor=t,t.__proto__=n,o.peek=function(){return c},o.rewind=function(){if(o.canUseDOM)throw new Error("You may only call rewind() on the server. Call peek() to read the current state.");var e=c;return c=void 0,s=[],e};var a=o.prototype;return a.UNSAFE_componentWillMount=function(){s.push(this),f()},a.componentDidUpdate=function(){f()},a.componentWillUnmount=function(){var e=s.indexOf(this);s.splice(e,1),f()},a.render=function(){return i.createElement(r,this.props)},o}(o.PureComponent);return a(l,"displayName","SideEffect("+function(e){return e.displayName||e.name||"Component"}(r)+")"),a(l,"canUseDOM",u),l}}},137:function(e,t){var n="undefined"!=typeof Element,r="function"==typeof Map,o="function"==typeof Set,i="function"==typeof ArrayBuffer&&!!ArrayBuffer.isView;function a(e,t){if(e===t)return!0;if(e&&t&&"object"==typeof e&&"object"==typeof t){if(e.constructor!==t.constructor)return!1;var u,c,s,f;if(Array.isArray(e)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(!a(e[c],t[c]))return!1;return!0}if(r&&e instanceof Map&&t instanceof Map){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;for(f=e.entries();!(c=f.next()).done;)if(!a(c.value[1],t.get(c.value[0])))return!1;return!0}if(o&&e instanceof Set&&t instanceof Set){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;return!0}if(i&&ArrayBuffer.isView(e)&&ArrayBuffer.isView(t)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(e[c]!==t[c])return!1;return!0}if(e.constructor===RegExp)return e.source===t.source&&e.flags===t.flags;if(e.valueOf!==Object.prototype.valueOf)return e.valueOf()===t.valueOf();if(e.toString!==Object.prototype.toString)return e.toString()===t.toString();if((u=(s=Object.keys(e)).length)!==Object.keys(t).length)return!1;for(c=u;0!=c--;)if(!Object.prototype.hasOwnProperty.call(t,s[c]))return!1;if(n&&e instanceof Element)return!1;for(c=u;0!=c--;)if(("_owner"!==s[c]&&"__v"!==s[c]&&"__o"!==s[c]||!e.$$typeof)&&!a(e[s[c]],t[s[c]]))return!1;return!0}return e!=e&&t!=t}e.exports=function(e,t){try{return a(e,t)}catch(n){if((n.message||"").match(/stack|recursion/i))return console.warn("react-fast-compare cannot handle circular refs"),!1;throw n}}},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var r=n(98);function o(){return Object(r.a)().siteConfig.themeConfig}},97:function(e,t,n){"use strict";function r(e){var t,n,o="";if("string"==typeof e||"number"==typeof e)o+=e;else if("object"==typeof e)if(Array.isArray(e))for(t=0;t<e.length;t++)e[t]&&(n=r(e[t]))&&(o&&(o+=" "),o+=n);else for(t in e)e[t]&&(o&&(o+=" "),o+=t);return o}t.a=function(){for(var e,t,n=0,o="";n<arguments.length;)(e=arguments[n++])&&(t=r(e))&&(o&&(o+=" "),o+=t);return o}},98:function(e,t,n){"use strict";var r=n(0),o=n(24);t.a=function(){var e=Object(r.useContext)(o.a);if(null===e)throw new Error("Docusaurus context not provided");return e}},99:function(e,t,n){try{e.exports=n(130)}catch(r){e.exports={}}}}]);
\ No newline at end of file
diff --git a/1.6bed8819.js b/1.6bed8819.js
deleted file mode 100644
index 92047cfc..00000000
--- a/1.6bed8819.js
+++ /dev/null
@@ -1 +0,0 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[1],{100:function(e,t,n){try{e.exports=n(131)}catch(r){e.exports={}}},101:function(e,t,n){"use strict";var r=n(0),o=n.n(r),i=n(13),a=n(104),u=n(9),c=Object(r.createContext)({collectLink:function(){}}),s=n(102),f=function(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&t.indexOf(r)<0&&(n[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var o=0;for(r=Object.getOwnPropertySymbols(e);o<r.length;o++)t.indexOf(r[o])<0&&Object.prototype.propertyIsEnumerable.call(e,r[o])&&(n[r[o]]=e[r[o]])}return n};t.a=function(e){var t,n,l,d=e.isNavLink,p=e.to,v=e.href,h=e.activeClassName,b=e.isActive,g=e["data-noBrokenLinkCheck"],y=f(e,["isNavLink","to","href","activeClassName","isActive","data-noBrokenLinkCheck"]),m=Object(s.b)().withBaseUrl,w=Object(r.useContext)(c),T=p||v,O=Object(a.a)(T),A=null==T?void 0:T.replace("pathname://",""),C=void 0!==A?function(e){return e.startsWith("/")}(n=A)?m(n):n:void 0,j=Object(r.useRef)(!1),E=d?i.e:i.c,S=u.a.canUseIntersectionObserver;Object(r.useEffect)((function(){return!S&&O&&window.docusaurus.prefetch(C),function(){S&&l&&l.disconnect()}}),[C,S,O]);var P=null!==(t=null==C?void 0:C.startsWith("#"))&&void 0!==t&&t,D=!C||!O||P;return C&&O&&!P&&!g&&w.collectLink(C),D?o.a.createElement("a",Object.assign({href:C},T&&!O&&{target:"_blank",rel:"noopener noreferrer"},y)):o.a.createElement(E,Object.assign({},y,{onMouseEnter:function(){j.current||(window.docusaurus.preload(C),j.current=!0)},innerRef:function(e){var t,n;S&&e&&O&&(t=e,n=function(){window.docusaurus.prefetch(C)},(l=new window.IntersectionObserver((function(e){e.forEach((function(e){t===e.target&&(e.isIntersecting||e.intersectionRatio>0)&&(l.unobserve(t),l.disconnect(),n())}))}))).observe(t))},to:C||""},d&&{isActive:b,activeClassName:h}))}},102:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"a",(function(){return a}));var r=n(99),o=n(104);function i(){var e=Object(r.a)().siteConfig,t=(e=void 0===e?{}:e).baseUrl,n=void 0===t?"/":t,i=e.url;return{withBaseUrl:function(e,t){return function(e,t,n,r){var i=void 0===r?{}:r,a=i.forcePrependBaseUrl,u=void 0!==a&&a,c=i.absolute,s=void 0!==c&&c;if(!n)return n;if(n.startsWith("#"))return n;if(Object(o.b)(n))return n;if(u)return t+n;var f=n.startsWith(t)?n:t+n.replace(/^\//,"");return s?e+f:f}(i,n,e,t)}}}function a(e,t){return void 0===t&&(t={}),(0,i().withBaseUrl)(e,t)}},103:function(e,t,n){"use strict";n.r(t);var r=n(13);n.d(t,"MemoryRouter",(function(){return r.d})),n.d(t,"Prompt",(function(){return r.f})),n.d(t,"Redirect",(function(){return r.g})),n.d(t,"Route",(function(){return r.h})),n.d(t,"Router",(function(){return r.i})),n.d(t,"StaticRouter",(function(){return r.j})),n.d(t,"Switch",(function(){return r.k})),n.d(t,"generatePath",(function(){return r.l})),n.d(t,"matchPath",(function(){return r.m})),n.d(t,"useHistory",(function(){return r.n})),n.d(t,"useLocation",(function(){return r.o})),n.d(t,"useParams",(function(){return r.p})),n.d(t,"useRouteMatch",(function(){return r.q})),n.d(t,"withRouter",(function(){return r.r})),n.d(t,"BrowserRouter",(function(){return r.a})),n.d(t,"HashRouter",(function(){return r.b})),n.d(t,"Link",(function(){return r.c})),n.d(t,"NavLink",(function(){return r.e}))},104:function(e,t,n){"use strict";function r(e){return!0===/^(\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return o}))},108:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));var r=n(0),o=n(124),i=n(100);function a(e){void 0===e&&(e="default");var t=Object(i.useDocsData)(e),n=Object(o.b)(),a=n[0],u=n[1],c=a[e].preferredVersionName;return{preferredVersion:c?t.versions.find((function(e){return e.name===c})):null,savePreferredVersionName:Object(r.useCallback)((function(t){u.savePreferredVersion(e,t)}),[u])}}},109:function(e,t,n){"use strict";var r=n(0),o=n.n(r),i=n(136);t.a=function(e){return o.a.createElement(i.a,Object.assign({},e))}},124:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return h}));var r=n(0),o=n.n(r),i=n(97),a=n(100),u=!!a.useAllDocsData,c=function(e){return"docs-preferred-version-"+e},s={save:function(e,t,n){"none"===t||window.localStorage.setItem(c(e),n)},read:function(e,t){return"none"===t?null:window.localStorage.getItem(c(e))},clear:function(e,t){"none"===t||window.localStorage.removeItem(c(e))}};function f(e){var t=e.pluginIds,n=e.versionPersistence,r=e.allDocsData;var o={};return t.forEach((function(e){o[e]=function(e){var t=s.read(e,n);return r[e].versions.some((function(e){return e.name===t}))?{preferredVersionName:t}:(s.clear(e,n),{preferredVersionName:null})}(e)})),o}function l(){var e=Object(a.useAllDocsData)(),t=Object(i.a)().docs.versionPersistence,n=Object(r.useMemo)((function(){return Object.keys(e)}),[e]),o=Object(r.useState)((function(){return function(e){var t={};return e.forEach((function(e){t[e]={preferredVersionName:null}})),t}(n)})),u=o[0],c=o[1];return Object(r.useEffect)((function(){c(f({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]),[u,Object(r.useMemo)((function(){return{savePreferredVersion:function(e,n){s.save(e,t,n),c((function(t){var r;return Object.assign({},t,((r={})[e]={preferredVersionName:n},r))}))}}}),[c])]}var d=Object(r.createContext)(null);function p(e){var t=e.children;return u?o.a.createElement(v,null,t):o.a.createElement(o.a.Fragment,null,t)}function v(e){var t=e.children,n=l();return o.a.createElement(d.Provider,{value:n},t)}function h(){var e=Object(r.useContext)(d);if(!e)throw new Error("Can't find docs preferred context, maybe you forgot to use the DocsPreferredVersionContextProvider ?");return e}},131:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useDocVersionSuggestions=t.useActiveDocContext=t.useActiveVersion=t.useLatestVersion=t.useVersions=t.useActivePluginAndVersion=t.useActivePlugin=t.useDocsData=t.useAllDocsData=void 0;var r=n(103),o=n(132),i=n(133);t.useAllDocsData=function(){return o.useAllPluginInstancesData("docusaurus-plugin-content-docs")},t.useDocsData=function(e){return o.usePluginData("docusaurus-plugin-content-docs",e)},t.useActivePlugin=function(e){void 0===e&&(e={});var n=t.useAllDocsData(),o=r.useLocation().pathname;return i.getActivePlugin(n,o,e)},t.useActivePluginAndVersion=function(e){void 0===e&&(e={});var n=t.useActivePlugin(e),o=r.useLocation().pathname;if(n)return{activePlugin:n,activeVersion:i.getActiveVersion(n.pluginData,o)}},t.useVersions=function(e){return t.useDocsData(e).versions},t.useLatestVersion=function(e){var n=t.useDocsData(e);return i.getLatestVersion(n)},t.useActiveVersion=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getActiveVersion(n,o)},t.useActiveDocContext=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getActiveDocContext(n,o)},t.useDocVersionSuggestions=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getDocVersionSuggestions(n,o)}},132:function(e,t,n){"use strict";n.r(t),n.d(t,"default",(function(){return o})),n.d(t,"useAllPluginInstancesData",(function(){return i})),n.d(t,"usePluginData",(function(){return a}));var r=n(99);function o(){var e=Object(r.a)().globalData;if(!e)throw new Error("Docusaurus global data not found");return e}function i(e){var t=o()[e];if(!t)throw new Error("Docusaurus plugin global data not found for pluginName="+e);return t}function a(e,t){void 0===t&&(t="default");var n=i(e)[t];if(!n)throw new Error("Docusaurus plugin global data not found for pluginName="+e+" and pluginId="+t);return n}},133:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getDocVersionSuggestions=t.getActiveDocContext=t.getActiveVersion=t.getLatestVersion=t.getActivePlugin=void 0;var r=n(103);t.getActivePlugin=function(e,t,n){void 0===n&&(n={});var o=Object.entries(e).find((function(e){e[0];var n=e[1];return!!r.matchPath(t,{path:n.path,exact:!1,strict:!1})})),i=o?{pluginId:o[0],pluginData:o[1]}:void 0;if(!i&&n.failfast)throw new Error("Can't find active docs plugin for pathname="+t+", while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: "+Object.values(e).map((function(e){return e.path})).join(", "));return i},t.getLatestVersion=function(e){return e.versions.find((function(e){return e.isLast}))},t.getActiveVersion=function(e,n){var o=t.getLatestVersion(e);return[].concat(e.versions.filter((function(e){return e!==o})),[o]).find((function(e){return!!r.matchPath(n,{path:e.path,exact:!1,strict:!1})}))},t.getActiveDocContext=function(e,n){var o,i,a=t.getActiveVersion(e,n),u=null==a?void 0:a.docs.find((function(e){return!!r.matchPath(n,{path:e.path,exact:!0,strict:!1})}));return{activeVersion:a,activeDoc:u,alternateDocVersions:u?(o=u.id,i={},e.versions.forEach((function(e){e.docs.forEach((function(t){t.id===o&&(i[e.name]=t)}))})),i):{}}},t.getDocVersionSuggestions=function(e,n){var r=t.getLatestVersion(e),o=t.getActiveDocContext(e,n),i=o.activeVersion!==r;return{latestDocSuggestion:i?null==o?void 0:o.alternateDocVersions[r.name]:void 0,latestVersionSuggestion:i?r:void 0}}},136:function(e,t,n){"use strict";(function(e){n.d(t,"a",(function(){return be}));var r,o,i,a,u=n(7),c=n.n(u),s=n(137),f=n.n(s),l=n(138),d=n.n(l),p=n(0),v=n.n(p),h=n(21),b=n.n(h),g="bodyAttributes",y="htmlAttributes",m="titleAttributes",w={BASE:"base",BODY:"body",HEAD:"head",HTML:"html",LINK:"link",META:"meta",NOSCRIPT:"noscript",SCRIPT:"script",STYLE:"style",TITLE:"title"},T=(Object.keys(w).map((function(e){return w[e]})),"charset"),O="cssText",A="href",C="http-equiv",j="innerHTML",E="itemprop",S="name",P="property",D="rel",L="src",x="target",k={accesskey:"accessKey",charset:"charSet",class:"className",contenteditable:"contentEditable",contextmenu:"contextMenu","http-equiv":"httpEquiv",itemprop:"itemProp",tabindex:"tabIndex"},I="defaultTitle",V="defer",N="encodeSpecialCharacters",M="onChangeClientState",R="titleTemplate",_=Object.keys(k).reduce((function(e,t){return e[k[t]]=t,e}),{}),B=[w.NOSCRIPT,w.SCRIPT,w.STYLE],H="data-react-helmet",U="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},q=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")},F=function(){function e(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,r.key,r)}}return function(t,n,r){return n&&e(t.prototype,n),r&&e(t,r),t}}(),Y=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},W=function(e,t){var n={};for(var r in e)t.indexOf(r)>=0||Object.prototype.hasOwnProperty.call(e,r)&&(n[r]=e[r]);return n},z=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t},K=function(e){var t=!(arguments.length>1&&void 0!==arguments[1])||arguments[1];return!1===t?String(e):String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#x27;")},J=function(e){var t=Z(e,w.TITLE),n=Z(e,R);if(n&&t)return n.replace(/%s/g,(function(){return Array.isArray(t)?t.join(""):t}));var r=Z(e,I);return t||r||void 0},$=function(e){return Z(e,M)||function(){}},G=function(e,t){return t.filter((function(t){return void 0!==t[e]})).map((function(t){return t[e]})).reduce((function(e,t){return Y({},e,t)}),{})},Q=function(e,t){return t.filter((function(e){return void 0!==e[w.BASE]})).map((function(e){return e[w.BASE]})).reverse().reduce((function(t,n){if(!t.length)for(var r=Object.keys(n),o=0;o<r.length;o++){var i=r[o].toLowerCase();if(-1!==e.indexOf(i)&&n[i])return t.concat(n)}return t}),[])},X=function(e,t,n){var r={};return n.filter((function(t){return!!Array.isArray(t[e])||(void 0!==t[e]&&oe("Helmet: "+e+' should be of type "Array". Instead found type "'+U(t[e])+'"'),!1)})).map((function(t){return t[e]})).reverse().reduce((function(e,n){var o={};n.filter((function(e){for(var n=void 0,i=Object.keys(e),a=0;a<i.length;a++){var u=i[a],c=u.toLowerCase();-1===t.indexOf(c)||n===D&&"canonical"===e[n].toLowerCase()||c===D&&"stylesheet"===e[c].toLowerCase()||(n=c),-1===t.indexOf(u)||u!==j&&u!==O&&u!==E||(n=u)}if(!n||!e[n])return!1;var s=e[n].toLowerCase();return r[n]||(r[n]={}),o[n]||(o[n]={}),!r[n][s]&&(o[n][s]=!0,!0)})).reverse().forEach((function(t){return e.push(t)}));for(var i=Object.keys(o),a=0;a<i.length;a++){var u=i[a],c=b()({},r[u],o[u]);r[u]=c}return e}),[]).reverse()},Z=function(e,t){for(var n=e.length-1;n>=0;n--){var r=e[n];if(r.hasOwnProperty(t))return r[t]}return null},ee=(r=Date.now(),function(e){var t=Date.now();t-r>16?(r=t,e(t)):setTimeout((function(){ee(e)}),0)}),te=function(e){return clearTimeout(e)},ne="undefined"!=typeof window?window.requestAnimationFrame&&window.requestAnimationFrame.bind(window)||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||ee:e.requestAnimationFrame||ee,re="undefined"!=typeof window?window.cancelAnimationFrame||window.webkitCancelAnimationFrame||window.mozCancelAnimationFrame||te:e.cancelAnimationFrame||te,oe=function(e){return console&&"function"==typeof console.warn&&console.warn(e)},ie=null,ae=function(e,t){var n=e.baseTag,r=e.bodyAttributes,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.onChangeClientState,s=e.scriptTags,f=e.styleTags,l=e.title,d=e.titleAttributes;se(w.BODY,r),se(w.HTML,o),ce(l,d);var p={baseTag:fe(w.BASE,n),linkTags:fe(w.LINK,i),metaTags:fe(w.META,a),noscriptTags:fe(w.NOSCRIPT,u),scriptTags:fe(w.SCRIPT,s),styleTags:fe(w.STYLE,f)},v={},h={};Object.keys(p).forEach((function(e){var t=p[e],n=t.newTags,r=t.oldTags;n.length&&(v[e]=n),r.length&&(h[e]=p[e].oldTags)})),t&&t(),c(e,v,h)},ue=function(e){return Array.isArray(e)?e.join(""):e},ce=function(e,t){void 0!==e&&document.title!==e&&(document.title=ue(e)),se(w.TITLE,t)},se=function(e,t){var n=document.getElementsByTagName(e)[0];if(n){for(var r=n.getAttribute(H),o=r?r.split(","):[],i=[].concat(o),a=Object.keys(t),u=0;u<a.length;u++){var c=a[u],s=t[c]||"";n.getAttribute(c)!==s&&n.setAttribute(c,s),-1===o.indexOf(c)&&o.push(c);var f=i.indexOf(c);-1!==f&&i.splice(f,1)}for(var l=i.length-1;l>=0;l--)n.removeAttribute(i[l]);o.length===i.length?n.removeAttribute(H):n.getAttribute(H)!==a.join(",")&&n.setAttribute(H,a.join(","))}},fe=function(e,t){var n=document.head||document.querySelector(w.HEAD),r=n.querySelectorAll(e+"["+"data-react-helmet]"),o=Array.prototype.slice.call(r),i=[],a=void 0;return t&&t.length&&t.forEach((function(t){var n=document.createElement(e);for(var r in t)if(t.hasOwnProperty(r))if(r===j)n.innerHTML=t.innerHTML;else if(r===O)n.styleSheet?n.styleSheet.cssText=t.cssText:n.appendChild(document.createTextNode(t.cssText));else{var u=void 0===t[r]?"":t[r];n.setAttribute(r,u)}n.setAttribute(H,"true"),o.some((function(e,t){return a=t,n.isEqualNode(e)}))?o.splice(a,1):i.push(n)})),o.forEach((function(e){return e.parentNode.removeChild(e)})),i.forEach((function(e){return n.appendChild(e)})),{oldTags:o,newTags:i}},le=function(e){return Object.keys(e).reduce((function(t,n){var r=void 0!==e[n]?n+'="'+e[n]+'"':""+n;return t?t+" "+r:r}),"")},de=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[k[n]||n]=e[n],t}),t)},pe=function(e,t,n){switch(e){case w.TITLE:return{toComponent:function(){return e=t.title,n=t.titleAttributes,(r={key:e})[H]=!0,o=de(n,r),[v.a.createElement(w.TITLE,o,e)];var e,n,r,o},toString:function(){return function(e,t,n,r){var o=le(n),i=ue(t);return o?"<"+e+' data-react-helmet="true" '+o+">"+K(i,r)+"</"+e+">":"<"+e+' data-react-helmet="true">'+K(i,r)+"</"+e+">"}(e,t.title,t.titleAttributes,n)}};case g:case y:return{toComponent:function(){return de(t)},toString:function(){return le(t)}};default:return{toComponent:function(){return function(e,t){return t.map((function(t,n){var r,o=((r={key:n})[H]=!0,r);return Object.keys(t).forEach((function(e){var n=k[e]||e;if(n===j||n===O){var r=t.innerHTML||t.cssText;o.dangerouslySetInnerHTML={__html:r}}else o[n]=t[e]})),v.a.createElement(e,o)}))}(e,t)},toString:function(){return function(e,t,n){return t.reduce((function(t,r){var o=Object.keys(r).filter((function(e){return!(e===j||e===O)})).reduce((function(e,t){var o=void 0===r[t]?t:t+'="'+K(r[t],n)+'"';return e?e+" "+o:o}),""),i=r.innerHTML||r.cssText||"",a=-1===B.indexOf(e);return t+"<"+e+' data-react-helmet="true" '+o+(a?"/>":">"+i+"</"+e+">")}),"")}(e,t,n)}}}},ve=function(e){var t=e.baseTag,n=e.bodyAttributes,r=e.encode,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.scriptTags,s=e.styleTags,f=e.title,l=void 0===f?"":f,d=e.titleAttributes;return{base:pe(w.BASE,t,r),bodyAttributes:pe(g,n,r),htmlAttributes:pe(y,o,r),link:pe(w.LINK,i,r),meta:pe(w.META,a,r),noscript:pe(w.NOSCRIPT,u,r),script:pe(w.SCRIPT,c,r),style:pe(w.STYLE,s,r),title:pe(w.TITLE,{title:l,titleAttributes:d},r)}},he=f()((function(e){return{baseTag:Q([A,x],e),bodyAttributes:G(g,e),defer:Z(e,V),encode:Z(e,N),htmlAttributes:G(y,e),linkTags:X(w.LINK,[D,A],e),metaTags:X(w.META,[S,T,C,P,E],e),noscriptTags:X(w.NOSCRIPT,[j],e),onChangeClientState:$(e),scriptTags:X(w.SCRIPT,[L,j],e),styleTags:X(w.STYLE,[O],e),title:J(e),titleAttributes:G(m,e)}}),(function(e){ie&&re(ie),e.defer?ie=ne((function(){ae(e,(function(){ie=null}))})):(ae(e),ie=null)}),ve)((function(){return null})),be=(o=he,a=i=function(e){function t(){return q(this,t),z(this,e.apply(this,arguments))}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(t,e),t.prototype.shouldComponentUpdate=function(e){return!d()(this.props,e)},t.prototype.mapNestedChildrenToProps=function(e,t){if(!t)return null;switch(e.type){case w.SCRIPT:case w.NOSCRIPT:return{innerHTML:t};case w.STYLE:return{cssText:t}}throw new Error("<"+e.type+" /> elements are self-closing and can not contain children. Refer to our API for more information.")},t.prototype.flattenArrayTypeChildren=function(e){var t,n=e.child,r=e.arrayTypeChildren,o=e.newChildProps,i=e.nestedChildren;return Y({},r,((t={})[n.type]=[].concat(r[n.type]||[],[Y({},o,this.mapNestedChildrenToProps(n,i))]),t))},t.prototype.mapObjectTypeChildren=function(e){var t,n,r=e.child,o=e.newProps,i=e.newChildProps,a=e.nestedChildren;switch(r.type){case w.TITLE:return Y({},o,((t={})[r.type]=a,t.titleAttributes=Y({},i),t));case w.BODY:return Y({},o,{bodyAttributes:Y({},i)});case w.HTML:return Y({},o,{htmlAttributes:Y({},i)})}return Y({},o,((n={})[r.type]=Y({},i),n))},t.prototype.mapArrayTypeChildrenToProps=function(e,t){var n=Y({},t);return Object.keys(e).forEach((function(t){var r;n=Y({},n,((r={})[t]=e[t],r))})),n},t.prototype.warnOnInvalidChildren=function(e,t){return!0},t.prototype.mapChildrenToProps=function(e,t){var n=this,r={};return v.a.Children.forEach(e,(function(e){if(e&&e.props){var o=e.props,i=o.children,a=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[_[n]||n]=e[n],t}),t)}(W(o,["children"]));switch(n.warnOnInvalidChildren(e,i),e.type){case w.LINK:case w.META:case w.NOSCRIPT:case w.SCRIPT:case w.STYLE:r=n.flattenArrayTypeChildren({child:e,arrayTypeChildren:r,newChildProps:a,nestedChildren:i});break;default:t=n.mapObjectTypeChildren({child:e,newProps:t,newChildProps:a,nestedChildren:i})}}})),t=this.mapArrayTypeChildrenToProps(r,t)},t.prototype.render=function(){var e=this.props,t=e.children,n=W(e,["children"]),r=Y({},n);return t&&(r=this.mapChildrenToProps(t,r)),v.a.createElement(o,r)},F(t,null,[{key:"canUseDOM",set:function(e){o.canUseDOM=e}}]),t}(v.a.Component),i.propTypes={base:c.a.object,bodyAttributes:c.a.object,children:c.a.oneOfType([c.a.arrayOf(c.a.node),c.a.node]),defaultTitle:c.a.string,defer:c.a.bool,encodeSpecialCharacters:c.a.bool,htmlAttributes:c.a.object,link:c.a.arrayOf(c.a.object),meta:c.a.arrayOf(c.a.object),noscript:c.a.arrayOf(c.a.object),onChangeClientState:c.a.func,script:c.a.arrayOf(c.a.object),style:c.a.arrayOf(c.a.object),title:c.a.string,titleAttributes:c.a.object,titleTemplate:c.a.string},i.defaultProps={defer:!0,encodeSpecialCharacters:!0},i.peek=o.peek,i.rewind=function(){var e=o.rewind();return e||(e=ve({baseTag:[],bodyAttributes:{},encodeSpecialCharacters:!0,htmlAttributes:{},linkTags:[],metaTags:[],noscriptTags:[],scriptTags:[],styleTags:[],title:"",titleAttributes:{}})),e},a);be.renderStatic=be.rewind}).call(this,n(29))},137:function(e,t,n){"use strict";var r,o=n(0),i=(r=o)&&"object"==typeof r&&"default"in r?r.default:r;function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var u=!("undefined"==typeof window||!window.document||!window.document.createElement);e.exports=function(e,t,n){if("function"!=typeof e)throw new Error("Expected reducePropsToState to be a function.");if("function"!=typeof t)throw new Error("Expected handleStateChangeOnClient to be a function.");if(void 0!==n&&"function"!=typeof n)throw new Error("Expected mapStateOnServer to either be undefined or a function.");return function(r){if("function"!=typeof r)throw new Error("Expected WrappedComponent to be a React component.");var c,s=[];function f(){c=e(s.map((function(e){return e.props}))),l.canUseDOM?t(c):n&&(c=n(c))}var l=function(e){var t,n;function o(){return e.apply(this,arguments)||this}n=e,(t=o).prototype=Object.create(n.prototype),t.prototype.constructor=t,t.__proto__=n,o.peek=function(){return c},o.rewind=function(){if(o.canUseDOM)throw new Error("You may only call rewind() on the server. Call peek() to read the current state.");var e=c;return c=void 0,s=[],e};var a=o.prototype;return a.UNSAFE_componentWillMount=function(){s.push(this),f()},a.componentDidUpdate=function(){f()},a.componentWillUnmount=function(){var e=s.indexOf(this);s.splice(e,1),f()},a.render=function(){return i.createElement(r,this.props)},o}(o.PureComponent);return a(l,"displayName","SideEffect("+function(e){return e.displayName||e.name||"Component"}(r)+")"),a(l,"canUseDOM",u),l}}},138:function(e,t){var n="undefined"!=typeof Element,r="function"==typeof Map,o="function"==typeof Set,i="function"==typeof ArrayBuffer&&!!ArrayBuffer.isView;function a(e,t){if(e===t)return!0;if(e&&t&&"object"==typeof e&&"object"==typeof t){if(e.constructor!==t.constructor)return!1;var u,c,s,f;if(Array.isArray(e)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(!a(e[c],t[c]))return!1;return!0}if(r&&e instanceof Map&&t instanceof Map){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;for(f=e.entries();!(c=f.next()).done;)if(!a(c.value[1],t.get(c.value[0])))return!1;return!0}if(o&&e instanceof Set&&t instanceof Set){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;return!0}if(i&&ArrayBuffer.isView(e)&&ArrayBuffer.isView(t)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(e[c]!==t[c])return!1;return!0}if(e.constructor===RegExp)return e.source===t.source&&e.flags===t.flags;if(e.valueOf!==Object.prototype.valueOf)return e.valueOf()===t.valueOf();if(e.toString!==Object.prototype.toString)return e.toString()===t.toString();if((u=(s=Object.keys(e)).length)!==Object.keys(t).length)return!1;for(c=u;0!=c--;)if(!Object.prototype.hasOwnProperty.call(t,s[c]))return!1;if(n&&e instanceof Element)return!1;for(c=u;0!=c--;)if(("_owner"!==s[c]&&"__v"!==s[c]&&"__o"!==s[c]||!e.$$typeof)&&!a(e[s[c]],t[s[c]]))return!1;return!0}return e!=e&&t!=t}e.exports=function(e,t){try{return a(e,t)}catch(n){if((n.message||"").match(/stack|recursion/i))return console.warn("react-fast-compare cannot handle circular refs"),!1;throw n}}},97:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var r=n(99);function o(){return Object(r.a)().siteConfig.themeConfig}},98:function(e,t,n){"use strict";function r(e){var t,n,o="";if("string"==typeof e||"number"==typeof e)o+=e;else if("object"==typeof e)if(Array.isArray(e))for(t=0;t<e.length;t++)e[t]&&(n=r(e[t]))&&(o&&(o+=" "),o+=n);else for(t in e)e[t]&&(o&&(o+=" "),o+=t);return o}t.a=function(){for(var e,t,n=0,o="";n<arguments.length;)(e=arguments[n++])&&(t=r(e))&&(o&&(o+=" "),o+=t);return o}},99:function(e,t,n){"use strict";var r=n(0),o=n(24);t.a=function(){var e=Object(r.useContext)(o.a);if(null===e)throw new Error("Docusaurus context not provided");return e}}}]);
\ No newline at end of file
diff --git a/17896441.2c25168c.js b/17896441.2c25168c.js
deleted file mode 100644
index 34a72440..00000000
--- a/17896441.2c25168c.js
+++ /dev/null
@@ -1 +0,0 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[7],{113:function(e,t,a){"use strict";var n=a(0),l=a.n(n);var r=function(e,t,a){var l=Object(n.useState)(void 0),r=l[0],i=l[1];Object(n.useEffect)((function(){function n(){var n=function(){var e=Array.from(document.getElementsByClassName("anchor")),t=e.find((function(e){return e.getBoundingClientRect().top>=a}));if(t){if(t.getBoundingClientRect().top>=a){var n=e[e.indexOf(t)-1];return null!=n?n:t}return t}return e[e.length-1]}();if(n)for(var l=0,c=!1,m=document.getElementsByClassName(e);l<m.length&&!c;){var o=m[l],s=o.href,d=decodeURIComponent(s.substring(s.indexOf("#")+1));n.id===d&&(r&&r.classList.remove(t),o.classList.add(t),i(o),c=!0),l+=1}}return document.addEventListener("scroll",n),document.addEventListener("resize",n),n(),function(){document.removeEventListener("scroll",n),document.removeEventListener("resize",n)}}))},i=a(47),c=a.n(i),m="table-of-contents__link";function o(e){var t=e.headings,a=e.isChild;return t.length?l.a.createElement("ul",{className:a?"":"table-of-contents table-of-contents__left-border"},t.map((function(e){return l.a.createElement("li",{key:e.id},l.a.createElement("a",{href:"#"+e.id,className:m,dangerouslySetInnerHTML:{__html:e.value}}),l.a.createElement(o,{isChild:!0,headings:e.children}))}))):null}t.a=function(e){var t=e.headings;return r(m,"table-of-contents__link--active",100),l.a.createElement("div",{className:c.a.tableOfContents},l.a.createElement(o,{headings:t}))}},94:function(e,t,a){"use strict";a.r(t);var n=a(0),l=a.n(n),r=a(109),i=a(99),c=a(102),m=a(101);var o=function(e){var t=e.metadata;return l.a.createElement("nav",{className:"pagination-nav","aria-label":"Blog list page navigation"},l.a.createElement("div",{className:"pagination-nav__item"},t.previous&&l.a.createElement(m.a,{className:"pagination-nav__link",to:t.previous.permalink},l.a.createElement("div",{className:"pagination-nav__sublabel"},"Previous"),l.a.createElement("div",{className:"pagination-nav__label"},"\xab ",t.previous.title))),l.a.createElement("div",{className:"pagination-nav__item pagination-nav__item--next"},t.next&&l.a.createElement(m.a,{className:"pagination-nav__link",to:t.next.permalink},l.a.createElement("div",{className:"pagination-nav__sublabel"},"Next"),l.a.createElement("div",{className:"pagination-nav__label"},t.next.title," \xbb"))))},s=a(100),d=a(108);var u=function(){var e=Object(i.a)().siteConfig.title,t=Object(s.useActivePlugin)({failfast:!0}).pluginId,a=Object(d.a)(t).savePreferredVersionName,n=Object(s.useActiveVersion)(t),r=Object(s.useDocVersionSuggestions)(t),c=r.latestDocSuggestion,o=r.latestVersionSuggestion;if(!o)return l.a.createElement(l.a.Fragment,null);var u,g=null!=c?c:(u=o).docs.find((function(e){return e.id===u.mainDocId}));return l.a.createElement("div",{className:"alert alert--warning margin-bottom--md",role:"alert"},"current"===n.name?l.a.createElement("div",null,"This is unreleased documentation for ",e," ",l.a.createElement("strong",null,n.label)," version."):l.a.createElement("div",null,"This is documentation for ",e," ",l.a.createElement("strong",null,n.label),", which is no longer actively maintained."),l.a.createElement("div",{className:"margin-top--md"},"For up-to-date documentation, see the"," ",l.a.createElement("strong",null,l.a.createElement(m.a,{to:g.path,onClick:function(){return a(o.name)}},"latest version"))," ","(",o.label,")."))},g=a(113),v=a(98),E=a(61),p=a.n(E);t.default=function(e){var t,a=Object(i.a)().siteConfig,n=a.url,m=a.title,d=a.titleDelimiter,E=e.content,f=E.metadata,b=f.description,h=f.title,N=f.permalink,_=f.editUrl,w=f.lastUpdatedAt,O=f.lastUpdatedBy,y=E.frontMatter,k=y.image,j=y.keywords,C=y.hide_title,x=y.hide_table_of_contents,I=Object(s.useActivePlugin)({failfast:!0}).pluginId,L=Object(s.useVersions)(I),A=Object(s.useActiveVersion)(I),S=L.length>1,B=h?h+" "+d+" "+m:m,D=Object(c.a)(k,{absolute:!0});return l.a.createElement(l.a.Fragment,null,l.a.createElement(r.a,null,l.a.createElement("title",null,B),l.a.createElement("meta",{property:"og:title",content:B}),b&&l.a.createElement("meta",{name:"description",content:b}),b&&l.a.createElement("meta",{property:"og:description",content:b}),j&&j.length&&l.a.createElement("meta",{name:"keywords",content:j.join(",")}),k&&l.a.createElement("meta",{property:"og:image",content:D}),k&&l.a.createElement("meta",{property:"twitter:image",content:D}),k&&l.a.createElement("meta",{name:"twitter:image:alt",content:"Image for "+h}),N&&l.a.createElement("meta",{property:"og:url",content:n+N}),N&&l.a.createElement("link",{rel:"canonical",href:n+N})),l.a.createElement("div",{className:Object(v.a)("container padding-vert--lg",p.a.docItemWrapper)},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:Object(v.a)("col",(t={},t[p.a.docItemCol]=!x,t))},l.a.createElement(u,null),l.a.createElement("div",{className:p.a.docItemContainer},l.a.createElement("article",null,S&&l.a.createElement("div",null,l.a.createElement("span",{className:"badge badge--secondary"},"Version: ",A.label)),!C&&l.a.createElement("header",null,l.a.createElement("h1",{className:p.a.docTitle},h)),l.a.createElement("div",{className:"markdown"},l.a.createElement(E,null))),(_||w||O)&&l.a.createElement("div",{className:"margin-vert--xl"},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:"col"},_&&l.a.createElement("a",{href:_,target:"_blank",rel:"noreferrer noopener"},l.a.createElement("svg",{fill:"currentColor",height:"1.2em",width:"1.2em",preserveAspectRatio:"xMidYMid meet",viewBox:"0 0 40 40",style:{marginRight:"0.3em",verticalAlign:"sub"}},l.a.createElement("g",null,l.a.createElement("path",{d:"m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"}))),"Edit this page")),(w||O)&&l.a.createElement("div",{className:"col text--right"},l.a.createElement("em",null,l.a.createElement("small",null,"Last updated"," ",w&&l.a.createElement(l.a.Fragment,null,"on"," ",l.a.createElement("time",{dateTime:new Date(1e3*w).toISOString(),className:p.a.docLastUpdatedAt},new Date(1e3*w).toLocaleDateString()),O&&" "),O&&l.a.createElement(l.a.Fragment,null,"by ",l.a.createElement("strong",null,O)),!1))))),l.a.createElement("div",{className:"margin-vert--lg"},l.a.createElement(o,{metadata:f})))),!x&&E.rightToc&&l.a.createElement("div",{className:"col col--3"},l.a.createElement(g.a,{headings:E.rightToc})))))}}}]);
\ No newline at end of file
diff --git a/17896441.8a8027b4.js b/17896441.8a8027b4.js
new file mode 100644
index 00000000..0dbe4cc1
--- /dev/null
+++ b/17896441.8a8027b4.js
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[7],{112:function(e,t,a){"use strict";var n=a(0),l=a.n(n);var r=function(e,t,a){var l=Object(n.useState)(void 0),r=l[0],i=l[1];Object(n.useEffect)((function(){function n(){var n=function(){var e=Array.from(document.getElementsByClassName("anchor")),t=e.find((function(e){return e.getBoundingClientRect().top>=a}));if(t){if(t.getBoundingClientRect().top>=a){var n=e[e.indexOf(t)-1];return null!=n?n:t}return t}return e[e.length-1]}();if(n)for(var l=0,c=!1,m=document.getElementsByClassName(e);l<m.length&&!c;){var o=m[l],s=o.href,d=decodeURIComponent(s.substring(s.indexOf("#")+1));n.id===d&&(r&&r.classList.remove(t),o.classList.add(t),i(o),c=!0),l+=1}}return document.addEventListener("scroll",n),document.addEventListener("resize",n),n(),function(){document.removeEventListener("scroll",n),document.removeEventListener("resize",n)}}))},i=a(47),c=a.n(i),m="table-of-contents__link";function o(e){var t=e.headings,a=e.isChild;return t.length?l.a.createElement("ul",{className:a?"":"table-of-contents table-of-contents__left-border"},t.map((function(e){return l.a.createElement("li",{key:e.id},l.a.createElement("a",{href:"#"+e.id,className:m,dangerouslySetInnerHTML:{__html:e.value}}),l.a.createElement(o,{isChild:!0,headings:e.children}))}))):null}t.a=function(e){var t=e.headings;return r(m,"table-of-contents__link--active",100),l.a.createElement("div",{className:c.a.tableOfContents},l.a.createElement(o,{headings:t}))}},93:function(e,t,a){"use strict";a.r(t);var n=a(0),l=a.n(n),r=a(108),i=a(98),c=a(101),m=a(100);var o=function(e){var t=e.metadata;return l.a.createElement("nav",{className:"pagination-nav","aria-label":"Blog list page navigation"},l.a.createElement("div",{className:"pagination-nav__item"},t.previous&&l.a.createElement(m.a,{className:"pagination-nav__link",to:t.previous.permalink},l.a.createElement("div",{className:"pagination-nav__sublabel"},"Previous"),l.a.createElement("div",{className:"pagination-nav__label"},"\xab ",t.previous.title))),l.a.createElement("div",{className:"pagination-nav__item pagination-nav__item--next"},t.next&&l.a.createElement(m.a,{className:"pagination-nav__link",to:t.next.permalink},l.a.createElement("div",{className:"pagination-nav__sublabel"},"Next"),l.a.createElement("div",{className:"pagination-nav__label"},t.next.title," \xbb"))))},s=a(99),d=a(107);var u=function(){var e=Object(i.a)().siteConfig.title,t=Object(s.useActivePlugin)({failfast:!0}).pluginId,a=Object(d.a)(t).savePreferredVersionName,n=Object(s.useActiveVersion)(t),r=Object(s.useDocVersionSuggestions)(t),c=r.latestDocSuggestion,o=r.latestVersionSuggestion;if(!o)return l.a.createElement(l.a.Fragment,null);var u,g=null!=c?c:(u=o).docs.find((function(e){return e.id===u.mainDocId}));return l.a.createElement("div",{className:"alert alert--warning margin-bottom--md",role:"alert"},"current"===n.name?l.a.createElement("div",null,"This is unreleased documentation for ",e," ",l.a.createElement("strong",null,n.label)," version."):l.a.createElement("div",null,"This is documentation for ",e," ",l.a.createElement("strong",null,n.label),", which is no longer actively maintained."),l.a.createElement("div",{className:"margin-top--md"},"For up-to-date documentation, see the"," ",l.a.createElement("strong",null,l.a.createElement(m.a,{to:g.path,onClick:function(){return a(o.name)}},"latest version"))," ","(",o.label,")."))},g=a(112),v=a(97),E=a(61),p=a.n(E);t.default=function(e){var t,a=Object(i.a)().siteConfig,n=a.url,m=a.title,d=a.titleDelimiter,E=e.content,f=E.metadata,b=f.description,h=f.title,N=f.permalink,_=f.editUrl,w=f.lastUpdatedAt,O=f.lastUpdatedBy,y=E.frontMatter,k=y.image,j=y.keywords,C=y.hide_title,x=y.hide_table_of_contents,I=Object(s.useActivePlugin)({failfast:!0}).pluginId,L=Object(s.useVersions)(I),A=Object(s.useActiveVersion)(I),S=L.length>1,B=h?h+" "+d+" "+m:m,D=Object(c.a)(k,{absolute:!0});return l.a.createElement(l.a.Fragment,null,l.a.createElement(r.a,null,l.a.createElement("title",null,B),l.a.createElement("meta",{property:"og:title",content:B}),b&&l.a.createElement("meta",{name:"description",content:b}),b&&l.a.createElement("meta",{property:"og:description",content:b}),j&&j.length&&l.a.createElement("meta",{name:"keywords",content:j.join(",")}),k&&l.a.createElement("meta",{property:"og:image",content:D}),k&&l.a.createElement("meta",{property:"twitter:image",content:D}),k&&l.a.createElement("meta",{name:"twitter:image:alt",content:"Image for "+h}),N&&l.a.createElement("meta",{property:"og:url",content:n+N}),N&&l.a.createElement("link",{rel:"canonical",href:n+N})),l.a.createElement("div",{className:Object(v.a)("container padding-vert--lg",p.a.docItemWrapper)},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:Object(v.a)("col",(t={},t[p.a.docItemCol]=!x,t))},l.a.createElement(u,null),l.a.createElement("div",{className:p.a.docItemContainer},l.a.createElement("article",null,S&&l.a.createElement("div",null,l.a.createElement("span",{className:"badge badge--secondary"},"Version: ",A.label)),!C&&l.a.createElement("header",null,l.a.createElement("h1",{className:p.a.docTitle},h)),l.a.createElement("div",{className:"markdown"},l.a.createElement(E,null))),(_||w||O)&&l.a.createElement("div",{className:"margin-vert--xl"},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:"col"},_&&l.a.createElement("a",{href:_,target:"_blank",rel:"noreferrer noopener"},l.a.createElement("svg",{fill:"currentColor",height:"1.2em",width:"1.2em",preserveAspectRatio:"xMidYMid meet",viewBox:"0 0 40 40",style:{marginRight:"0.3em",verticalAlign:"sub"}},l.a.createElement("g",null,l.a.createElement("path",{d:"m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"}))),"Edit this page")),(w||O)&&l.a.createElement("div",{className:"col text--right"},l.a.createElement("em",null,l.a.createElement("small",null,"Last updated"," ",w&&l.a.createElement(l.a.Fragment,null,"on"," ",l.a.createElement("time",{dateTime:new Date(1e3*w).toISOString(),className:p.a.docLastUpdatedAt},new Date(1e3*w).toLocaleDateString()),O&&" "),O&&l.a.createElement(l.a.Fragment,null,"by ",l.a.createElement("strong",null,O)),!1))))),l.a.createElement("div",{className:"margin-vert--lg"},l.a.createElement(o,{metadata:f})))),!x&&E.rightToc&&l.a.createElement("div",{className:"col col--3"},l.a.createElement(g.a,{headings:E.rightToc})))))}}}]);
\ No newline at end of file
diff --git a/2.f73f779a.js b/2.cd1a0941.js
similarity index 81%
rename from 2.f73f779a.js
rename to 2.cd1a0941.js
index ab164a85..242cd403 100644
--- a/2.f73f779a.js
+++ b/2.cd1a0941.js
@@ -1,2 +1,2 @@
-/*! For license information please see 2.f73f779a.js.LICENSE.txt */
-(window.webpackJsonp=window.webpackJsonp||[]).push([[2],{105:function(e,t,a){"use strict";var n=a(0),r=a(117);t.a=function(){var e=Object(n.useContext)(r.a);if(null==e)throw new Error("`useThemeContext` is used outside of `Layout` Component. See https://v2.docusaurus.io/docs/theme-classic#usethemecontext.");return e}},106:function(e,t,a){"use strict";var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(98),i=a(101),s=a(102),u=a(103),d=a(122);function m(e){var t=e.activeBasePath,a=e.activeBaseRegex,c=e.to,l=e.href,u=e.label,d=e.activeClassName,m=void 0===d?"navbar__link--active":d,f=e.prependBaseUrlToHref,h=Object(r.a)(e,["activeBasePath","activeBaseRegex","to","href","label","activeClassName","prependBaseUrlToHref"]),v=Object(s.a)(c),b=Object(s.a)(t),p=Object(s.a)(l,{forcePrependBaseUrl:!0});return o.a.createElement(i.a,Object(n.a)({},l?{target:"_blank",rel:"noopener noreferrer",href:f?p:l}:Object.assign({isNavLink:!0,activeClassName:m,to:v},t||a?{isActive:function(e,t){return a?new RegExp(a).test(t.pathname):t.pathname.startsWith(b)}}:null),h),u)}function f(e){var t=e.items,a=e.position,i=e.className,s=Object(r.a)(e,["items","position","className"]),u=Object(c.useRef)(null),d=Object(c.useRef)(null),f=Object(c.useState)(!1),h=f[0],v=f[1];Object(c.useEffect)((function(){var e=function(e){u.current&&!u.current.contains(e.target)&&v(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),function(){document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e)}}),[u]);var b=function(e,t){return void 0===t&&(t=!1),Object(l.a)({"navbar__item navbar__link":!t,dropdown__link:t},e)};return t?o.a.createElement("div",{ref:u,className:Object(l.a)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--left":"left"===a,"dropdown--right":"right"===a,"dropdown--show":h})},o.a.createElement(m,Object(n.a)({className:b(i)},s,{onClick:s.to?void 0:function(e){return e.preventDefault()},onKeyDown:function(e){"Enter"===e.key&&(e.preventDefault(),v(!h))}}),s.label),o.a.createElement("ul",{ref:d,className:"dropdown__menu"},t.map((function(e,a){var c=e.className,l=Object(r.a)(e,["className"]);return o.a.createElement("li",{key:a},o.a.createElement(m,Object(n.a)({onKeyDown:function(e){if(a===t.length-1&&"Tab"===e.key){e.preventDefault(),v(!1);var n=u.current.nextElementSibling;n&&n.focus()}},activeClassName:"dropdown__link--active",className:b(c,!0)},l)))})))):o.a.createElement(m,Object(n.a)({className:b(i)},s))}function h(e){var t=e.items,a=e.className,i=(e.position,Object(r.a)(e,["items","className","position"])),s=Object(u.useLocation)().pathname,f=Object(c.useState)((function(){var e;return null===(e=!(null==t?void 0:t.some((function(e){return Object(d.a)(e.to,s)}))))||void 0===e||e})),h=f[0],v=f[1],b=function(e,t){return void 0===t&&(t=!1),Object(l.a)("menu__link",{"menu__link--sublist":t},e)};return t?o.a.createElement("li",{className:Object(l.a)("menu__list-item",{"menu__list-item--collapsed":h})},o.a.createElement(m,Object(n.a)({role:"button",className:b(a,!0)},i,{onClick:function(){v((function(e){return!e}))}}),i.label),o.a.createElement("ul",{className:"menu__list"},t.map((function(e,t){var a=e.className,c=Object(r.a)(e,["className"]);return o.a.createElement("li",{className:"menu__list-item",key:t},o.a.createElement(m,Object(n.a)({activeClassName:"menu__link--active",className:b(a)},c,{onClick:i.onClick})))})))):o.a.createElement("li",{className:"menu__list-item"},o.a.createElement(m,Object(n.a)({className:b(a)},i)))}t.a=function(e){var t=e.mobile,a=void 0!==t&&t,n=Object(r.a)(e,["mobile"]),c=a?h:f;return o.a.createElement(c,n)}},107:function(e,t,a){"use strict";var n=a(0),r=a.n(n),c=a(98),o=a(97),l=a(115),i=a(52),s=a.n(i);var u=function(){var e,t=Object(l.a)(),a=t.isAnnouncementBarClosed,n=t.closeAnnouncementBar,i=Object(o.a)().announcementBar;if(!i)return null;var u=i.content,d=i.backgroundColor,m=i.textColor,f=i.isCloseable;return!u||f&&a?null:r.a.createElement("div",{className:s.a.announcementBar,style:{backgroundColor:d,color:m},role:"banner"},r.a.createElement("div",{className:Object(c.a)(s.a.announcementBarContent,(e={},e[s.a.announcementBarCloseable]=f,e)),dangerouslySetInnerHTML:{__html:u}}),f?r.a.createElement("button",{type:"button",className:s.a.announcementBarClose,onClick:n,"aria-label":"Close"},r.a.createElement("span",{"aria-hidden":"true"},"\xd7")):null)},d=a(2),m=a(101),f=a(99),h=function(){return null},v=a(125),b=a.n(v),p=a(53),g=a.n(p),k=function(e){var t=e.icon,a=e.style;return r.a.createElement("span",{className:Object(c.a)(g.a.toggle,g.a.dark),style:a},t)},E=function(e){var t=e.icon,a=e.style;return r.a.createElement("span",{className:Object(c.a)(g.a.toggle,g.a.light),style:a},t)},O=function(e){var t=Object(o.a)().colorMode.switchConfig,a=t.darkIcon,n=t.darkIconStyle,c=t.lightIcon,l=t.lightIconStyle,i=Object(f.a)().isClient;return r.a.createElement(b.a,Object(d.a)({disabled:!i,icons:{checked:r.a.createElement(k,{icon:a,style:n}),unchecked:r.a.createElement(E,{icon:c,style:l})}},e))},j=a(105),y=a(103);var _=function(e){var t=Object(n.useState)(e),a=t[0],r=t[1];return Object(n.useEffect)((function(){var e=function(){return r(window.location.hash)};return window.addEventListener("hashchange",e),function(){return window.removeEventListener("hashchange",e)}}),[]),[a,r]},w=a(118),C=function(e){var t=Object(n.useState)(!0),a=t[0],r=t[1],c=Object(n.useState)(!1),o=c[0],l=c[1],i=Object(n.useState)(0),s=i[0],u=i[1],d=Object(n.useState)(0),m=d[0],f=d[1],h=Object(n.useCallback)((function(e){null!==e&&f(e.getBoundingClientRect().height)}),[]),v=Object(y.useLocation)(),b=_(v.hash),p=b[0],g=b[1];return Object(w.a)((function(t){var a=t.scrollY;if(e&&(0===a&&r(!0),!(a<m))){if(o)return l(!1),r(!1),void u(a);var n=document.documentElement.scrollHeight-m,c=window.innerHeight;s&&a>=s?r(!1):a+c<n&&r(!0),u(a)}}),[s,m]),Object(n.useEffect)((function(){e&&(r(!0),g(v.hash))}),[v]),Object(n.useEffect)((function(){e&&p&&l(!0)}),[p]),{navbarRef:h,isNavbarVisible:a}},N=a(119),S=a(120),T=a(121),I=a(54),L=a.n(I),B=a(6),x=a(106),D={default:function(){return x.a},docsVersion:function(){return a(130).default},docsVersionDropdown:function(){return a(134).default},doc:function(){return a(135).default}};function P(e){var t=e.type,a=Object(B.a)(e,["type"]),n=function(e){void 0===e&&(e="default");var t=D[e];if(!t)throw new Error("No NavbarItem component found for type="+e+".");return t()}(t);return r.a.createElement(n,a)}var M="right";var A=function(){var e,t,a=Object(f.a)().isClient,l=Object(o.a)(),i=l.navbar,s=i.title,u=i.items,v=i.hideOnScroll,b=i.style,p=l.colorMode.disableSwitch,g=Object(n.useState)(!1),k=g[0],E=g[1],y=Object(n.useState)(!1),_=y[0],w=y[1],I=Object(j.a)(),B=I.isDarkTheme,x=I.setLightTheme,D=I.setDarkTheme,A=C(v),V=A.navbarRef,X=A.isNavbarVisible,F=Object(T.a)(),U=F.logoLink,H=F.logoLinkProps,R=F.logoImageUrl,G=F.logoAlt;Object(N.a)(k);var W=Object(n.useCallback)((function(){E(!0)}),[E]),Y=Object(n.useCallback)((function(){E(!1)}),[E]),K=Object(n.useCallback)((function(e){return e.target.checked?D():x()}),[x,D]),z=Object(S.a)();Object(n.useEffect)((function(){z===S.b.desktop&&E(!1)}),[z]);var J=function(e){return{leftItems:e.filter((function(e){var t;return"left"===(null!==(t=e.position)&&void 0!==t?t:M)})),rightItems:e.filter((function(e){var t;return"right"===(null!==(t=e.position)&&void 0!==t?t:M)}))}}(u),q=J.leftItems,Q=J.rightItems;return r.a.createElement("nav",{ref:V,className:Object(c.a)("navbar","navbar--fixed-top",(e={"navbar--dark":"dark"===b,"navbar--primary":"primary"===b,"navbar-sidebar--show":k},e[L.a.navbarHideable]=v,e[L.a.navbarHidden]=!X,e))},r.a.createElement("div",{className:"navbar__inner"},r.a.createElement("div",{className:"navbar__items"},null!=u&&0!==u.length&&r.a.createElement("div",{"aria-label":"Navigation bar toggle",className:"navbar__toggle",role:"button",tabIndex:0,onClick:W,onKeyDown:W},r.a.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",width:"30",height:"30",viewBox:"0 0 30 30",role:"img",focusable:"false"},r.a.createElement("title",null,"Menu"),r.a.createElement("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"}))),r.a.createElement(m.a,Object(d.a)({className:"navbar__brand",to:U},H),null!=R&&r.a.createElement("img",{key:a,className:"navbar__logo",src:R,alt:G}),null!=s&&r.a.createElement("strong",{className:Object(c.a)("navbar__title",(t={},t[L.a.hideLogoText]=_,t))},s)),q.map((function(e,t){return r.a.createElement(P,Object(d.a)({},e,{key:t}))}))),r.a.createElement("div",{className:"navbar__items navbar__items--right"},Q.map((function(e,t){return r.a.createElement(P,Object(d.a)({},e,{key:t}))})),!p&&r.a.createElement(O,{className:L.a.displayOnlyInLargeViewport,"aria-label":"Dark mode toggle",checked:B,onChange:K}),r.a.createElement(h,{handleSearchBarToggle:w,isSearchBarExpanded:_}))),r.a.createElement("div",{role:"presentation",className:"navbar-sidebar__backdrop",onClick:Y}),r.a.createElement("div",{className:"navbar-sidebar"},r.a.createElement("div",{className:"navbar-sidebar__brand"},r.a.createElement(m.a,Object(d.a)({className:"navbar__brand",onClick:Y,to:U},H),null!=R&&r.a.createElement("img",{key:a,className:"navbar__logo",src:R,alt:G}),null!=s&&r.a.createElement("strong",{className:"navbar__title"},s)),!p&&k&&r.a.createElement(O,{"aria-label":"Dark mode toggle in sidebar",checked:B,onChange:K})),r.a.createElement("div",{className:"navbar-sidebar__items"},r.a.createElement("div",{className:"menu"},r.a.createElement("ul",{className:"menu__list"},u.map((function(e,t){return r.a.createElement(P,Object(d.a)({mobile:!0},e,{onClick:Y,key:t}))})))))))},V=a(102),X=a(55),F=a.n(X);function U(e){var t=e.to,a=e.href,n=e.label,c=e.prependBaseUrlToHref,o=Object(B.a)(e,["to","href","label","prependBaseUrlToHref"]),l=Object(V.a)(t),i=Object(V.a)(a,{forcePrependBaseUrl:!0});return r.a.createElement(m.a,Object(d.a)({className:"footer__link-item"},a?{target:"_blank",rel:"noopener noreferrer",href:c?i:a}:{to:l},o),n)}var H=function(e){var t=e.url,a=e.alt;return r.a.createElement("img",{className:"footer__logo",alt:a,src:t})};var R=function(){var e=Object(o.a)().footer,t=e||{},a=t.copyright,n=t.links,l=void 0===n?[]:n,i=t.logo,s=void 0===i?{}:i,u=Object(V.a)(s.src);return e?r.a.createElement("footer",{className:Object(c.a)("footer",{"footer--dark":"dark"===e.style})},r.a.createElement("div",{className:"container"},l&&l.length>0&&r.a.createElement("div",{className:"row footer__links"},l.map((function(e,t){return r.a.createElement("div",{key:t,className:"col footer__col"},null!=e.title?r.a.createElement("h4",{className:"footer__title"},e.title):null,null!=e.items&&Array.isArray(e.items)&&e.items.length>0?r.a.createElement("ul",{className:"footer__items"},e.items.map((function(e,t){return e.html?r.a.createElement("li",{key:t,className:"footer__item",dangerouslySetInnerHTML:{__html:e.html}}):r.a.createElement("li",{key:e.href||e.to,className:"footer__item"},r.a.createElement(U,e))}))):null)}))),(s||a)&&r.a.createElement("div",{className:"text--center"},s&&s.src&&r.a.createElement("div",{className:"margin-bottom--sm"},s.href?r.a.createElement("a",{href:s.href,target:"_blank",rel:"noopener noreferrer",className:F.a.footerLogoLink},r.a.createElement(H,{alt:s.alt,url:u})):r.a.createElement(H,{alt:s.alt,url:u})),r.a.createElement("div",{dangerouslySetInnerHTML:{__html:a}})))):null},G=a(9),W="light",Y="dark",K=function(e){return e===Y?Y:W},z=function(){return G.a.canUseDOM?K(document.documentElement.getAttribute("data-theme")):W},J=function(e){try{localStorage.setItem("theme",K(e))}catch(t){console.error(t)}},q=function(){var e=Object(o.a)().colorMode.disableSwitch,t=void 0!==e&&e,a=Object(n.useState)(z),r=a[0],c=a[1],l=Object(n.useCallback)((function(){c(W),J(W)}),[]),i=Object(n.useCallback)((function(){c(Y),J(Y)}),[]);return Object(n.useEffect)((function(){document.documentElement.setAttribute("data-theme",K(r))}),[r]),Object(n.useEffect)((function(){if(!t)try{var e=localStorage.getItem("theme");null!==e&&c(K(e))}catch(a){console.error(a)}}),[c]),Object(n.useEffect)((function(){t||window.matchMedia("(prefers-color-scheme: dark)").addListener((function(e){var t=e.matches;c(t?Y:W)}))}),[]),{isDarkTheme:r===Y,setLightTheme:l,setDarkTheme:i}},Q=a(117);var Z=function(e){var t=q(),a=t.isDarkTheme,n=t.setLightTheme,c=t.setDarkTheme;return r.a.createElement(Q.a.Provider,{value:{isDarkTheme:a,setLightTheme:n,setDarkTheme:c}},e.children)},$="docusaurus.tab.",ee=function(){var e=Object(n.useState)({}),t=e[0],a=e[1],r=Object(n.useCallback)((function(e,t){try{localStorage.setItem("docusaurus.tab."+e,t)}catch(a){console.error(a)}}),[]);return Object(n.useEffect)((function(){try{for(var e={},t=0;t<localStorage.length;t+=1){var n=localStorage.key(t);if(n.startsWith($))e[n.substring($.length)]=localStorage.getItem(n)}a(e)}catch(r){console.error(r)}}),[]),{tabGroupChoices:t,setTabGroupChoices:function(e,t){a((function(a){var n;return Object.assign({},a,((n={})[e]=t,n))})),r(e,t)}}},te="docusaurus.announcement.dismiss",ae="docusaurus.announcement.id",ne=function(){var e=Object(o.a)().announcementBar,t=Object(n.useState)(!0),a=t[0],r=t[1],c=Object(n.useCallback)((function(){localStorage.setItem(te,"true"),r(!0)}),[]);return Object(n.useEffect)((function(){if(e){var t=e.id,a=localStorage.getItem(ae);"annoucement-bar"===a&&(a="announcement-bar");var n=t!==a;localStorage.setItem(ae,t),n&&localStorage.setItem(te,"false"),(n||"false"===localStorage.getItem(te))&&r(!1)}}),[]),{isAnnouncementBarClosed:a,closeAnnouncementBar:c}},re=a(116);var ce=function(e){var t=ee(),a=t.tabGroupChoices,n=t.setTabGroupChoices,c=ne(),o=c.isAnnouncementBarClosed,l=c.closeAnnouncementBar;return r.a.createElement(re.a.Provider,{value:{tabGroupChoices:a,setTabGroupChoices:n,isAnnouncementBarClosed:o,closeAnnouncementBar:l}},e.children)},oe=a(124);function le(e){var t=e.children;return r.a.createElement(Z,null,r.a.createElement(ce,null,r.a.createElement(oe.a,null,t)))}var ie=a(109);function se(e){var t=e.language,a=e.version,n=e.tag;return r.a.createElement(ie.a,null,t&&r.a.createElement("meta",{name:"docusaurus_language",content:""+t}),a&&r.a.createElement("meta",{name:"docusaurus_version",content:a}),n&&r.a.createElement("meta",{name:"docusaurus_tag",content:n}))}var ue=a(123);function de(e){var t=Object(f.a)().siteConfig,a=t.favicon,n=t.title,c=t.themeConfig,o=c.image,l=c.metadatas,i=t.url,s=t.titleDelimiter,u=e.title,m=e.description,h=e.image,v=e.keywords,b=e.permalink,p=e.searchMetadatas,g=u?u+" "+s+" "+n:n,k=h||o,E=Object(V.a)(k,{absolute:!0}),O=Object(V.a)(a);return r.a.createElement(r.a.Fragment,null,r.a.createElement(ie.a,null,r.a.createElement("html",{lang:"en"}),g&&r.a.createElement("title",null,g),g&&r.a.createElement("meta",{property:"og:title",content:g}),a&&r.a.createElement("link",{rel:"shortcut icon",href:O}),m&&r.a.createElement("meta",{name:"description",content:m}),m&&r.a.createElement("meta",{property:"og:description",content:m}),v&&v.length&&r.a.createElement("meta",{name:"keywords",content:v.join(",")}),k&&r.a.createElement("meta",{property:"og:image",content:E}),k&&r.a.createElement("meta",{property:"twitter:image",content:E}),k&&r.a.createElement("meta",{name:"twitter:image:alt",content:"Image for "+g}),b&&r.a.createElement("meta",{property:"og:url",content:i+b}),b&&r.a.createElement("link",{rel:"canonical",href:i+b}),r.a.createElement("meta",{name:"twitter:card",content:"summary_large_image"})),r.a.createElement(se,Object(d.a)({tag:ue.a,language:"en"},p)),r.a.createElement(ie.a,null,l.map((function(e,t){return r.a.createElement("meta",Object(d.a)({key:"metadata_"+t},e))}))))}a(56);t.a=function(e){var t=e.children,a=e.noFooter,n=e.wrapperClassName;return r.a.createElement(le,null,r.a.createElement(de,e),r.a.createElement(u,null),r.a.createElement(A,null),r.a.createElement("div",{className:Object(c.a)("main-wrapper",n)},t),!a&&r.a.createElement(R,null))}},115:function(e,t,a){"use strict";var n=a(0),r=a(116);t.a=function(){var e=Object(n.useContext)(r.a);if(null==e)throw new Error("`useUserPreferencesContext` is used outside of `Layout` Component.");return e}},116:function(e,t,a){"use strict";var n=a(0),r=Object(n.createContext)(void 0);t.a=r},117:function(e,t,a){"use strict";var n=a(0),r=a.n(n).a.createContext(void 0);t.a=r},118:function(e,t,a){"use strict";var n=a(0),r=a(9),c=function(){return{scrollX:r.a.canUseDOM?window.pageXOffset:0,scrollY:r.a.canUseDOM?window.pageYOffset:0}};t.a=function(e,t){void 0===t&&(t=[]);var a=Object(n.useState)(c()),r=a[0],o=a[1],l=function(){var t=c();o(t),e&&e(t)};return Object(n.useEffect)((function(){return window.addEventListener("scroll",l),function(){return window.removeEventListener("scroll",l,{passive:!0})}}),t),r}},119:function(e,t,a){"use strict";var n=a(0);t.a=function(e){void 0===e&&(e=!0),Object(n.useEffect)((function(){return document.body.style.overflow=e?"hidden":"visible",function(){document.body.style.overflow="visible"}}),[e])}},120:function(e,t,a){"use strict";a.d(t,"b",(function(){return r}));var n=a(0),r={desktop:"desktop",mobile:"mobile"};t.a=function(){var e="undefined"!=typeof window;function t(){if(e)return window.innerWidth>996?r.desktop:r.mobile}var a=Object(n.useState)(t),c=a[0],o=a[1];return Object(n.useEffect)((function(){if(e)return window.addEventListener("resize",a),function(){return window.removeEventListener("resize",a)};function a(){o(t())}}),[]),c}},121:function(e,t,a){"use strict";var n=a(105),r=a(102),c=a(104),o=a(97);t.a=function(){var e=Object(o.a)().navbar.logo,t=Object(n.a)().isDarkTheme,a=Object(r.a)(e.href||"/"),l={};e.target?l={target:e.target}:Object(c.a)(a)||(l={rel:"noopener noreferrer",target:"_blank"});var i=e.srcDark&&t?e.srcDark:e.src;return{logoLink:a,logoLinkProps:l,logoImageUrl:Object(r.a)(i),logoAlt:e.alt}}},122:function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));var n=function(e,t){var a=function(e){return e.endsWith("/")?e:e+"/"};return a(e)===a(t)}},123:function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return r}));var n="default";function r(e,t){return"docs-"+e+"-"+t}},125:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var a=arguments[t];for(var n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n])}return e},r=function(){function e(e,t){for(var a=0;a<t.length;a++){var n=t[a];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(e,n.key,n)}}return function(t,a,n){return a&&e(t.prototype,a),n&&e(t,n),t}}(),c=a(0),o=m(c),l=m(a(126)),i=m(a(7)),s=m(a(127)),u=m(a(128)),d=a(129);function m(e){return e&&e.__esModule?e:{default:e}}var f=function(e){function t(e){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,t);var a=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t}(this,(t.__proto__||Object.getPrototypeOf(t)).call(this,e));return a.handleClick=a.handleClick.bind(a),a.handleTouchStart=a.handleTouchStart.bind(a),a.handleTouchMove=a.handleTouchMove.bind(a),a.handleTouchEnd=a.handleTouchEnd.bind(a),a.handleFocus=a.handleFocus.bind(a),a.handleBlur=a.handleBlur.bind(a),a.previouslyChecked=!(!e.checked&&!e.defaultChecked),a.state={checked:!(!e.checked&&!e.defaultChecked),hasFocus:!1},a}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(t,e),r(t,[{key:"componentDidUpdate",value:function(e){e.checked!==this.props.checked&&this.setState({checked:!!this.props.checked})}},{key:"handleClick",value:function(e){var t=this.input;if(e.target!==t&&!this.moved)return this.previouslyChecked=t.checked,e.preventDefault(),t.focus(),void t.click();var a=this.props.hasOwnProperty("checked")?this.props.checked:t.checked;this.setState({checked:a})}},{key:"handleTouchStart",value:function(e){this.startX=(0,d.pointerCoord)(e).x,this.activated=!0}},{key:"handleTouchMove",value:function(e){if(this.activated&&(this.moved=!0,this.startX)){var t=(0,d.pointerCoord)(e).x;this.state.checked&&t+15<this.startX?(this.setState({checked:!1}),this.startX=t,this.activated=!0):t-15>this.startX&&(this.setState({checked:!0}),this.startX=t,this.activated=t<this.startX+5)}}},{key:"handleTouchEnd",value:function(e){if(this.moved){var t=this.input;if(e.preventDefault(),this.startX){var a=(0,d.pointerCoord)(e).x;!0===this.previouslyChecked&&this.startX+4>a?this.previouslyChecked!==this.state.checked&&(this.setState({checked:!1}),this.previouslyChecked=this.state.checked,t.click()):this.startX-4<a&&this.previouslyChecked!==this.state.checked&&(this.setState({checked:!0}),this.previouslyChecked=this.state.checked,t.click()),this.activated=!1,this.startX=null,this.moved=!1}}}},{key:"handleFocus",value:function(e){var t=this.props.onFocus;t&&t(e),this.setState({hasFocus:!0})}},{key:"handleBlur",value:function(e){var t=this.props.onBlur;t&&t(e),this.setState({hasFocus:!1})}},{key:"getIcon",value:function(e){var a=this.props.icons;return a?void 0===a[e]?t.defaultProps.icons[e]:a[e]:null}},{key:"render",value:function(){var e=this,t=this.props,a=t.className,r=(t.icons,function(e,t){var a={};for(var n in e)t.indexOf(n)>=0||Object.prototype.hasOwnProperty.call(e,n)&&(a[n]=e[n]);return a}(t,["className","icons"])),c=(0,l.default)("react-toggle",{"react-toggle--checked":this.state.checked,"react-toggle--focus":this.state.hasFocus,"react-toggle--disabled":this.props.disabled},a);return o.default.createElement("div",{className:c,onClick:this.handleClick,onTouchStart:this.handleTouchStart,onTouchMove:this.handleTouchMove,onTouchEnd:this.handleTouchEnd},o.default.createElement("div",{className:"react-toggle-track"},o.default.createElement("div",{className:"react-toggle-track-check"},this.getIcon("checked")),o.default.createElement("div",{className:"react-toggle-track-x"},this.getIcon("unchecked"))),o.default.createElement("div",{className:"react-toggle-thumb"}),o.default.createElement("input",n({},r,{ref:function(t){e.input=t},onFocus:this.handleFocus,onBlur:this.handleBlur,className:"react-toggle-screenreader-only",type:"checkbox"})))}}]),t}(c.PureComponent);t.default=f,f.displayName="Toggle",f.defaultProps={icons:{checked:o.default.createElement(s.default,null),unchecked:o.default.createElement(u.default,null)}},f.propTypes={checked:i.default.bool,disabled:i.default.bool,defaultChecked:i.default.bool,onChange:i.default.func,onFocus:i.default.func,onBlur:i.default.func,className:i.default.string,name:i.default.string,value:i.default.string,id:i.default.string,"aria-labelledby":i.default.string,"aria-label":i.default.string,icons:i.default.oneOfType([i.default.bool,i.default.shape({checked:i.default.node,unchecked:i.default.node})])}},126:function(e,t,a){var n;!function(){"use strict";var a={}.hasOwnProperty;function r(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var c=typeof n;if("string"===c||"number"===c)e.push(n);else if(Array.isArray(n)&&n.length){var o=r.apply(null,n);o&&e.push(o)}else if("object"===c)for(var l in n)a.call(n,l)&&n[l]&&e.push(l)}}return e.join(" ")}e.exports?(r.default=r,e.exports=r):void 0===(n=function(){return r}.apply(t,[]))||(e.exports=n)}()},127:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n,r=a(0),c=(n=r)&&n.__esModule?n:{default:n};t.default=function(){return c.default.createElement("svg",{width:"14",height:"11",viewBox:"0 0 14 11"},c.default.createElement("title",null,"switch-check"),c.default.createElement("path",{d:"M11.264 0L5.26 6.004 2.103 2.847 0 4.95l5.26 5.26 8.108-8.107L11.264 0",fill:"#fff",fillRule:"evenodd"}))}},128:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n,r=a(0),c=(n=r)&&n.__esModule?n:{default:n};t.default=function(){return c.default.createElement("svg",{width:"10",height:"10",viewBox:"0 0 10 10"},c.default.createElement("title",null,"switch-x"),c.default.createElement("path",{d:"M9.9 2.12L7.78 0 4.95 2.828 2.12 0 0 2.12l2.83 2.83L0 7.776 2.123 9.9 4.95 7.07 7.78 9.9 9.9 7.776 7.072 4.95 9.9 2.12",fill:"#fff",fillRule:"evenodd"}))}},129:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.pointerCoord=function(e){if(e){var t=e.changedTouches;if(t&&t.length>0){var a=t[0];return{x:a.clientX,y:a.clientY}}var n=e.pageX;if(void 0!==n)return{x:n,y:e.pageY}}return{x:0,y:0}}},130:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return u}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(106),i=a(100),s=a(108);function u(e){var t,a=e.label,c=e.to,u=e.docsPluginId,d=Object(r.a)(e,["label","to","docsPluginId"]),m=Object(i.useActiveVersion)(u),f=Object(s.a)(u).preferredVersion,h=Object(i.useLatestVersion)(u),v=null!==(t=null!=m?m:f)&&void 0!==t?t:h,b=null!=a?a:v.label,p=null!=c?c:function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))}(v).path;return o.a.createElement(l.a,Object(n.a)({},d,{label:b,to:p}))}},134:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(106),i=a(100),s=a(108),u=function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))};function d(e){var t,a,c=e.mobile,d=e.docsPluginId,m=e.dropdownActiveClassDisabled,f=e.dropdownItemsBefore,h=e.dropdownItemsAfter,v=Object(r.a)(e,["mobile","docsPluginId","dropdownActiveClassDisabled","dropdownItemsBefore","dropdownItemsAfter"]),b=Object(i.useActiveDocContext)(d),p=Object(i.useVersions)(d),g=Object(i.useLatestVersion)(d),k=Object(s.a)(d),E=k.preferredVersion,O=k.savePreferredVersionName;var j=null!==(t=null!==(a=b.activeVersion)&&void 0!==a?a:E)&&void 0!==t?t:g,y=c?"Versions":j.label,_=c?void 0:u(j).path;return o.a.createElement(l.a,Object(n.a)({},v,{mobile:c,label:y,to:_,items:function(){var e=p.map((function(e){var t=(null==b?void 0:b.alternateDocVersions[e.name])||u(e);return{isNavLink:!0,label:e.label,to:t.path,isActive:function(){return e===(null==b?void 0:b.activeVersion)},onClick:function(){O(e.name)}}})),t=[].concat(f,e,h);if(!(t.length<=1))return t}(),isActive:m?function(){return!1}:void 0}))}},135:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(106),i=a(100),s=a(98),u=a(108);function d(e){var t,a,c=e.docId,d=e.activeSidebarClassName,m=e.label,f=e.docsPluginId,h=Object(r.a)(e,["docId","activeSidebarClassName","label","docsPluginId"]),v=Object(i.useActiveDocContext)(f),b=v.activeVersion,p=v.activeDoc,g=Object(u.a)(f).preferredVersion,k=Object(i.useLatestVersion)(f),E=null!==(t=null!=b?b:g)&&void 0!==t?t:k,O=E.docs.find((function(e){return e.id===c}));if(!O)throw new Error("DocNavbarItem: couldn't find any doc with id="+c+" in version "+E.name+".\nAvailable docIds=\n- "+E.docs.join("\n- "));return o.a.createElement(l.a,Object(n.a)({exact:!0},h,{className:Object(s.a)(h.className,(a={},a[d]=p&&p.sidebar===O.sidebar,a)),label:null!=m?m:O.id,to:O.path}))}}}]);
\ No newline at end of file
+/*! For license information please see 2.cd1a0941.js.LICENSE.txt */
+(window.webpackJsonp=window.webpackJsonp||[]).push([[2],{104:function(e,t,a){"use strict";var n=a(0),r=a(116);t.a=function(){var e=Object(n.useContext)(r.a);if(null==e)throw new Error("`useThemeContext` is used outside of `Layout` Component. See https://v2.docusaurus.io/docs/theme-classic#usethemecontext.");return e}},105:function(e,t,a){"use strict";var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(97),i=a(100),s=a(101),u=a(102),d=a(121);function m(e){var t=e.activeBasePath,a=e.activeBaseRegex,c=e.to,l=e.href,u=e.label,d=e.activeClassName,m=void 0===d?"navbar__link--active":d,f=e.prependBaseUrlToHref,h=Object(r.a)(e,["activeBasePath","activeBaseRegex","to","href","label","activeClassName","prependBaseUrlToHref"]),v=Object(s.a)(c),b=Object(s.a)(t),p=Object(s.a)(l,{forcePrependBaseUrl:!0});return o.a.createElement(i.a,Object(n.a)({},l?{target:"_blank",rel:"noopener noreferrer",href:f?p:l}:Object.assign({isNavLink:!0,activeClassName:m,to:v},t||a?{isActive:function(e,t){return a?new RegExp(a).test(t.pathname):t.pathname.startsWith(b)}}:null),h),u)}function f(e){var t=e.items,a=e.position,i=e.className,s=Object(r.a)(e,["items","position","className"]),u=Object(c.useRef)(null),d=Object(c.useRef)(null),f=Object(c.useState)(!1),h=f[0],v=f[1];Object(c.useEffect)((function(){var e=function(e){u.current&&!u.current.contains(e.target)&&v(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),function(){document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e)}}),[u]);var b=function(e,t){return void 0===t&&(t=!1),Object(l.a)({"navbar__item navbar__link":!t,dropdown__link:t},e)};return t?o.a.createElement("div",{ref:u,className:Object(l.a)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--left":"left"===a,"dropdown--right":"right"===a,"dropdown--show":h})},o.a.createElement(m,Object(n.a)({className:b(i)},s,{onClick:s.to?void 0:function(e){return e.preventDefault()},onKeyDown:function(e){"Enter"===e.key&&(e.preventDefault(),v(!h))}}),s.label),o.a.createElement("ul",{ref:d,className:"dropdown__menu"},t.map((function(e,a){var c=e.className,l=Object(r.a)(e,["className"]);return o.a.createElement("li",{key:a},o.a.createElement(m,Object(n.a)({onKeyDown:function(e){if(a===t.length-1&&"Tab"===e.key){e.preventDefault(),v(!1);var n=u.current.nextElementSibling;n&&n.focus()}},activeClassName:"dropdown__link--active",className:b(c,!0)},l)))})))):o.a.createElement(m,Object(n.a)({className:b(i)},s))}function h(e){var t=e.items,a=e.className,i=(e.position,Object(r.a)(e,["items","className","position"])),s=Object(u.useLocation)().pathname,f=Object(c.useState)((function(){var e;return null===(e=!(null==t?void 0:t.some((function(e){return Object(d.a)(e.to,s)}))))||void 0===e||e})),h=f[0],v=f[1],b=function(e,t){return void 0===t&&(t=!1),Object(l.a)("menu__link",{"menu__link--sublist":t},e)};return t?o.a.createElement("li",{className:Object(l.a)("menu__list-item",{"menu__list-item--collapsed":h})},o.a.createElement(m,Object(n.a)({role:"button",className:b(a,!0)},i,{onClick:function(){v((function(e){return!e}))}}),i.label),o.a.createElement("ul",{className:"menu__list"},t.map((function(e,t){var a=e.className,c=Object(r.a)(e,["className"]);return o.a.createElement("li",{className:"menu__list-item",key:t},o.a.createElement(m,Object(n.a)({activeClassName:"menu__link--active",className:b(a)},c,{onClick:i.onClick})))})))):o.a.createElement("li",{className:"menu__list-item"},o.a.createElement(m,Object(n.a)({className:b(a)},i)))}t.a=function(e){var t=e.mobile,a=void 0!==t&&t,n=Object(r.a)(e,["mobile"]),c=a?h:f;return o.a.createElement(c,n)}},106:function(e,t,a){"use strict";var n=a(0),r=a.n(n),c=a(97),o=a(96),l=a(114),i=a(52),s=a.n(i);var u=function(){var e,t=Object(l.a)(),a=t.isAnnouncementBarClosed,n=t.closeAnnouncementBar,i=Object(o.a)().announcementBar;if(!i)return null;var u=i.content,d=i.backgroundColor,m=i.textColor,f=i.isCloseable;return!u||f&&a?null:r.a.createElement("div",{className:s.a.announcementBar,style:{backgroundColor:d,color:m},role:"banner"},r.a.createElement("div",{className:Object(c.a)(s.a.announcementBarContent,(e={},e[s.a.announcementBarCloseable]=f,e)),dangerouslySetInnerHTML:{__html:u}}),f?r.a.createElement("button",{type:"button",className:s.a.announcementBarClose,onClick:n,"aria-label":"Close"},r.a.createElement("span",{"aria-hidden":"true"},"\xd7")):null)},d=a(2),m=a(100),f=a(98),h=function(){return null},v=a(124),b=a.n(v),p=a(53),g=a.n(p),k=function(e){var t=e.icon,a=e.style;return r.a.createElement("span",{className:Object(c.a)(g.a.toggle,g.a.dark),style:a},t)},E=function(e){var t=e.icon,a=e.style;return r.a.createElement("span",{className:Object(c.a)(g.a.toggle,g.a.light),style:a},t)},O=function(e){var t=Object(o.a)().colorMode.switchConfig,a=t.darkIcon,n=t.darkIconStyle,c=t.lightIcon,l=t.lightIconStyle,i=Object(f.a)().isClient;return r.a.createElement(b.a,Object(d.a)({disabled:!i,icons:{checked:r.a.createElement(k,{icon:a,style:n}),unchecked:r.a.createElement(E,{icon:c,style:l})}},e))},j=a(104),y=a(102);var _=function(e){var t=Object(n.useState)(e),a=t[0],r=t[1];return Object(n.useEffect)((function(){var e=function(){return r(window.location.hash)};return window.addEventListener("hashchange",e),function(){return window.removeEventListener("hashchange",e)}}),[]),[a,r]},w=a(117),C=function(e){var t=Object(n.useState)(!0),a=t[0],r=t[1],c=Object(n.useState)(!1),o=c[0],l=c[1],i=Object(n.useState)(0),s=i[0],u=i[1],d=Object(n.useState)(0),m=d[0],f=d[1],h=Object(n.useCallback)((function(e){null!==e&&f(e.getBoundingClientRect().height)}),[]),v=Object(y.useLocation)(),b=_(v.hash),p=b[0],g=b[1];return Object(w.a)((function(t){var a=t.scrollY;if(e&&(0===a&&r(!0),!(a<m))){if(o)return l(!1),r(!1),void u(a);var n=document.documentElement.scrollHeight-m,c=window.innerHeight;s&&a>=s?r(!1):a+c<n&&r(!0),u(a)}}),[s,m]),Object(n.useEffect)((function(){e&&(r(!0),g(v.hash))}),[v]),Object(n.useEffect)((function(){e&&p&&l(!0)}),[p]),{navbarRef:h,isNavbarVisible:a}},N=a(118),S=a(119),T=a(120),I=a(54),L=a.n(I),B=a(6),x=a(105),D={default:function(){return x.a},docsVersion:function(){return a(129).default},docsVersionDropdown:function(){return a(133).default},doc:function(){return a(134).default}};function P(e){var t=e.type,a=Object(B.a)(e,["type"]),n=function(e){void 0===e&&(e="default");var t=D[e];if(!t)throw new Error("No NavbarItem component found for type="+e+".");return t()}(t);return r.a.createElement(n,a)}var M="right";var A=function(){var e,t,a=Object(f.a)().isClient,l=Object(o.a)(),i=l.navbar,s=i.title,u=i.items,v=i.hideOnScroll,b=i.style,p=l.colorMode.disableSwitch,g=Object(n.useState)(!1),k=g[0],E=g[1],y=Object(n.useState)(!1),_=y[0],w=y[1],I=Object(j.a)(),B=I.isDarkTheme,x=I.setLightTheme,D=I.setDarkTheme,A=C(v),V=A.navbarRef,X=A.isNavbarVisible,F=Object(T.a)(),U=F.logoLink,H=F.logoLinkProps,R=F.logoImageUrl,G=F.logoAlt;Object(N.a)(k);var W=Object(n.useCallback)((function(){E(!0)}),[E]),Y=Object(n.useCallback)((function(){E(!1)}),[E]),K=Object(n.useCallback)((function(e){return e.target.checked?D():x()}),[x,D]),z=Object(S.a)();Object(n.useEffect)((function(){z===S.b.desktop&&E(!1)}),[z]);var J=function(e){return{leftItems:e.filter((function(e){var t;return"left"===(null!==(t=e.position)&&void 0!==t?t:M)})),rightItems:e.filter((function(e){var t;return"right"===(null!==(t=e.position)&&void 0!==t?t:M)}))}}(u),q=J.leftItems,Q=J.rightItems;return r.a.createElement("nav",{ref:V,className:Object(c.a)("navbar","navbar--fixed-top",(e={"navbar--dark":"dark"===b,"navbar--primary":"primary"===b,"navbar-sidebar--show":k},e[L.a.navbarHideable]=v,e[L.a.navbarHidden]=!X,e))},r.a.createElement("div",{className:"navbar__inner"},r.a.createElement("div",{className:"navbar__items"},null!=u&&0!==u.length&&r.a.createElement("div",{"aria-label":"Navigation bar toggle",className:"navbar__toggle",role:"button",tabIndex:0,onClick:W,onKeyDown:W},r.a.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",width:"30",height:"30",viewBox:"0 0 30 30",role:"img",focusable:"false"},r.a.createElement("title",null,"Menu"),r.a.createElement("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"}))),r.a.createElement(m.a,Object(d.a)({className:"navbar__brand",to:U},H),null!=R&&r.a.createElement("img",{key:a,className:"navbar__logo",src:R,alt:G}),null!=s&&r.a.createElement("strong",{className:Object(c.a)("navbar__title",(t={},t[L.a.hideLogoText]=_,t))},s)),q.map((function(e,t){return r.a.createElement(P,Object(d.a)({},e,{key:t}))}))),r.a.createElement("div",{className:"navbar__items navbar__items--right"},Q.map((function(e,t){return r.a.createElement(P,Object(d.a)({},e,{key:t}))})),!p&&r.a.createElement(O,{className:L.a.displayOnlyInLargeViewport,"aria-label":"Dark mode toggle",checked:B,onChange:K}),r.a.createElement(h,{handleSearchBarToggle:w,isSearchBarExpanded:_}))),r.a.createElement("div",{role:"presentation",className:"navbar-sidebar__backdrop",onClick:Y}),r.a.createElement("div",{className:"navbar-sidebar"},r.a.createElement("div",{className:"navbar-sidebar__brand"},r.a.createElement(m.a,Object(d.a)({className:"navbar__brand",onClick:Y,to:U},H),null!=R&&r.a.createElement("img",{key:a,className:"navbar__logo",src:R,alt:G}),null!=s&&r.a.createElement("strong",{className:"navbar__title"},s)),!p&&k&&r.a.createElement(O,{"aria-label":"Dark mode toggle in sidebar",checked:B,onChange:K})),r.a.createElement("div",{className:"navbar-sidebar__items"},r.a.createElement("div",{className:"menu"},r.a.createElement("ul",{className:"menu__list"},u.map((function(e,t){return r.a.createElement(P,Object(d.a)({mobile:!0},e,{onClick:Y,key:t}))})))))))},V=a(101),X=a(55),F=a.n(X);function U(e){var t=e.to,a=e.href,n=e.label,c=e.prependBaseUrlToHref,o=Object(B.a)(e,["to","href","label","prependBaseUrlToHref"]),l=Object(V.a)(t),i=Object(V.a)(a,{forcePrependBaseUrl:!0});return r.a.createElement(m.a,Object(d.a)({className:"footer__link-item"},a?{target:"_blank",rel:"noopener noreferrer",href:c?i:a}:{to:l},o),n)}var H=function(e){var t=e.url,a=e.alt;return r.a.createElement("img",{className:"footer__logo",alt:a,src:t})};var R=function(){var e=Object(o.a)().footer,t=e||{},a=t.copyright,n=t.links,l=void 0===n?[]:n,i=t.logo,s=void 0===i?{}:i,u=Object(V.a)(s.src);return e?r.a.createElement("footer",{className:Object(c.a)("footer",{"footer--dark":"dark"===e.style})},r.a.createElement("div",{className:"container"},l&&l.length>0&&r.a.createElement("div",{className:"row footer__links"},l.map((function(e,t){return r.a.createElement("div",{key:t,className:"col footer__col"},null!=e.title?r.a.createElement("h4",{className:"footer__title"},e.title):null,null!=e.items&&Array.isArray(e.items)&&e.items.length>0?r.a.createElement("ul",{className:"footer__items"},e.items.map((function(e,t){return e.html?r.a.createElement("li",{key:t,className:"footer__item",dangerouslySetInnerHTML:{__html:e.html}}):r.a.createElement("li",{key:e.href||e.to,className:"footer__item"},r.a.createElement(U,e))}))):null)}))),(s||a)&&r.a.createElement("div",{className:"text--center"},s&&s.src&&r.a.createElement("div",{className:"margin-bottom--sm"},s.href?r.a.createElement("a",{href:s.href,target:"_blank",rel:"noopener noreferrer",className:F.a.footerLogoLink},r.a.createElement(H,{alt:s.alt,url:u})):r.a.createElement(H,{alt:s.alt,url:u})),r.a.createElement("div",{dangerouslySetInnerHTML:{__html:a}})))):null},G=a(9),W="light",Y="dark",K=function(e){return e===Y?Y:W},z=function(){return G.a.canUseDOM?K(document.documentElement.getAttribute("data-theme")):W},J=function(e){try{localStorage.setItem("theme",K(e))}catch(t){console.error(t)}},q=function(){var e=Object(o.a)().colorMode.disableSwitch,t=void 0!==e&&e,a=Object(n.useState)(z),r=a[0],c=a[1],l=Object(n.useCallback)((function(){c(W),J(W)}),[]),i=Object(n.useCallback)((function(){c(Y),J(Y)}),[]);return Object(n.useEffect)((function(){document.documentElement.setAttribute("data-theme",K(r))}),[r]),Object(n.useEffect)((function(){if(!t)try{var e=localStorage.getItem("theme");null!==e&&c(K(e))}catch(a){console.error(a)}}),[c]),Object(n.useEffect)((function(){t||window.matchMedia("(prefers-color-scheme: dark)").addListener((function(e){var t=e.matches;c(t?Y:W)}))}),[]),{isDarkTheme:r===Y,setLightTheme:l,setDarkTheme:i}},Q=a(116);var Z=function(e){var t=q(),a=t.isDarkTheme,n=t.setLightTheme,c=t.setDarkTheme;return r.a.createElement(Q.a.Provider,{value:{isDarkTheme:a,setLightTheme:n,setDarkTheme:c}},e.children)},$="docusaurus.tab.",ee=function(){var e=Object(n.useState)({}),t=e[0],a=e[1],r=Object(n.useCallback)((function(e,t){try{localStorage.setItem("docusaurus.tab."+e,t)}catch(a){console.error(a)}}),[]);return Object(n.useEffect)((function(){try{for(var e={},t=0;t<localStorage.length;t+=1){var n=localStorage.key(t);if(n.startsWith($))e[n.substring($.length)]=localStorage.getItem(n)}a(e)}catch(r){console.error(r)}}),[]),{tabGroupChoices:t,setTabGroupChoices:function(e,t){a((function(a){var n;return Object.assign({},a,((n={})[e]=t,n))})),r(e,t)}}},te="docusaurus.announcement.dismiss",ae="docusaurus.announcement.id",ne=function(){var e=Object(o.a)().announcementBar,t=Object(n.useState)(!0),a=t[0],r=t[1],c=Object(n.useCallback)((function(){localStorage.setItem(te,"true"),r(!0)}),[]);return Object(n.useEffect)((function(){if(e){var t=e.id,a=localStorage.getItem(ae);"annoucement-bar"===a&&(a="announcement-bar");var n=t!==a;localStorage.setItem(ae,t),n&&localStorage.setItem(te,"false"),(n||"false"===localStorage.getItem(te))&&r(!1)}}),[]),{isAnnouncementBarClosed:a,closeAnnouncementBar:c}},re=a(115);var ce=function(e){var t=ee(),a=t.tabGroupChoices,n=t.setTabGroupChoices,c=ne(),o=c.isAnnouncementBarClosed,l=c.closeAnnouncementBar;return r.a.createElement(re.a.Provider,{value:{tabGroupChoices:a,setTabGroupChoices:n,isAnnouncementBarClosed:o,closeAnnouncementBar:l}},e.children)},oe=a(123);function le(e){var t=e.children;return r.a.createElement(Z,null,r.a.createElement(ce,null,r.a.createElement(oe.a,null,t)))}var ie=a(108);function se(e){var t=e.language,a=e.version,n=e.tag;return r.a.createElement(ie.a,null,t&&r.a.createElement("meta",{name:"docusaurus_language",content:""+t}),a&&r.a.createElement("meta",{name:"docusaurus_version",content:a}),n&&r.a.createElement("meta",{name:"docusaurus_tag",content:n}))}var ue=a(122);function de(e){var t=Object(f.a)().siteConfig,a=t.favicon,n=t.title,c=t.themeConfig,o=c.image,l=c.metadatas,i=t.url,s=t.titleDelimiter,u=e.title,m=e.description,h=e.image,v=e.keywords,b=e.permalink,p=e.searchMetadatas,g=u?u+" "+s+" "+n:n,k=h||o,E=Object(V.a)(k,{absolute:!0}),O=Object(V.a)(a);return r.a.createElement(r.a.Fragment,null,r.a.createElement(ie.a,null,r.a.createElement("html",{lang:"en"}),g&&r.a.createElement("title",null,g),g&&r.a.createElement("meta",{property:"og:title",content:g}),a&&r.a.createElement("link",{rel:"shortcut icon",href:O}),m&&r.a.createElement("meta",{name:"description",content:m}),m&&r.a.createElement("meta",{property:"og:description",content:m}),v&&v.length&&r.a.createElement("meta",{name:"keywords",content:v.join(",")}),k&&r.a.createElement("meta",{property:"og:image",content:E}),k&&r.a.createElement("meta",{property:"twitter:image",content:E}),k&&r.a.createElement("meta",{name:"twitter:image:alt",content:"Image for "+g}),b&&r.a.createElement("meta",{property:"og:url",content:i+b}),b&&r.a.createElement("link",{rel:"canonical",href:i+b}),r.a.createElement("meta",{name:"twitter:card",content:"summary_large_image"})),r.a.createElement(se,Object(d.a)({tag:ue.a,language:"en"},p)),r.a.createElement(ie.a,null,l.map((function(e,t){return r.a.createElement("meta",Object(d.a)({key:"metadata_"+t},e))}))))}a(56);t.a=function(e){var t=e.children,a=e.noFooter,n=e.wrapperClassName;return r.a.createElement(le,null,r.a.createElement(de,e),r.a.createElement(u,null),r.a.createElement(A,null),r.a.createElement("div",{className:Object(c.a)("main-wrapper",n)},t),!a&&r.a.createElement(R,null))}},114:function(e,t,a){"use strict";var n=a(0),r=a(115);t.a=function(){var e=Object(n.useContext)(r.a);if(null==e)throw new Error("`useUserPreferencesContext` is used outside of `Layout` Component.");return e}},115:function(e,t,a){"use strict";var n=a(0),r=Object(n.createContext)(void 0);t.a=r},116:function(e,t,a){"use strict";var n=a(0),r=a.n(n).a.createContext(void 0);t.a=r},117:function(e,t,a){"use strict";var n=a(0),r=a(9),c=function(){return{scrollX:r.a.canUseDOM?window.pageXOffset:0,scrollY:r.a.canUseDOM?window.pageYOffset:0}};t.a=function(e,t){void 0===t&&(t=[]);var a=Object(n.useState)(c()),r=a[0],o=a[1],l=function(){var t=c();o(t),e&&e(t)};return Object(n.useEffect)((function(){return window.addEventListener("scroll",l),function(){return window.removeEventListener("scroll",l,{passive:!0})}}),t),r}},118:function(e,t,a){"use strict";var n=a(0);t.a=function(e){void 0===e&&(e=!0),Object(n.useEffect)((function(){return document.body.style.overflow=e?"hidden":"visible",function(){document.body.style.overflow="visible"}}),[e])}},119:function(e,t,a){"use strict";a.d(t,"b",(function(){return r}));var n=a(0),r={desktop:"desktop",mobile:"mobile"};t.a=function(){var e="undefined"!=typeof window;function t(){if(e)return window.innerWidth>996?r.desktop:r.mobile}var a=Object(n.useState)(t),c=a[0],o=a[1];return Object(n.useEffect)((function(){if(e)return window.addEventListener("resize",a),function(){return window.removeEventListener("resize",a)};function a(){o(t())}}),[]),c}},120:function(e,t,a){"use strict";var n=a(104),r=a(101),c=a(103),o=a(96);t.a=function(){var e=Object(o.a)().navbar.logo,t=Object(n.a)().isDarkTheme,a=Object(r.a)(e.href||"/"),l={};e.target?l={target:e.target}:Object(c.a)(a)||(l={rel:"noopener noreferrer",target:"_blank"});var i=e.srcDark&&t?e.srcDark:e.src;return{logoLink:a,logoLinkProps:l,logoImageUrl:Object(r.a)(i),logoAlt:e.alt}}},121:function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));var n=function(e,t){var a=function(e){return e.endsWith("/")?e:e+"/"};return a(e)===a(t)}},122:function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return r}));var n="default";function r(e,t){return"docs-"+e+"-"+t}},124:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var a=arguments[t];for(var n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n])}return e},r=function(){function e(e,t){for(var a=0;a<t.length;a++){var n=t[a];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(e,n.key,n)}}return function(t,a,n){return a&&e(t.prototype,a),n&&e(t,n),t}}(),c=a(0),o=m(c),l=m(a(125)),i=m(a(7)),s=m(a(126)),u=m(a(127)),d=a(128);function m(e){return e&&e.__esModule?e:{default:e}}var f=function(e){function t(e){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,t);var a=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t}(this,(t.__proto__||Object.getPrototypeOf(t)).call(this,e));return a.handleClick=a.handleClick.bind(a),a.handleTouchStart=a.handleTouchStart.bind(a),a.handleTouchMove=a.handleTouchMove.bind(a),a.handleTouchEnd=a.handleTouchEnd.bind(a),a.handleFocus=a.handleFocus.bind(a),a.handleBlur=a.handleBlur.bind(a),a.previouslyChecked=!(!e.checked&&!e.defaultChecked),a.state={checked:!(!e.checked&&!e.defaultChecked),hasFocus:!1},a}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(t,e),r(t,[{key:"componentDidUpdate",value:function(e){e.checked!==this.props.checked&&this.setState({checked:!!this.props.checked})}},{key:"handleClick",value:function(e){var t=this.input;if(e.target!==t&&!this.moved)return this.previouslyChecked=t.checked,e.preventDefault(),t.focus(),void t.click();var a=this.props.hasOwnProperty("checked")?this.props.checked:t.checked;this.setState({checked:a})}},{key:"handleTouchStart",value:function(e){this.startX=(0,d.pointerCoord)(e).x,this.activated=!0}},{key:"handleTouchMove",value:function(e){if(this.activated&&(this.moved=!0,this.startX)){var t=(0,d.pointerCoord)(e).x;this.state.checked&&t+15<this.startX?(this.setState({checked:!1}),this.startX=t,this.activated=!0):t-15>this.startX&&(this.setState({checked:!0}),this.startX=t,this.activated=t<this.startX+5)}}},{key:"handleTouchEnd",value:function(e){if(this.moved){var t=this.input;if(e.preventDefault(),this.startX){var a=(0,d.pointerCoord)(e).x;!0===this.previouslyChecked&&this.startX+4>a?this.previouslyChecked!==this.state.checked&&(this.setState({checked:!1}),this.previouslyChecked=this.state.checked,t.click()):this.startX-4<a&&this.previouslyChecked!==this.state.checked&&(this.setState({checked:!0}),this.previouslyChecked=this.state.checked,t.click()),this.activated=!1,this.startX=null,this.moved=!1}}}},{key:"handleFocus",value:function(e){var t=this.props.onFocus;t&&t(e),this.setState({hasFocus:!0})}},{key:"handleBlur",value:function(e){var t=this.props.onBlur;t&&t(e),this.setState({hasFocus:!1})}},{key:"getIcon",value:function(e){var a=this.props.icons;return a?void 0===a[e]?t.defaultProps.icons[e]:a[e]:null}},{key:"render",value:function(){var e=this,t=this.props,a=t.className,r=(t.icons,function(e,t){var a={};for(var n in e)t.indexOf(n)>=0||Object.prototype.hasOwnProperty.call(e,n)&&(a[n]=e[n]);return a}(t,["className","icons"])),c=(0,l.default)("react-toggle",{"react-toggle--checked":this.state.checked,"react-toggle--focus":this.state.hasFocus,"react-toggle--disabled":this.props.disabled},a);return o.default.createElement("div",{className:c,onClick:this.handleClick,onTouchStart:this.handleTouchStart,onTouchMove:this.handleTouchMove,onTouchEnd:this.handleTouchEnd},o.default.createElement("div",{className:"react-toggle-track"},o.default.createElement("div",{className:"react-toggle-track-check"},this.getIcon("checked")),o.default.createElement("div",{className:"react-toggle-track-x"},this.getIcon("unchecked"))),o.default.createElement("div",{className:"react-toggle-thumb"}),o.default.createElement("input",n({},r,{ref:function(t){e.input=t},onFocus:this.handleFocus,onBlur:this.handleBlur,className:"react-toggle-screenreader-only",type:"checkbox"})))}}]),t}(c.PureComponent);t.default=f,f.displayName="Toggle",f.defaultProps={icons:{checked:o.default.createElement(s.default,null),unchecked:o.default.createElement(u.default,null)}},f.propTypes={checked:i.default.bool,disabled:i.default.bool,defaultChecked:i.default.bool,onChange:i.default.func,onFocus:i.default.func,onBlur:i.default.func,className:i.default.string,name:i.default.string,value:i.default.string,id:i.default.string,"aria-labelledby":i.default.string,"aria-label":i.default.string,icons:i.default.oneOfType([i.default.bool,i.default.shape({checked:i.default.node,unchecked:i.default.node})])}},125:function(e,t,a){var n;!function(){"use strict";var a={}.hasOwnProperty;function r(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var c=typeof n;if("string"===c||"number"===c)e.push(n);else if(Array.isArray(n)&&n.length){var o=r.apply(null,n);o&&e.push(o)}else if("object"===c)for(var l in n)a.call(n,l)&&n[l]&&e.push(l)}}return e.join(" ")}e.exports?(r.default=r,e.exports=r):void 0===(n=function(){return r}.apply(t,[]))||(e.exports=n)}()},126:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n,r=a(0),c=(n=r)&&n.__esModule?n:{default:n};t.default=function(){return c.default.createElement("svg",{width:"14",height:"11",viewBox:"0 0 14 11"},c.default.createElement("title",null,"switch-check"),c.default.createElement("path",{d:"M11.264 0L5.26 6.004 2.103 2.847 0 4.95l5.26 5.26 8.108-8.107L11.264 0",fill:"#fff",fillRule:"evenodd"}))}},127:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n,r=a(0),c=(n=r)&&n.__esModule?n:{default:n};t.default=function(){return c.default.createElement("svg",{width:"10",height:"10",viewBox:"0 0 10 10"},c.default.createElement("title",null,"switch-x"),c.default.createElement("path",{d:"M9.9 2.12L7.78 0 4.95 2.828 2.12 0 0 2.12l2.83 2.83L0 7.776 2.123 9.9 4.95 7.07 7.78 9.9 9.9 7.776 7.072 4.95 9.9 2.12",fill:"#fff",fillRule:"evenodd"}))}},128:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.pointerCoord=function(e){if(e){var t=e.changedTouches;if(t&&t.length>0){var a=t[0];return{x:a.clientX,y:a.clientY}}var n=e.pageX;if(void 0!==n)return{x:n,y:e.pageY}}return{x:0,y:0}}},129:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return u}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(105),i=a(99),s=a(107);function u(e){var t,a=e.label,c=e.to,u=e.docsPluginId,d=Object(r.a)(e,["label","to","docsPluginId"]),m=Object(i.useActiveVersion)(u),f=Object(s.a)(u).preferredVersion,h=Object(i.useLatestVersion)(u),v=null!==(t=null!=m?m:f)&&void 0!==t?t:h,b=null!=a?a:v.label,p=null!=c?c:function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))}(v).path;return o.a.createElement(l.a,Object(n.a)({},d,{label:b,to:p}))}},133:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(105),i=a(99),s=a(107),u=function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))};function d(e){var t,a,c=e.mobile,d=e.docsPluginId,m=e.dropdownActiveClassDisabled,f=e.dropdownItemsBefore,h=e.dropdownItemsAfter,v=Object(r.a)(e,["mobile","docsPluginId","dropdownActiveClassDisabled","dropdownItemsBefore","dropdownItemsAfter"]),b=Object(i.useActiveDocContext)(d),p=Object(i.useVersions)(d),g=Object(i.useLatestVersion)(d),k=Object(s.a)(d),E=k.preferredVersion,O=k.savePreferredVersionName;var j=null!==(t=null!==(a=b.activeVersion)&&void 0!==a?a:E)&&void 0!==t?t:g,y=c?"Versions":j.label,_=c?void 0:u(j).path;return o.a.createElement(l.a,Object(n.a)({},v,{mobile:c,label:y,to:_,items:function(){var e=p.map((function(e){var t=(null==b?void 0:b.alternateDocVersions[e.name])||u(e);return{isNavLink:!0,label:e.label,to:t.path,isActive:function(){return e===(null==b?void 0:b.activeVersion)},onClick:function(){O(e.name)}}})),t=[].concat(f,e,h);if(!(t.length<=1))return t}(),isActive:m?function(){return!1}:void 0}))}},134:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(105),i=a(99),s=a(97),u=a(107);function d(e){var t,a,c=e.docId,d=e.activeSidebarClassName,m=e.label,f=e.docsPluginId,h=Object(r.a)(e,["docId","activeSidebarClassName","label","docsPluginId"]),v=Object(i.useActiveDocContext)(f),b=v.activeVersion,p=v.activeDoc,g=Object(u.a)(f).preferredVersion,k=Object(i.useLatestVersion)(f),E=null!==(t=null!=b?b:g)&&void 0!==t?t:k,O=E.docs.find((function(e){return e.id===c}));if(!O)throw new Error("DocNavbarItem: couldn't find any doc with id="+c+" in version "+E.name+".\nAvailable docIds=\n- "+E.docs.join("\n- "));return o.a.createElement(l.a,Object(n.a)({exact:!0},h,{className:Object(s.a)(h.className,(a={},a[d]=p&&p.sidebar===O.sidebar,a)),label:null!=m?m:O.id,to:O.path}))}}}]);
\ No newline at end of file
diff --git a/2.f73f779a.js.LICENSE.txt b/2.cd1a0941.js.LICENSE.txt
similarity index 100%
rename from 2.f73f779a.js.LICENSE.txt
rename to 2.cd1a0941.js.LICENSE.txt
diff --git a/35234f08.540f1aca.js b/35234f08.540f1aca.js
deleted file mode 100644
index a822b8ec..00000000
--- a/35234f08.540f1aca.js
+++ /dev/null
@@ -1 +0,0 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[9],{66:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return o})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return l}));var r=n(2),i=n(6),a=(n(0),n(96)),o={id:"security",title:"Security"},s={unversionedId:"community/security",id:"community/security",isDocsHomePage:!1,title:"Security",description:"OAuth2 Proxy is a community project.",source:"@site/docs/community/security.md",slug:"/community/security",permalink:"/oauth2-proxy/docs/next/community/security",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/community/security.md",version:"current",sidebar:"docs",previous:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/next/features/request_signatures"}},c=[{value:"Security Disclosures",id:"security-disclosures",children:[{value:"How will we respond to disclosures?",id:"how-will-we-respond-to-disclosures",children:[]}]}],u={rightToc:c};function l(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(a.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(a.b)("h5",{parentName:"div"},Object(a.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(a.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(a.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(a.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(a.b)("p",{parentName:"div"},"OAuth2 Proxy is a community project.\nMaintainers do not work on this project full time, and as such,\nwhile we endeavour to respond to disclosures as quickly as possible,\nthis may take longer than in projects with corporate sponsorship."))),Object(a.b)("h2",{id:"security-disclosures"},"Security Disclosures"),Object(a.b)("div",{className:"admonition admonition-important alert alert--info"},Object(a.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(a.b)("h5",{parentName:"div"},Object(a.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(a.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(a.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(a.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(a.b)("p",{parentName:"div"},"If you believe you have found a vulnerability within OAuth2 Proxy or any of its\ndependencies, please do NOT open an issue or PR on GitHub, please do NOT post\nany details publicly."))),Object(a.b)("p",null,"Security disclosures MUST be done in private.\nIf you have found an issue that you would like to bring to the attention of the\nmaintenance team for OAuth2 Proxy, please compose an email and send it to the\nlist of maintainers in our ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS"}),"MAINTAINERS")," file."),Object(a.b)("p",null,"Please include as much detail as possible.\nIdeally, your disclosure should include:"),Object(a.b)("ul",null,Object(a.b)("li",{parentName:"ul"},"A reproducible case that can be used to demonstrate the exploit"),Object(a.b)("li",{parentName:"ul"},"How you discovered this vulnerability"),Object(a.b)("li",{parentName:"ul"},"A potential fix for the issue (if you have thought of one)"),Object(a.b)("li",{parentName:"ul"},"Versions affected (if not present in master)"),Object(a.b)("li",{parentName:"ul"},"Your GitHub ID")),Object(a.b)("h3",{id:"how-will-we-respond-to-disclosures"},"How will we respond to disclosures?"),Object(a.b)("p",null,"We use ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories"}),"GitHub Security Advisories"),"\nto privately discuss fixes for disclosed vulnerabilities.\nIf you include a GitHub ID with your disclosure we will add you as a collaborator\nfor the advisory so that you can join the discussion and validate any fixes\nwe may propose."),Object(a.b)("p",null,"For minor issues and previously disclosed vulnerabilities (typically for\ndependencies), we may use regular PRs for fixes and forego the security advisory."),Object(a.b)("p",null,"Once a fix has been agreed upon, we will merge the fix and create a new release.\nIf we have multiple security issues in flight simultaneously, we may delay\nmerging fixes until all patches are ready.\nWe may also backport the fix to previous releases,\nbut this will be at the discretion of the maintainers."))}l.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return m}));var r=n(0),i=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?o(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):o(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=i.a.createContext({}),l=function(e){var t=i.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return i.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},b=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,o=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=r,m=d["".concat(o,".").concat(b)]||d[b]||p[b]||a;return n?i.a.createElement(m,s(s({ref:t},u),{},{components:n})):i.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,o=new Array(a);o[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,o[1]=s;for(var u=2;u<a;u++)o[u]=n[u];return i.a.createElement.apply(null,o)}return i.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/35234f08.b5c25545.js b/35234f08.b5c25545.js
new file mode 100644
index 00000000..1d2c37f4
--- /dev/null
+++ b/35234f08.b5c25545.js
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[9],{66:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return l}));var r=n(2),i=n(6),o=(n(0),n(95)),a={id:"security",title:"Security"},s={unversionedId:"community/security",id:"community/security",isDocsHomePage:!1,title:"Security",description:"OAuth2 Proxy is a community project.",source:"@site/docs/community/security.md",slug:"/community/security",permalink:"/oauth2-proxy/docs/next/community/security",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/community/security.md",version:"current",sidebar:"docs",previous:{title:"Endpoints",permalink:"/oauth2-proxy/docs/next/features/endpoints"}},c=[{value:"Security Disclosures",id:"security-disclosures",children:[{value:"How will we respond to disclosures?",id:"how-will-we-respond-to-disclosures",children:[]}]}],u={rightToc:c};function l(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"OAuth2 Proxy is a community project.\nMaintainers do not work on this project full time, and as such,\nwhile we endeavour to respond to disclosures as quickly as possible,\nthis may take longer than in projects with corporate sponsorship."))),Object(o.b)("h2",{id:"security-disclosures"},"Security Disclosures"),Object(o.b)("div",{className:"admonition admonition-important alert alert--info"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"If you believe you have found a vulnerability within OAuth2 Proxy or any of its\ndependencies, please do NOT open an issue or PR on GitHub, please do NOT post\nany details publicly."))),Object(o.b)("p",null,"Security disclosures MUST be done in private.\nIf you have found an issue that you would like to bring to the attention of the\nmaintenance team for OAuth2 Proxy, please compose an email and send it to the\nlist of maintainers in our ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS"}),"MAINTAINERS")," file."),Object(o.b)("p",null,"Please include as much detail as possible.\nIdeally, your disclosure should include:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"A reproducible case that can be used to demonstrate the exploit"),Object(o.b)("li",{parentName:"ul"},"How you discovered this vulnerability"),Object(o.b)("li",{parentName:"ul"},"A potential fix for the issue (if you have thought of one)"),Object(o.b)("li",{parentName:"ul"},"Versions affected (if not present in master)"),Object(o.b)("li",{parentName:"ul"},"Your GitHub ID")),Object(o.b)("h3",{id:"how-will-we-respond-to-disclosures"},"How will we respond to disclosures?"),Object(o.b)("p",null,"We use ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories"}),"GitHub Security Advisories"),"\nto privately discuss fixes for disclosed vulnerabilities.\nIf you include a GitHub ID with your disclosure we will add you as a collaborator\nfor the advisory so that you can join the discussion and validate any fixes\nwe may propose."),Object(o.b)("p",null,"For minor issues and previously disclosed vulnerabilities (typically for\ndependencies), we may use regular PRs for fixes and forego the security advisory."),Object(o.b)("p",null,"Once a fix has been agreed upon, we will merge the fix and create a new release.\nIf we have multiple security issues in flight simultaneously, we may delay\nmerging fixes until all patches are ready.\nWe may also backport the fix to previous releases,\nbut this will be at the discretion of the maintainers."))}l.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return m}));var r=n(0),i=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=i.a.createContext({}),l=function(e){var t=i.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return i.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},b=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=r,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?i.a.createElement(m,s(s({ref:t},u),{},{components:n})):i.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var u=2;u<o;u++)a[u]=n[u];return i.a.createElement.apply(null,a)}return i.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/357fe94d.f0a0c172.js b/357fe94d.283fb6a4.js
similarity index 99%
rename from 357fe94d.f0a0c172.js
rename to 357fe94d.283fb6a4.js
index def54a53..bfd6322a 100644
--- a/357fe94d.f0a0c172.js
+++ b/357fe94d.283fb6a4.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[10],{67:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return b}));var o=a(2),n=a(6),r=(a(0),a(96)),i={id:"oauth_provider",title:"OAuth Provider Configuration"},l={unversionedId:"configuration/oauth_provider",id:"configuration/oauth_provider",isDocsHomePage:!1,title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/docs/configuration/auth.md",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md",version:"current",sidebar:"docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/next/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[]},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[]},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[]},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[]},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[]},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[]},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[]},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[]},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[]},{value:"login.gov Provider",id:"logingov-provider",children:[]},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[]},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[]},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[]},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[]},{value:"Email Authentication",id:"email-authentication",children:[]},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[]}],p={rightToc:c};function b(e){var t=e.components,a=Object(n.a)(e,["components"]);return Object(r.b)("wrapper",Object(o.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),Object(r.b)("p",null,"Valid providers are :"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#google-auth-provider"}),"Google")," ",Object(r.b)("em",{parentName:"li"},"default")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#azure-auth-provider"}),"Azure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#facebook-auth-provider"}),"Facebook")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#github-auth-provider"}),"GitHub")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#keycloak-auth-provider"}),"Keycloak")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitlab-auth-provider"}),"GitLab")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#linkedin-auth-provider"}),"LinkedIn")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#microsoft-azure-ad-provider"}),"Microsoft Azure AD")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#openid-connect-provider"}),"OpenID Connect")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#logingov-provider"}),"login.gov")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#nextcloud-provider"}),"Nextcloud")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#digitalocean-auth-provider"}),"DigitalOcean")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#bitbucket-auth-provider"}),"Bitbucket")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitea-auth-provider"}),"Gitea"))),Object(r.b)("p",null,"The provider can be selected using the ",Object(r.b)("inlineCode",{parentName:"p"},"provider")," configuration value."),Object(r.b)("p",null,"Please note that not all providers support all claims. The ",Object(r.b)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),Object(r.b)("h3",{id:"google-auth-provider"},"Google Auth Provider"),Object(r.b)("p",null,"For Google, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://console.developers.google.com/project"}),"https://console.developers.google.com/project")),Object(r.b)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),Object(r.b)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"API Manager"')),Object(r.b)("li",{parentName:"ol"},"In the left Nav pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",Object(r.b)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')," tab.",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Open the ",Object(r.b)("strong",{parentName:"li"},'"New credentials"')," drop down"),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth client ID"')),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Web application"')),Object(r.b)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),Object(r.b)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),Object(r.b)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Create"')))),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Client ID")," and ",Object(r.b)("strong",{parentName:"li"},"Client Secret"))),Object(r.b)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",Object(r.b)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),Object(r.b)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a service account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"}),"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),Object(r.b)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),Object(r.b)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),Object(r.b)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"}),"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),Object(r.b)("ol",{start:6},Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://support.google.com/a/answer/60757"}),"https://support.google.com/a/answer/60757")," to enable Admin API access."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),Object(r.b)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",Object(r.b)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),Object(r.b)("li",{parentName:"ol"},"Restart oauth2-proxy.")),Object(r.b)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),Object(r.b)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Add an application: go to ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://portal.azure.com"}),"https://portal.azure.com"),", choose ",Object(r.b)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",Object(r.b)("strong",{parentName:"li"},'"App registrations"')," and then click on ",Object(r.b)("strong",{parentName:"li"},'"New app registration"'),"."),Object(r.b)("li",{parentName:"ol"},"Pick a name and choose ",Object(r.b)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",Object(r.b)("strong",{parentName:"li"},'"Create"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",Object(r.b)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",Object(r.b)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",Object(r.b)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",Object(r.b)("strong",{parentName:"li"},'"Save"')," and then then on ",Object(r.b)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=azure\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 6>\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--provider=keycloak\n--client-id=<client you have created>\n--client-secret=<your client\'s secret>\n--login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"\n--redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"\n--profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--keycloak-group=<first_allowed_user_group>\n--keycloak-group=<second_allowed_user_group>\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="gitlab"\n    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n    --client-id=GITLAB_CLIENT_ID\n    --client-secret=GITLAB_CLIENT_SECRET\n    --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url="<your gitlab url>"\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n    "https://example.corp.com"\n]\nemail_domains = [\n    "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n    "http://0.0.0.0:8080"\n]\nemail_domains = [\n    "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard.  The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol:  make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer:  do what they say for OpenID Connect.  We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle:  Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n  -client-id=${LOGINGOV_ISSUER} \\\n  -redirect-url=http://localhost:4180/oauth2/callback \\\n  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n  -cookie-secure=false \\\n  -email-domain=gsa.gov \\\n  -upstream=http://localhost:3000/ \\\n  -cookie-secret=somerandomstring12341234567890AB \\\n  -cookie-domain=localhost \\\n  -skip-provider-button=true \\\n  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),".  In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"    -provider oidc\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -skip-oidc-discovery\n    -login-url http://127.0.0.1:5556/authorize\n    -redeem-url http://127.0.0.1:5556/token\n    -oidc-jwks-url http://127.0.0.1:5556/keys\n    -cookie-secure=false\n    -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider nextcloud\n    -client-id <from nextcloud admin>\n    -client-secret <from nextcloud admin>\n    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=digitalocean\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=bitbucket\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="github"\n    --redirect-url="https://<proxied host>/oauth2/callback"\n    --provider-display-name="Gitea"\n    --client-id="< client_id as generated by Gitea >"\n    --client-secret="< client_secret as generated by Gitea >"\n    --login-url="https://< your gitea host >/login/oauth/authorize"\n    --redeem-url="https://< your gitea host >/login/oauth/access_token"\n    --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,o,n=function(e,t){if(null==e)return{};var a,o,n={},r=Object.keys(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p<r;p++)i[p]=a[p];return n.a.createElement.apply(null,i)}return n.a.createElement.apply(null,a)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[10],{67:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return b}));var o=a(2),n=a(6),r=(a(0),a(95)),i={id:"oauth_provider",title:"OAuth Provider Configuration"},l={unversionedId:"configuration/oauth_provider",id:"configuration/oauth_provider",isDocsHomePage:!1,title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/docs/configuration/auth.md",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md",version:"current",sidebar:"docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/next/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[]},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[]},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[]},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[]},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[]},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[]},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[]},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[]},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[]},{value:"login.gov Provider",id:"logingov-provider",children:[]},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[]},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[]},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[]},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[]},{value:"Email Authentication",id:"email-authentication",children:[]},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[]}],p={rightToc:c};function b(e){var t=e.components,a=Object(n.a)(e,["components"]);return Object(r.b)("wrapper",Object(o.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),Object(r.b)("p",null,"Valid providers are :"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#google-auth-provider"}),"Google")," ",Object(r.b)("em",{parentName:"li"},"default")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#azure-auth-provider"}),"Azure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#facebook-auth-provider"}),"Facebook")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#github-auth-provider"}),"GitHub")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#keycloak-auth-provider"}),"Keycloak")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitlab-auth-provider"}),"GitLab")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#linkedin-auth-provider"}),"LinkedIn")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#microsoft-azure-ad-provider"}),"Microsoft Azure AD")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#openid-connect-provider"}),"OpenID Connect")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#logingov-provider"}),"login.gov")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#nextcloud-provider"}),"Nextcloud")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#digitalocean-auth-provider"}),"DigitalOcean")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#bitbucket-auth-provider"}),"Bitbucket")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitea-auth-provider"}),"Gitea"))),Object(r.b)("p",null,"The provider can be selected using the ",Object(r.b)("inlineCode",{parentName:"p"},"provider")," configuration value."),Object(r.b)("p",null,"Please note that not all providers support all claims. The ",Object(r.b)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),Object(r.b)("h3",{id:"google-auth-provider"},"Google Auth Provider"),Object(r.b)("p",null,"For Google, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://console.developers.google.com/project"}),"https://console.developers.google.com/project")),Object(r.b)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),Object(r.b)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"API Manager"')),Object(r.b)("li",{parentName:"ol"},"In the left Nav pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",Object(r.b)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')," tab.",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Open the ",Object(r.b)("strong",{parentName:"li"},'"New credentials"')," drop down"),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth client ID"')),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Web application"')),Object(r.b)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),Object(r.b)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),Object(r.b)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Create"')))),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Client ID")," and ",Object(r.b)("strong",{parentName:"li"},"Client Secret"))),Object(r.b)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",Object(r.b)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),Object(r.b)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a service account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"}),"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),Object(r.b)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),Object(r.b)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),Object(r.b)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"}),"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),Object(r.b)("ol",{start:6},Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://support.google.com/a/answer/60757"}),"https://support.google.com/a/answer/60757")," to enable Admin API access."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),Object(r.b)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",Object(r.b)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),Object(r.b)("li",{parentName:"ol"},"Restart oauth2-proxy.")),Object(r.b)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),Object(r.b)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Add an application: go to ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://portal.azure.com"}),"https://portal.azure.com"),", choose ",Object(r.b)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",Object(r.b)("strong",{parentName:"li"},'"App registrations"')," and then click on ",Object(r.b)("strong",{parentName:"li"},'"New app registration"'),"."),Object(r.b)("li",{parentName:"ol"},"Pick a name and choose ",Object(r.b)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",Object(r.b)("strong",{parentName:"li"},'"Create"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",Object(r.b)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",Object(r.b)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",Object(r.b)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",Object(r.b)("strong",{parentName:"li"},'"Save"')," and then then on ",Object(r.b)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=azure\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 6>\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--provider=keycloak\n--client-id=<client you have created>\n--client-secret=<your client\'s secret>\n--login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"\n--redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"\n--profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--keycloak-group=<first_allowed_user_group>\n--keycloak-group=<second_allowed_user_group>\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="gitlab"\n    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n    --client-id=GITLAB_CLIENT_ID\n    --client-secret=GITLAB_CLIENT_SECRET\n    --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url="<your gitlab url>"\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n    "https://example.corp.com"\n]\nemail_domains = [\n    "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n    "http://0.0.0.0:8080"\n]\nemail_domains = [\n    "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard.  The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol:  make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer:  do what they say for OpenID Connect.  We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle:  Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n  -client-id=${LOGINGOV_ISSUER} \\\n  -redirect-url=http://localhost:4180/oauth2/callback \\\n  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n  -cookie-secure=false \\\n  -email-domain=gsa.gov \\\n  -upstream=http://localhost:3000/ \\\n  -cookie-secret=somerandomstring12341234567890AB \\\n  -cookie-domain=localhost \\\n  -skip-provider-button=true \\\n  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),".  In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"    -provider oidc\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -skip-oidc-discovery\n    -login-url http://127.0.0.1:5556/authorize\n    -redeem-url http://127.0.0.1:5556/token\n    -oidc-jwks-url http://127.0.0.1:5556/keys\n    -cookie-secure=false\n    -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider nextcloud\n    -client-id <from nextcloud admin>\n    -client-secret <from nextcloud admin>\n    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=digitalocean\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=bitbucket\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="github"\n    --redirect-url="https://<proxied host>/oauth2/callback"\n    --provider-display-name="Gitea"\n    --client-id="< client_id as generated by Gitea >"\n    --client-secret="< client_secret as generated by Gitea >"\n    --login-url="https://< your gitea host >/login/oauth/authorize"\n    --redeem-url="https://< your gitea host >/login/oauth/access_token"\n    --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,o,n=function(e,t){if(null==e)return{};var a,o,n={},r=Object.keys(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p<r;p++)i[p]=a[p];return n.a.createElement.apply(null,i)}return n.a.createElement.apply(null,a)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/39.6bb7dda7.js b/38.f7098cec.js
similarity index 94%
rename from 39.6bb7dda7.js
rename to 38.f7098cec.js
index 9ce13a93..e2671651 100644
--- a/39.6bb7dda7.js
+++ b/38.f7098cec.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[39,41],{110:function(e,t,n){"use strict";const a=(e,{target:t=document.body}={})=>{const n=document.createElement("textarea"),a=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const r=document.getSelection();let o=!1;r.rangeCount>0&&(o=r.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let l=!1;try{l=document.execCommand("copy")}catch(c){}return n.remove(),o&&(r.removeAllRanges(),r.addRange(o)),a&&a.focus(),l};e.exports=a,e.exports.default=a},111:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],a=t[2],r=t[3];if(n&&r){var o=[],l=(n=parseInt(n))<(r=parseInt(r))?1:-1;"-"!=a&&".."!=a&&"\u2025"!=a||(r+=l);for(var c=n;c!=r;c+=l)o.push(c);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},112:function(e,t,n){"use strict";var a=n(2),r=n(0),o=n.n(r),l=n(101),c=n(98),i={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},s={Prism:n(20).a,theme:i};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var a in n)Object.prototype.hasOwnProperty.call(n,a)&&(e[a]=n[a])}return e}).apply(this,arguments)}var m=/\r\n|\r|\n/,d=function(e){0===e.length?e.push({types:["plain"],content:"",empty:!0}):1===e.length&&""===e[0].content&&(e[0].empty=!0)},y=function(e,t){var n=e.length;return n>0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,a=Object.create(null),r=e.styles.reduce((function(e,n){var a=n.languages,r=n.style;return a&&!a.includes(t)||n.types.forEach((function(t){var n=p({},e[t],r);e[t]=n})),e}),a);return r.root=n,r.plain=p({},n,{backgroundColor:null}),r};function h(e,t){var n={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&-1===t.indexOf(a)&&(n[a]=e[a]);return n}var b=function(e){function t(){for(var t=this,n=[],a=arguments.length;a--;)n[a]=arguments[a];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,a=e.className,r=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),l=t.getThemeDict(t.props);return void 0!==l&&(o.style=l.plain),void 0!==r&&(o.style=void 0!==o.style?p({},o.style,r):r),void 0!==n&&(o.key=n),a&&(o.className+=" "+a),o})),u(this,"getStyleForToken",(function(e){var n=e.types,a=e.empty,r=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===r&&"plain"===n[0])return a?{display:"inline-block"}:void 0;if(1===r&&!a)return o[n[0]];var l=a?{display:"inline-block"}:{},c=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[l].concat(c))}})),u(this,"getTokenProps",(function(e){var n=e.key,a=e.className,r=e.style,o=e.token,l=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==r&&(l.style=void 0!==l.style?p({},l.style,r):r),void 0!==n&&(l.key=n),a&&(l.className+=" "+a),l}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,a=e.code,r=e.children,o=this.getThemeDict(this.props),l=t.languages[n];return r({tokens:function(e){for(var t=[[]],n=[e],a=[0],r=[e.length],o=0,l=0,c=[],i=[c];l>-1;){for(;(o=a[l]++)<r[l];){var s=void 0,u=t[l],p=n[l][o];if("string"==typeof p?(u=l>0?u:["plain"],s=p):(u=y(u,p.type),p.alias&&(u=y(u,p.alias)),s=p.content),"string"==typeof s){var f=s.split(m),h=f.length;c.push({types:u,content:f[0]});for(var b=1;b<h;b++)d(c),i.push(c=[]),c.push({types:u,content:f[b]})}else l++,t.push(u),n.push(s),a.push(0),r.push(s.length)}l--,t.pop(),n.pop(),a.pop(),r.pop()}return d(c),i}(void 0!==l?t.tokenize(a,l,n):[a]),className:"prism-code language-"+n,style:void 0!==o?o.root:{},getLineProps:this.getLineProps,getTokenProps:this.getTokenProps})},t}(r.Component),g=n(110),v=n.n(g),k=n(111),j=n.n(k),O={plain:{color:"#bfc7d5",backgroundColor:"#292d3e"},styles:[{types:["comment"],style:{color:"rgb(105, 112, 152)",fontStyle:"italic"}},{types:["string","inserted"],style:{color:"rgb(195, 232, 141)"}},{types:["number"],style:{color:"rgb(247, 140, 108)"}},{types:["builtin","char","constant","function"],style:{color:"rgb(130, 170, 255)"}},{types:["punctuation","selector"],style:{color:"rgb(199, 146, 234)"}},{types:["variable"],style:{color:"rgb(191, 199, 213)"}},{types:["class-name","attr-name"],style:{color:"rgb(255, 203, 107)"}},{types:["tag","deleted"],style:{color:"rgb(255, 85, 114)"}},{types:["operator"],style:{color:"rgb(137, 221, 255)"}},{types:["boolean"],style:{color:"rgb(255, 88, 116)"}},{types:["keyword"],style:{fontStyle:"italic"}},{types:["doctype"],style:{color:"rgb(199, 146, 234)",fontStyle:"italic"}},{types:["namespace"],style:{color:"rgb(178, 204, 214)"}},{types:["url"],style:{color:"rgb(221, 221, 221)"}}]},E=n(105),N=n(97),w=function(){var e=Object(N.a)().prism,t=Object(E.a)().isDarkTheme,n=e.theme||O,a=e.darkTheme||n;return t?a:n},x=n(48),C=n.n(x),P=/{([\d,-]+)}/,_=function(e){void 0===e&&(e=["js","jsBlock","jsx","python","html"]);var t={js:{start:"\\/\\/",end:""},jsBlock:{start:"\\/\\*",end:"\\*\\/"},jsx:{start:"\\{\\s*\\/\\*",end:"\\*\\/\\s*\\}"},python:{start:"#",end:""},html:{start:"\x3c!--",end:"--\x3e"}},n=["highlight-next-line","highlight-start","highlight-end"].join("|"),a=e.map((function(e){return"(?:"+t[e].start+"\\s*("+n+")\\s*"+t[e].end+")"})).join("|");return new RegExp("^\\s*(?:"+a+")\\s*$")},T=/title=".*"/,S=function(e){var t=e.children,n=e.className,l=e.metastring,i=Object(N.a)().prism,u=Object(r.useState)(!1),p=u[0],m=u[1],d=Object(r.useState)(!1),y=d[0],f=d[1];Object(r.useEffect)((function(){f(!0)}),[]);var h=Object(r.useRef)(null),g=[],k="",O=w();if(l&&P.test(l)){var E=l.match(P)[1];g=j.a.parse(E).filter((function(e){return e>0}))}l&&T.test(l)&&(k=l.match(T)[0].split("title=")[1].replace(/"+/g,""));var x=n&&n.replace(/language-/,"");!x&&i.defaultLanguage&&(x=i.defaultLanguage);var S=t.replace(/\n$/,"");if(0===g.length&&void 0!==x){for(var I,D="",L=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return _(["js","jsBlock"]);case"jsx":case"tsx":return _(["js","jsBlock","jsx"]);case"html":return _(["js","jsBlock","html"]);case"python":case"py":return _(["python"]);default:return _()}}(x),M=t.replace(/\n$/,"").split("\n"),B=0;B<M.length;){var A=B+1,R=M[B].match(L);if(null!==R){switch(R.slice(1).reduce((function(e,t){return e||t}),void 0)){case"highlight-next-line":D+=A+",";break;case"highlight-start":I=A;break;case"highlight-end":D+=I+"-"+(A-1)+","}M.splice(B,1)}else B+=1}g=j.a.parse(D),S=M.join("\n")}var F=function(){v()(S),m(!0),setTimeout((function(){return m(!1)}),2e3)};return o.a.createElement(b,Object(a.a)({},s,{key:String(y),theme:O,code:S,language:x}),(function(e){var t,n,r=e.className,l=e.style,i=e.tokens,s=e.getLineProps,u=e.getTokenProps;return o.a.createElement(o.a.Fragment,null,k&&o.a.createElement("div",{style:l,className:C.a.codeBlockTitle},k),o.a.createElement("div",{className:C.a.codeBlockContent},o.a.createElement("button",{tabIndex:0,ref:h,type:"button","aria-label":"Copy code to clipboard",className:Object(c.a)(C.a.copyButton,(t={},t[C.a.copyButtonWithTitle]=k,t)),onClick:F},p?"Copied":"Copy"),o.a.createElement("div",{className:Object(c.a)(r,C.a.codeBlock,(n={},n[C.a.codeBlockWithTitle]=k,n))},o.a.createElement("div",{className:C.a.codeBlockLines,style:l},i.map((function(e,t){1===e.length&&""===e[0].content&&(e[0].content="\n");var n=s({line:e,key:t});return g.includes(t+1)&&(n.className=n.className+" docusaurus-highlight-code-line"),o.a.createElement("div",Object(a.a)({key:t},n),e.map((function(e,t){return o.a.createElement("span",Object(a.a)({key:t},u({token:e,key:t})))})))}))))))}))},I=n(6),D=(n(49),n(50)),L=n.n(D),M=function(e){return function(t){var n,a=t.id,r=Object(I.a)(t,["id"]),l=Object(N.a)().navbar.hideOnScroll;return a?o.a.createElement(e,r,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:Object(c.a)("anchor",(n={},n[L.a.enhancedAnchor]=!l,n)),id:a}),r.children,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:"hash-link",href:"#"+a,title:"Direct link to heading"},"#")):o.a.createElement(e,r)}},B=n(51),A=n.n(B),R={code:function(e){var t=e.children;return"string"==typeof t?t.includes("\n")?o.a.createElement(S,e):o.a.createElement("code",e):t},a:function(e){return o.a.createElement(l.a,e)},pre:function(e){return o.a.createElement("div",Object(a.a)({className:A.a.mdxCodeBlock},e))},h1:M("h1"),h2:M("h2"),h3:M("h3"),h4:M("h4"),h5:M("h5"),h6:M("h6")};t.a=R},114:function(e,t,n){"use strict";n.r(t);var a=n(0),r=n.n(a),o=n(107);t.default=function(){return r.a.createElement(o.a,{title:"Page Not Found"},r.a.createElement("div",{className:"container margin-vert--xl"},r.a.createElement("div",{className:"row"},r.a.createElement("div",{className:"col col--6 col--offset-3"},r.a.createElement("h1",{className:"hero__title"},"Page Not Found"),r.a.createElement("p",null,"We could not find what you were looking for."),r.a.createElement("p",null,"Please contact the owner of the site that linked you to the original URL and let them know their link is broken.")))))}},95:function(e,t,n){"use strict";n.r(t);var a=n(0),r=n.n(a),o=n(96),l=n(99),c=n(22),i=n(107),s=n(2),u=n(6),p=n(98),m=n(97),d=n(122),y=n(115),f=n(119),h=n(120),b=n(121),g=n(118),v=n(101),k=n(104),j=n(62),O=n.n(j);var E=function e(t,n){return"link"===t.type?Object(d.a)(t.href,n):"category"===t.type&&t.items.some((function(t){return e(t,n)}))};function N(e){var t,n,o,l=e.item,c=e.onItemClick,i=e.collapsible,m=e.activePath,d=Object(u.a)(e,["item","onItemClick","collapsible","activePath"]),y=l.items,f=l.label,h=E(l,m),b=(n=h,o=Object(a.useRef)(n),Object(a.useEffect)((function(){o.current=n}),[n]),o.current),g=Object(a.useState)((function(){return!!i&&(!h&&l.collapsed)})),v=g[0],k=g[1];Object(a.useEffect)((function(){h&&!b&&v&&k(!1)}),[h,b,v]);var j=Object(a.useCallback)((function(e){e.preventDefault(),k((function(e){return!e}))}),[k]);return 0===y.length?null:r.a.createElement("li",{className:Object(p.a)("menu__list-item",{"menu__list-item--collapsed":v}),key:f},r.a.createElement("a",Object(s.a)({className:Object(p.a)("menu__link",(t={"menu__link--sublist":i,"menu__link--active":i&&h},t[O.a.menuLinkText]=!i,t)),onClick:i?j:void 0,href:i?"#!":void 0},d),f),r.a.createElement("ul",{className:"menu__list"},y.map((function(e){return r.a.createElement(x,{tabIndex:v?"-1":"0",key:e.label,item:e,onItemClick:c,collapsible:i,activePath:m})}))))}function w(e){var t=e.item,n=e.onItemClick,a=e.activePath,o=(e.collapsible,Object(u.a)(e,["item","onItemClick","activePath","collapsible"])),l=t.href,c=t.label,i=E(t,a);return r.a.createElement("li",{className:"menu__list-item",key:c},r.a.createElement(v.a,Object(s.a)({className:Object(p.a)("menu__link",{"menu__link--active":i}),to:l},Object(k.a)(l)?{isNavLink:!0,exact:!0,onClick:n}:{target:"_blank",rel:"noreferrer noopener"},o),c))}function x(e){switch(e.item.type){case"category":return r.a.createElement(N,e);case"link":default:return r.a.createElement(w,e)}}var C=function(e){var t,n,o=e.path,c=e.sidebar,i=e.sidebarCollapsible,u=void 0===i||i,d=Object(a.useState)(!1),k=d[0],j=d[1],E=Object(m.a)().navbar,N=E.title,w=E.hideOnScroll,C=Object(l.a)().isClient,P=Object(b.a)(),_=P.logoLink,T=P.logoLinkProps,S=P.logoImageUrl,I=P.logoAlt,D=Object(y.a)().isAnnouncementBarClosed,L=Object(g.a)().scrollY;Object(f.a)(k);var M=Object(h.a)();return Object(a.useEffect)((function(){M===h.b.desktop&&j(!1)}),[M]),r.a.createElement("div",{className:Object(p.a)(O.a.sidebar,(t={},t[O.a.sidebarWithHideableNavbar]=w,t))},w&&r.a.createElement(v.a,Object(s.a)({tabIndex:-1,className:O.a.sidebarLogo,to:_},T),null!=S&&r.a.createElement("img",{key:C,src:S,alt:I}),null!=N&&r.a.createElement("strong",null,N)),r.a.createElement("div",{className:Object(p.a)("menu","menu--responsive",O.a.menu,(n={"menu--show":k},n[O.a.menuWithAnnouncementBar]=!D&&0===L,n))},r.a.createElement("button",{"aria-label":k?"Close Menu":"Open Menu","aria-haspopup":"true",className:"button button--secondary button--sm menu__button",type:"button",onClick:function(){j(!k)}},k?r.a.createElement("span",{className:Object(p.a)(O.a.sidebarMenuIcon,O.a.sidebarMenuCloseIcon)},"\xd7"):r.a.createElement("svg",{"aria-label":"Menu",className:O.a.sidebarMenuIcon,xmlns:"http://www.w3.org/2000/svg",height:24,width:24,viewBox:"0 0 32 32",role:"img",focusable:"false"},r.a.createElement("title",null,"Menu"),r.a.createElement("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"}))),r.a.createElement("ul",{className:"menu__list"},c.map((function(e){return r.a.createElement(x,{key:e.label,item:e,onItemClick:function(e){e.target.blur(),j(!1)},collapsible:u,activePath:o})})))))},P=n(112),_=n(114),T=n(103),S=n(63),I=n.n(S),D=n(123);function L(e){var t,n,a=e.currentDocRoute,c=e.versionMetadata,s=e.children,u=Object(l.a)(),p=u.siteConfig,m=u.isClient,d=c.pluginId,y=c.permalinkToSidebar,f=c.docsSidebars,h=c.version,b=y[a.path],g=f[b];return r.a.createElement(i.a,{key:m,searchMetadatas:{version:h,tag:Object(D.b)(d,h)}},r.a.createElement("div",{className:I.a.docPage},g&&r.a.createElement("div",{className:I.a.docSidebarContainer,role:"complementary"},r.a.createElement(C,{key:b,sidebar:g,path:a.path,sidebarCollapsible:null===(t=null===(n=p.themeConfig)||void 0===n?void 0:n.sidebarCollapsible)||void 0===t||t})),r.a.createElement("main",{className:I.a.docMainContainer},r.a.createElement(o.a,{components:P.a},s))))}t.default=function(e){var t=e.route.routes,n=e.versionMetadata,a=e.location,o=t.find((function(e){return Object(T.matchPath)(a.pathname,e)}));return o?r.a.createElement(L,{currentDocRoute:o,versionMetadata:n},Object(c.a)(t)):r.a.createElement(_.default,e)}},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return y}));var a=n(0),r=n.n(a);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function l(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?l(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):l(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function i(e,t){if(null==e)return{};var n,a,r=function(e,t){if(null==e)return{};var n,a,r={},o=Object.keys(e);for(a=0;a<o.length;a++)n=o[a],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(a=0;a<o.length;a++)n=o[a],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var s=r.a.createContext({}),u=function(e){var t=r.a.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},p=function(e){var t=u(e.components);return r.a.createElement(s.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},d=r.a.forwardRef((function(e,t){var n=e.components,a=e.mdxType,o=e.originalType,l=e.parentName,s=i(e,["components","mdxType","originalType","parentName"]),p=u(n),d=a,y=p["".concat(l,".").concat(d)]||p[d]||m[d]||o;return n?r.a.createElement(y,c(c({ref:t},s),{},{components:n})):r.a.createElement(y,c({ref:t},s))}));function y(e,t){var n=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=n.length,l=new Array(o);l[0]=d;var c={};for(var i in t)hasOwnProperty.call(t,i)&&(c[i]=t[i]);c.originalType=e,c.mdxType="string"==typeof e?e:a,l[1]=c;for(var s=2;s<o;s++)l[s]=n[s];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,n)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[38,40],{109:function(e,t,n){"use strict";const a=(e,{target:t=document.body}={})=>{const n=document.createElement("textarea"),a=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const r=document.getSelection();let o=!1;r.rangeCount>0&&(o=r.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let l=!1;try{l=document.execCommand("copy")}catch(c){}return n.remove(),o&&(r.removeAllRanges(),r.addRange(o)),a&&a.focus(),l};e.exports=a,e.exports.default=a},110:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],a=t[2],r=t[3];if(n&&r){var o=[],l=(n=parseInt(n))<(r=parseInt(r))?1:-1;"-"!=a&&".."!=a&&"\u2025"!=a||(r+=l);for(var c=n;c!=r;c+=l)o.push(c);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},111:function(e,t,n){"use strict";var a=n(2),r=n(0),o=n.n(r),l=n(100),c=n(97),i={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},s={Prism:n(20).a,theme:i};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var a in n)Object.prototype.hasOwnProperty.call(n,a)&&(e[a]=n[a])}return e}).apply(this,arguments)}var m=/\r\n|\r|\n/,d=function(e){0===e.length?e.push({types:["plain"],content:"",empty:!0}):1===e.length&&""===e[0].content&&(e[0].empty=!0)},y=function(e,t){var n=e.length;return n>0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,a=Object.create(null),r=e.styles.reduce((function(e,n){var a=n.languages,r=n.style;return a&&!a.includes(t)||n.types.forEach((function(t){var n=p({},e[t],r);e[t]=n})),e}),a);return r.root=n,r.plain=p({},n,{backgroundColor:null}),r};function h(e,t){var n={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&-1===t.indexOf(a)&&(n[a]=e[a]);return n}var b=function(e){function t(){for(var t=this,n=[],a=arguments.length;a--;)n[a]=arguments[a];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,a=e.className,r=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),l=t.getThemeDict(t.props);return void 0!==l&&(o.style=l.plain),void 0!==r&&(o.style=void 0!==o.style?p({},o.style,r):r),void 0!==n&&(o.key=n),a&&(o.className+=" "+a),o})),u(this,"getStyleForToken",(function(e){var n=e.types,a=e.empty,r=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===r&&"plain"===n[0])return a?{display:"inline-block"}:void 0;if(1===r&&!a)return o[n[0]];var l=a?{display:"inline-block"}:{},c=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[l].concat(c))}})),u(this,"getTokenProps",(function(e){var n=e.key,a=e.className,r=e.style,o=e.token,l=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==r&&(l.style=void 0!==l.style?p({},l.style,r):r),void 0!==n&&(l.key=n),a&&(l.className+=" "+a),l}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,a=e.code,r=e.children,o=this.getThemeDict(this.props),l=t.languages[n];return r({tokens:function(e){for(var t=[[]],n=[e],a=[0],r=[e.length],o=0,l=0,c=[],i=[c];l>-1;){for(;(o=a[l]++)<r[l];){var s=void 0,u=t[l],p=n[l][o];if("string"==typeof p?(u=l>0?u:["plain"],s=p):(u=y(u,p.type),p.alias&&(u=y(u,p.alias)),s=p.content),"string"==typeof s){var f=s.split(m),h=f.length;c.push({types:u,content:f[0]});for(var b=1;b<h;b++)d(c),i.push(c=[]),c.push({types:u,content:f[b]})}else l++,t.push(u),n.push(s),a.push(0),r.push(s.length)}l--,t.pop(),n.pop(),a.pop(),r.pop()}return d(c),i}(void 0!==l?t.tokenize(a,l,n):[a]),className:"prism-code language-"+n,style:void 0!==o?o.root:{},getLineProps:this.getLineProps,getTokenProps:this.getTokenProps})},t}(r.Component),g=n(109),v=n.n(g),k=n(110),j=n.n(k),O={plain:{color:"#bfc7d5",backgroundColor:"#292d3e"},styles:[{types:["comment"],style:{color:"rgb(105, 112, 152)",fontStyle:"italic"}},{types:["string","inserted"],style:{color:"rgb(195, 232, 141)"}},{types:["number"],style:{color:"rgb(247, 140, 108)"}},{types:["builtin","char","constant","function"],style:{color:"rgb(130, 170, 255)"}},{types:["punctuation","selector"],style:{color:"rgb(199, 146, 234)"}},{types:["variable"],style:{color:"rgb(191, 199, 213)"}},{types:["class-name","attr-name"],style:{color:"rgb(255, 203, 107)"}},{types:["tag","deleted"],style:{color:"rgb(255, 85, 114)"}},{types:["operator"],style:{color:"rgb(137, 221, 255)"}},{types:["boolean"],style:{color:"rgb(255, 88, 116)"}},{types:["keyword"],style:{fontStyle:"italic"}},{types:["doctype"],style:{color:"rgb(199, 146, 234)",fontStyle:"italic"}},{types:["namespace"],style:{color:"rgb(178, 204, 214)"}},{types:["url"],style:{color:"rgb(221, 221, 221)"}}]},E=n(104),N=n(96),w=function(){var e=Object(N.a)().prism,t=Object(E.a)().isDarkTheme,n=e.theme||O,a=e.darkTheme||n;return t?a:n},x=n(48),C=n.n(x),P=/{([\d,-]+)}/,_=function(e){void 0===e&&(e=["js","jsBlock","jsx","python","html"]);var t={js:{start:"\\/\\/",end:""},jsBlock:{start:"\\/\\*",end:"\\*\\/"},jsx:{start:"\\{\\s*\\/\\*",end:"\\*\\/\\s*\\}"},python:{start:"#",end:""},html:{start:"\x3c!--",end:"--\x3e"}},n=["highlight-next-line","highlight-start","highlight-end"].join("|"),a=e.map((function(e){return"(?:"+t[e].start+"\\s*("+n+")\\s*"+t[e].end+")"})).join("|");return new RegExp("^\\s*(?:"+a+")\\s*$")},T=/title=".*"/,S=function(e){var t=e.children,n=e.className,l=e.metastring,i=Object(N.a)().prism,u=Object(r.useState)(!1),p=u[0],m=u[1],d=Object(r.useState)(!1),y=d[0],f=d[1];Object(r.useEffect)((function(){f(!0)}),[]);var h=Object(r.useRef)(null),g=[],k="",O=w();if(l&&P.test(l)){var E=l.match(P)[1];g=j.a.parse(E).filter((function(e){return e>0}))}l&&T.test(l)&&(k=l.match(T)[0].split("title=")[1].replace(/"+/g,""));var x=n&&n.replace(/language-/,"");!x&&i.defaultLanguage&&(x=i.defaultLanguage);var S=t.replace(/\n$/,"");if(0===g.length&&void 0!==x){for(var I,D="",L=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return _(["js","jsBlock"]);case"jsx":case"tsx":return _(["js","jsBlock","jsx"]);case"html":return _(["js","jsBlock","html"]);case"python":case"py":return _(["python"]);default:return _()}}(x),M=t.replace(/\n$/,"").split("\n"),B=0;B<M.length;){var A=B+1,R=M[B].match(L);if(null!==R){switch(R.slice(1).reduce((function(e,t){return e||t}),void 0)){case"highlight-next-line":D+=A+",";break;case"highlight-start":I=A;break;case"highlight-end":D+=I+"-"+(A-1)+","}M.splice(B,1)}else B+=1}g=j.a.parse(D),S=M.join("\n")}var F=function(){v()(S),m(!0),setTimeout((function(){return m(!1)}),2e3)};return o.a.createElement(b,Object(a.a)({},s,{key:String(y),theme:O,code:S,language:x}),(function(e){var t,n,r=e.className,l=e.style,i=e.tokens,s=e.getLineProps,u=e.getTokenProps;return o.a.createElement(o.a.Fragment,null,k&&o.a.createElement("div",{style:l,className:C.a.codeBlockTitle},k),o.a.createElement("div",{className:C.a.codeBlockContent},o.a.createElement("button",{tabIndex:0,ref:h,type:"button","aria-label":"Copy code to clipboard",className:Object(c.a)(C.a.copyButton,(t={},t[C.a.copyButtonWithTitle]=k,t)),onClick:F},p?"Copied":"Copy"),o.a.createElement("div",{className:Object(c.a)(r,C.a.codeBlock,(n={},n[C.a.codeBlockWithTitle]=k,n))},o.a.createElement("div",{className:C.a.codeBlockLines,style:l},i.map((function(e,t){1===e.length&&""===e[0].content&&(e[0].content="\n");var n=s({line:e,key:t});return g.includes(t+1)&&(n.className=n.className+" docusaurus-highlight-code-line"),o.a.createElement("div",Object(a.a)({key:t},n),e.map((function(e,t){return o.a.createElement("span",Object(a.a)({key:t},u({token:e,key:t})))})))}))))))}))},I=n(6),D=(n(49),n(50)),L=n.n(D),M=function(e){return function(t){var n,a=t.id,r=Object(I.a)(t,["id"]),l=Object(N.a)().navbar.hideOnScroll;return a?o.a.createElement(e,r,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:Object(c.a)("anchor",(n={},n[L.a.enhancedAnchor]=!l,n)),id:a}),r.children,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:"hash-link",href:"#"+a,title:"Direct link to heading"},"#")):o.a.createElement(e,r)}},B=n(51),A=n.n(B),R={code:function(e){var t=e.children;return"string"==typeof t?t.includes("\n")?o.a.createElement(S,e):o.a.createElement("code",e):t},a:function(e){return o.a.createElement(l.a,e)},pre:function(e){return o.a.createElement("div",Object(a.a)({className:A.a.mdxCodeBlock},e))},h1:M("h1"),h2:M("h2"),h3:M("h3"),h4:M("h4"),h5:M("h5"),h6:M("h6")};t.a=R},113:function(e,t,n){"use strict";n.r(t);var a=n(0),r=n.n(a),o=n(106);t.default=function(){return r.a.createElement(o.a,{title:"Page Not Found"},r.a.createElement("div",{className:"container margin-vert--xl"},r.a.createElement("div",{className:"row"},r.a.createElement("div",{className:"col col--6 col--offset-3"},r.a.createElement("h1",{className:"hero__title"},"Page Not Found"),r.a.createElement("p",null,"We could not find what you were looking for."),r.a.createElement("p",null,"Please contact the owner of the site that linked you to the original URL and let them know their link is broken.")))))}},94:function(e,t,n){"use strict";n.r(t);var a=n(0),r=n.n(a),o=n(95),l=n(98),c=n(22),i=n(106),s=n(2),u=n(6),p=n(97),m=n(96),d=n(121),y=n(114),f=n(118),h=n(119),b=n(120),g=n(117),v=n(100),k=n(103),j=n(62),O=n.n(j);var E=function e(t,n){return"link"===t.type?Object(d.a)(t.href,n):"category"===t.type&&t.items.some((function(t){return e(t,n)}))};function N(e){var t,n,o,l=e.item,c=e.onItemClick,i=e.collapsible,m=e.activePath,d=Object(u.a)(e,["item","onItemClick","collapsible","activePath"]),y=l.items,f=l.label,h=E(l,m),b=(n=h,o=Object(a.useRef)(n),Object(a.useEffect)((function(){o.current=n}),[n]),o.current),g=Object(a.useState)((function(){return!!i&&(!h&&l.collapsed)})),v=g[0],k=g[1];Object(a.useEffect)((function(){h&&!b&&v&&k(!1)}),[h,b,v]);var j=Object(a.useCallback)((function(e){e.preventDefault(),k((function(e){return!e}))}),[k]);return 0===y.length?null:r.a.createElement("li",{className:Object(p.a)("menu__list-item",{"menu__list-item--collapsed":v}),key:f},r.a.createElement("a",Object(s.a)({className:Object(p.a)("menu__link",(t={"menu__link--sublist":i,"menu__link--active":i&&h},t[O.a.menuLinkText]=!i,t)),onClick:i?j:void 0,href:i?"#!":void 0},d),f),r.a.createElement("ul",{className:"menu__list"},y.map((function(e){return r.a.createElement(x,{tabIndex:v?"-1":"0",key:e.label,item:e,onItemClick:c,collapsible:i,activePath:m})}))))}function w(e){var t=e.item,n=e.onItemClick,a=e.activePath,o=(e.collapsible,Object(u.a)(e,["item","onItemClick","activePath","collapsible"])),l=t.href,c=t.label,i=E(t,a);return r.a.createElement("li",{className:"menu__list-item",key:c},r.a.createElement(v.a,Object(s.a)({className:Object(p.a)("menu__link",{"menu__link--active":i}),to:l},Object(k.a)(l)?{isNavLink:!0,exact:!0,onClick:n}:{target:"_blank",rel:"noreferrer noopener"},o),c))}function x(e){switch(e.item.type){case"category":return r.a.createElement(N,e);case"link":default:return r.a.createElement(w,e)}}var C=function(e){var t,n,o=e.path,c=e.sidebar,i=e.sidebarCollapsible,u=void 0===i||i,d=Object(a.useState)(!1),k=d[0],j=d[1],E=Object(m.a)().navbar,N=E.title,w=E.hideOnScroll,C=Object(l.a)().isClient,P=Object(b.a)(),_=P.logoLink,T=P.logoLinkProps,S=P.logoImageUrl,I=P.logoAlt,D=Object(y.a)().isAnnouncementBarClosed,L=Object(g.a)().scrollY;Object(f.a)(k);var M=Object(h.a)();return Object(a.useEffect)((function(){M===h.b.desktop&&j(!1)}),[M]),r.a.createElement("div",{className:Object(p.a)(O.a.sidebar,(t={},t[O.a.sidebarWithHideableNavbar]=w,t))},w&&r.a.createElement(v.a,Object(s.a)({tabIndex:-1,className:O.a.sidebarLogo,to:_},T),null!=S&&r.a.createElement("img",{key:C,src:S,alt:I}),null!=N&&r.a.createElement("strong",null,N)),r.a.createElement("div",{className:Object(p.a)("menu","menu--responsive",O.a.menu,(n={"menu--show":k},n[O.a.menuWithAnnouncementBar]=!D&&0===L,n))},r.a.createElement("button",{"aria-label":k?"Close Menu":"Open Menu","aria-haspopup":"true",className:"button button--secondary button--sm menu__button",type:"button",onClick:function(){j(!k)}},k?r.a.createElement("span",{className:Object(p.a)(O.a.sidebarMenuIcon,O.a.sidebarMenuCloseIcon)},"\xd7"):r.a.createElement("svg",{"aria-label":"Menu",className:O.a.sidebarMenuIcon,xmlns:"http://www.w3.org/2000/svg",height:24,width:24,viewBox:"0 0 32 32",role:"img",focusable:"false"},r.a.createElement("title",null,"Menu"),r.a.createElement("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"}))),r.a.createElement("ul",{className:"menu__list"},c.map((function(e){return r.a.createElement(x,{key:e.label,item:e,onItemClick:function(e){e.target.blur(),j(!1)},collapsible:u,activePath:o})})))))},P=n(111),_=n(113),T=n(102),S=n(63),I=n.n(S),D=n(122);function L(e){var t,n,a=e.currentDocRoute,c=e.versionMetadata,s=e.children,u=Object(l.a)(),p=u.siteConfig,m=u.isClient,d=c.pluginId,y=c.permalinkToSidebar,f=c.docsSidebars,h=c.version,b=y[a.path],g=f[b];return r.a.createElement(i.a,{key:m,searchMetadatas:{version:h,tag:Object(D.b)(d,h)}},r.a.createElement("div",{className:I.a.docPage},g&&r.a.createElement("div",{className:I.a.docSidebarContainer,role:"complementary"},r.a.createElement(C,{key:b,sidebar:g,path:a.path,sidebarCollapsible:null===(t=null===(n=p.themeConfig)||void 0===n?void 0:n.sidebarCollapsible)||void 0===t||t})),r.a.createElement("main",{className:I.a.docMainContainer},r.a.createElement(o.a,{components:P.a},s))))}t.default=function(e){var t=e.route.routes,n=e.versionMetadata,a=e.location,o=t.find((function(e){return Object(T.matchPath)(a.pathname,e)}));return o?r.a.createElement(L,{currentDocRoute:o,versionMetadata:n},Object(c.a)(t)):r.a.createElement(_.default,e)}},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return y}));var a=n(0),r=n.n(a);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function l(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?l(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):l(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function i(e,t){if(null==e)return{};var n,a,r=function(e,t){if(null==e)return{};var n,a,r={},o=Object.keys(e);for(a=0;a<o.length;a++)n=o[a],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(a=0;a<o.length;a++)n=o[a],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var s=r.a.createContext({}),u=function(e){var t=r.a.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},p=function(e){var t=u(e.components);return r.a.createElement(s.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},d=r.a.forwardRef((function(e,t){var n=e.components,a=e.mdxType,o=e.originalType,l=e.parentName,s=i(e,["components","mdxType","originalType","parentName"]),p=u(n),d=a,y=p["".concat(l,".").concat(d)]||p[d]||m[d]||o;return n?r.a.createElement(y,c(c({ref:t},s),{},{components:n})):r.a.createElement(y,c({ref:t},s))}));function y(e,t){var n=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=n.length,l=new Array(o);l[0]=d;var c={};for(var i in t)hasOwnProperty.call(t,i)&&(c[i]=t[i]);c.originalType=e,c.mdxType="string"==typeof e?e:a,l[1]=c;for(var s=2;s<o;s++)l[s]=n[s];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,n)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/40.24f08f88.js b/39.a8bc1f06.js
similarity index 96%
rename from 40.24f08f88.js
rename to 39.a8bc1f06.js
index 6abb1417..ce86073b 100644
--- a/40.24f08f88.js
+++ b/39.a8bc1f06.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[40],{110:function(e,t,n){"use strict";const r=(e,{target:t=document.body}={})=>{const n=document.createElement("textarea"),r=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const a=document.getSelection();let o=!1;a.rangeCount>0&&(o=a.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let c=!1;try{c=document.execCommand("copy")}catch(l){}return n.remove(),o&&(a.removeAllRanges(),a.addRange(o)),r&&r.focus(),c};e.exports=r,e.exports.default=r},111:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],r=t[2],a=t[3];if(n&&a){var o=[],c=(n=parseInt(n))<(a=parseInt(a))?1:-1;"-"!=r&&".."!=r&&"\u2025"!=r||(a+=c);for(var l=n;l!=a;l+=c)o.push(l);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},112:function(e,t,n){"use strict";var r=n(2),a=n(0),o=n.n(a),c=n(101),l=n(98),s={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},i={Prism:n(20).a,theme:s};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e}).apply(this,arguments)}var d=/\r\n|\r|\n/,y=function(e){0===e.length?e.push({types:["plain"],content:"",empty:!0}):1===e.length&&""===e[0].content&&(e[0].empty=!0)},m=function(e,t){var n=e.length;return n>0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,r=Object.create(null),a=e.styles.reduce((function(e,n){var r=n.languages,a=n.style;return r&&!r.includes(t)||n.types.forEach((function(t){var n=p({},e[t],a);e[t]=n})),e}),r);return a.root=n,a.plain=p({},n,{backgroundColor:null}),a};function h(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&-1===t.indexOf(r)&&(n[r]=e[r]);return n}var g=function(e){function t(){for(var t=this,n=[],r=arguments.length;r--;)n[r]=arguments[r];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,r=e.className,a=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),c=t.getThemeDict(t.props);return void 0!==c&&(o.style=c.plain),void 0!==a&&(o.style=void 0!==o.style?p({},o.style,a):a),void 0!==n&&(o.key=n),r&&(o.className+=" "+r),o})),u(this,"getStyleForToken",(function(e){var n=e.types,r=e.empty,a=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===a&&"plain"===n[0])return r?{display:"inline-block"}:void 0;if(1===a&&!r)return o[n[0]];var c=r?{display:"inline-block"}:{},l=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[c].concat(l))}})),u(this,"getTokenProps",(function(e){var n=e.key,r=e.className,a=e.style,o=e.token,c=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==a&&(c.style=void 0!==c.style?p({},c.style,a):a),void 0!==n&&(c.key=n),r&&(c.className+=" "+r),c}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,r=e.code,a=e.children,o=this.getThemeDict(this.props),c=t.languages[n];return a({tokens:function(e){for(var t=[[]],n=[e],r=[0],a=[e.length],o=0,c=0,l=[],s=[l];c>-1;){for(;(o=r[c]++)<a[c];){var i=void 0,u=t[c],p=n[c][o];if("string"==typeof p?(u=c>0?u:["plain"],i=p):(u=m(u,p.type),p.alias&&(u=m(u,p.alias)),i=p.content),"string"==typeof i){var f=i.split(d),h=f.length;l.push({types:u,content:f[0]});for(var g=1;g<h;g++)y(l),s.push(l=[]),l.push({types:u,content:f[g]})}else c++,t.push(u),n.push(i),r.push(0),a.push(i.length)}c--,t.pop(),n.pop(),r.pop(),a.pop()}return y(l),s}(void 0!==c?t.tokenize(r,c,n):[r]),className:"prism-code language-"+n,style:void 0!==o?o.root:{},getLineProps:this.getLineProps,getTokenProps:this.getTokenProps})},t}(a.Component),v=n(110),b=n.n(v),j=n(111),k=n.n(j),O={plain:{color:"#bfc7d5",backgroundColor:"#292d3e"},styles:[{types:["comment"],style:{color:"rgb(105, 112, 152)",fontStyle:"italic"}},{types:["string","inserted"],style:{color:"rgb(195, 232, 141)"}},{types:["number"],style:{color:"rgb(247, 140, 108)"}},{types:["builtin","char","constant","function"],style:{color:"rgb(130, 170, 255)"}},{types:["punctuation","selector"],style:{color:"rgb(199, 146, 234)"}},{types:["variable"],style:{color:"rgb(191, 199, 213)"}},{types:["class-name","attr-name"],style:{color:"rgb(255, 203, 107)"}},{types:["tag","deleted"],style:{color:"rgb(255, 85, 114)"}},{types:["operator"],style:{color:"rgb(137, 221, 255)"}},{types:["boolean"],style:{color:"rgb(255, 88, 116)"}},{types:["keyword"],style:{fontStyle:"italic"}},{types:["doctype"],style:{color:"rgb(199, 146, 234)",fontStyle:"italic"}},{types:["namespace"],style:{color:"rgb(178, 204, 214)"}},{types:["url"],style:{color:"rgb(221, 221, 221)"}}]},E=n(105),N=n(97),x=function(){var e=Object(N.a)().prism,t=Object(E.a)().isDarkTheme,n=e.theme||O,r=e.darkTheme||n;return t?r:n},w=n(48),T=n.n(w),C=/{([\d,-]+)}/,P=function(e){void 0===e&&(e=["js","jsBlock","jsx","python","html"]);var t={js:{start:"\\/\\/",end:""},jsBlock:{start:"\\/\\*",end:"\\*\\/"},jsx:{start:"\\{\\s*\\/\\*",end:"\\*\\/\\s*\\}"},python:{start:"#",end:""},html:{start:"\x3c!--",end:"--\x3e"}},n=["highlight-next-line","highlight-start","highlight-end"].join("|"),r=e.map((function(e){return"(?:"+t[e].start+"\\s*("+n+")\\s*"+t[e].end+")"})).join("|");return new RegExp("^\\s*(?:"+r+")\\s*$")},S=/title=".*"/,L=function(e){var t=e.children,n=e.className,c=e.metastring,s=Object(N.a)().prism,u=Object(a.useState)(!1),p=u[0],d=u[1],y=Object(a.useState)(!1),m=y[0],f=y[1];Object(a.useEffect)((function(){f(!0)}),[]);var h=Object(a.useRef)(null),v=[],j="",O=x();if(c&&C.test(c)){var E=c.match(C)[1];v=k.a.parse(E).filter((function(e){return e>0}))}c&&S.test(c)&&(j=c.match(S)[0].split("title=")[1].replace(/"+/g,""));var w=n&&n.replace(/language-/,"");!w&&s.defaultLanguage&&(w=s.defaultLanguage);var L=t.replace(/\n$/,"");if(0===v.length&&void 0!==w){for(var B,D="",_=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return P(["js","jsBlock"]);case"jsx":case"tsx":return P(["js","jsBlock","jsx"]);case"html":return P(["js","jsBlock","html"]);case"python":case"py":return P(["python"]);default:return P()}}(w),A=t.replace(/\n$/,"").split("\n"),I=0;I<A.length;){var R=I+1,F=A[I].match(_);if(null!==F){switch(F.slice(1).reduce((function(e,t){return e||t}),void 0)){case"highlight-next-line":D+=R+",";break;case"highlight-start":B=R;break;case"highlight-end":D+=B+"-"+(R-1)+","}A.splice(I,1)}else I+=1}v=k.a.parse(D),L=A.join("\n")}var $=function(){b()(L),d(!0),setTimeout((function(){return d(!1)}),2e3)};return o.a.createElement(g,Object(r.a)({},i,{key:String(m),theme:O,code:L,language:w}),(function(e){var t,n,a=e.className,c=e.style,s=e.tokens,i=e.getLineProps,u=e.getTokenProps;return o.a.createElement(o.a.Fragment,null,j&&o.a.createElement("div",{style:c,className:T.a.codeBlockTitle},j),o.a.createElement("div",{className:T.a.codeBlockContent},o.a.createElement("button",{tabIndex:0,ref:h,type:"button","aria-label":"Copy code to clipboard",className:Object(l.a)(T.a.copyButton,(t={},t[T.a.copyButtonWithTitle]=j,t)),onClick:$},p?"Copied":"Copy"),o.a.createElement("div",{className:Object(l.a)(a,T.a.codeBlock,(n={},n[T.a.codeBlockWithTitle]=j,n))},o.a.createElement("div",{className:T.a.codeBlockLines,style:c},s.map((function(e,t){1===e.length&&""===e[0].content&&(e[0].content="\n");var n=i({line:e,key:t});return v.includes(t+1)&&(n.className=n.className+" docusaurus-highlight-code-line"),o.a.createElement("div",Object(r.a)({key:t},n),e.map((function(e,t){return o.a.createElement("span",Object(r.a)({key:t},u({token:e,key:t})))})))}))))))}))},B=n(6),D=(n(49),n(50)),_=n.n(D),A=function(e){return function(t){var n,r=t.id,a=Object(B.a)(t,["id"]),c=Object(N.a)().navbar.hideOnScroll;return r?o.a.createElement(e,a,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:Object(l.a)("anchor",(n={},n[_.a.enhancedAnchor]=!c,n)),id:r}),a.children,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:"hash-link",href:"#"+r,title:"Direct link to heading"},"#")):o.a.createElement(e,a)}},I=n(51),R=n.n(I),F={code:function(e){var t=e.children;return"string"==typeof t?t.includes("\n")?o.a.createElement(L,e):o.a.createElement("code",e):t},a:function(e){return o.a.createElement(c.a,e)},pre:function(e){return o.a.createElement("div",Object(r.a)({className:R.a.mdxCodeBlock},e))},h1:A("h1"),h2:A("h2"),h3:A("h3"),h4:A("h4"),h5:A("h5"),h6:A("h6")};t.a=F},113:function(e,t,n){"use strict";var r=n(0),a=n.n(r);var o=function(e,t,n){var a=Object(r.useState)(void 0),o=a[0],c=a[1];Object(r.useEffect)((function(){function r(){var r=function(){var e=Array.from(document.getElementsByClassName("anchor")),t=e.find((function(e){return e.getBoundingClientRect().top>=n}));if(t){if(t.getBoundingClientRect().top>=n){var r=e[e.indexOf(t)-1];return null!=r?r:t}return t}return e[e.length-1]}();if(r)for(var a=0,l=!1,s=document.getElementsByClassName(e);a<s.length&&!l;){var i=s[a],u=i.href,p=decodeURIComponent(u.substring(u.indexOf("#")+1));r.id===p&&(o&&o.classList.remove(t),i.classList.add(t),c(i),l=!0),a+=1}}return document.addEventListener("scroll",r),document.addEventListener("resize",r),r(),function(){document.removeEventListener("scroll",r),document.removeEventListener("resize",r)}}))},c=n(47),l=n.n(c),s="table-of-contents__link";function i(e){var t=e.headings,n=e.isChild;return t.length?a.a.createElement("ul",{className:n?"":"table-of-contents table-of-contents__left-border"},t.map((function(e){return a.a.createElement("li",{key:e.id},a.a.createElement("a",{href:"#"+e.id,className:s,dangerouslySetInnerHTML:{__html:e.value}}),a.a.createElement(i,{isChild:!0,headings:e.children}))}))):null}t.a=function(e){var t=e.headings;return o(s,"table-of-contents__link--active",100),a.a.createElement("div",{className:l.a.tableOfContents},a.a.createElement(i,{headings:t}))}},64:function(e,t,n){"use strict";n.r(t);var r=n(0),a=n.n(r),o=n(107),c=n(96),l=n(112),s=n(113);t.default=function(e){var t=e.content,n=t.frontMatter,r=t.metadata,i=n.title,u=n.description,p=n.wrapperClassName,d=n.hide_table_of_contents,y=r.permalink;return a.a.createElement(o.a,{title:i,description:u,permalink:y,wrapperClassName:p},a.a.createElement("main",null,a.a.createElement("div",{className:"container container--fluid"},a.a.createElement("div",{className:"margin-vert--lg padding-vert--lg"},a.a.createElement("div",{className:"row"},a.a.createElement("div",{className:"col col--8 col--offset-2"},a.a.createElement("div",{className:"container"},a.a.createElement(c.a,{components:l.a},a.a.createElement(t,null)))),!d&&t.rightToc&&a.a.createElement("div",{className:"col col--2"},a.a.createElement(s.a,{headings:t.rightToc})))))))}},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return m}));var r=n(0),a=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function c(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function l(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?c(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):c(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,a=function(e,t){if(null==e)return{};var n,r,a={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var i=a.a.createContext({}),u=function(e){var t=a.a.useContext(i),n=t;return e&&(n="function"==typeof e?e(t):l(l({},t),e)),n},p=function(e){var t=u(e.components);return a.a.createElement(i.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},y=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,c=e.parentName,i=s(e,["components","mdxType","originalType","parentName"]),p=u(n),y=r,m=p["".concat(c,".").concat(y)]||p[y]||d[y]||o;return n?a.a.createElement(m,l(l({ref:t},i),{},{components:n})):a.a.createElement(m,l({ref:t},i))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,c=new Array(o);c[0]=y;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l.mdxType="string"==typeof e?e:r,c[1]=l;for(var i=2;i<o;i++)c[i]=n[i];return a.a.createElement.apply(null,c)}return a.a.createElement.apply(null,n)}y.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[39],{109:function(e,t,n){"use strict";const r=(e,{target:t=document.body}={})=>{const n=document.createElement("textarea"),r=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const a=document.getSelection();let o=!1;a.rangeCount>0&&(o=a.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let c=!1;try{c=document.execCommand("copy")}catch(l){}return n.remove(),o&&(a.removeAllRanges(),a.addRange(o)),r&&r.focus(),c};e.exports=r,e.exports.default=r},110:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],r=t[2],a=t[3];if(n&&a){var o=[],c=(n=parseInt(n))<(a=parseInt(a))?1:-1;"-"!=r&&".."!=r&&"\u2025"!=r||(a+=c);for(var l=n;l!=a;l+=c)o.push(l);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},111:function(e,t,n){"use strict";var r=n(2),a=n(0),o=n.n(a),c=n(100),l=n(97),s={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},i={Prism:n(20).a,theme:s};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e}).apply(this,arguments)}var d=/\r\n|\r|\n/,y=function(e){0===e.length?e.push({types:["plain"],content:"",empty:!0}):1===e.length&&""===e[0].content&&(e[0].empty=!0)},m=function(e,t){var n=e.length;return n>0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,r=Object.create(null),a=e.styles.reduce((function(e,n){var r=n.languages,a=n.style;return r&&!r.includes(t)||n.types.forEach((function(t){var n=p({},e[t],a);e[t]=n})),e}),r);return a.root=n,a.plain=p({},n,{backgroundColor:null}),a};function h(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&-1===t.indexOf(r)&&(n[r]=e[r]);return n}var g=function(e){function t(){for(var t=this,n=[],r=arguments.length;r--;)n[r]=arguments[r];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,r=e.className,a=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),c=t.getThemeDict(t.props);return void 0!==c&&(o.style=c.plain),void 0!==a&&(o.style=void 0!==o.style?p({},o.style,a):a),void 0!==n&&(o.key=n),r&&(o.className+=" "+r),o})),u(this,"getStyleForToken",(function(e){var n=e.types,r=e.empty,a=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===a&&"plain"===n[0])return r?{display:"inline-block"}:void 0;if(1===a&&!r)return o[n[0]];var c=r?{display:"inline-block"}:{},l=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[c].concat(l))}})),u(this,"getTokenProps",(function(e){var n=e.key,r=e.className,a=e.style,o=e.token,c=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==a&&(c.style=void 0!==c.style?p({},c.style,a):a),void 0!==n&&(c.key=n),r&&(c.className+=" "+r),c}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,r=e.code,a=e.children,o=this.getThemeDict(this.props),c=t.languages[n];return a({tokens:function(e){for(var t=[[]],n=[e],r=[0],a=[e.length],o=0,c=0,l=[],s=[l];c>-1;){for(;(o=r[c]++)<a[c];){var i=void 0,u=t[c],p=n[c][o];if("string"==typeof p?(u=c>0?u:["plain"],i=p):(u=m(u,p.type),p.alias&&(u=m(u,p.alias)),i=p.content),"string"==typeof i){var f=i.split(d),h=f.length;l.push({types:u,content:f[0]});for(var g=1;g<h;g++)y(l),s.push(l=[]),l.push({types:u,content:f[g]})}else c++,t.push(u),n.push(i),r.push(0),a.push(i.length)}c--,t.pop(),n.pop(),r.pop(),a.pop()}return y(l),s}(void 0!==c?t.tokenize(r,c,n):[r]),className:"prism-code language-"+n,style:void 0!==o?o.root:{},getLineProps:this.getLineProps,getTokenProps:this.getTokenProps})},t}(a.Component),v=n(109),b=n.n(v),j=n(110),k=n.n(j),O={plain:{color:"#bfc7d5",backgroundColor:"#292d3e"},styles:[{types:["comment"],style:{color:"rgb(105, 112, 152)",fontStyle:"italic"}},{types:["string","inserted"],style:{color:"rgb(195, 232, 141)"}},{types:["number"],style:{color:"rgb(247, 140, 108)"}},{types:["builtin","char","constant","function"],style:{color:"rgb(130, 170, 255)"}},{types:["punctuation","selector"],style:{color:"rgb(199, 146, 234)"}},{types:["variable"],style:{color:"rgb(191, 199, 213)"}},{types:["class-name","attr-name"],style:{color:"rgb(255, 203, 107)"}},{types:["tag","deleted"],style:{color:"rgb(255, 85, 114)"}},{types:["operator"],style:{color:"rgb(137, 221, 255)"}},{types:["boolean"],style:{color:"rgb(255, 88, 116)"}},{types:["keyword"],style:{fontStyle:"italic"}},{types:["doctype"],style:{color:"rgb(199, 146, 234)",fontStyle:"italic"}},{types:["namespace"],style:{color:"rgb(178, 204, 214)"}},{types:["url"],style:{color:"rgb(221, 221, 221)"}}]},E=n(104),N=n(96),x=function(){var e=Object(N.a)().prism,t=Object(E.a)().isDarkTheme,n=e.theme||O,r=e.darkTheme||n;return t?r:n},w=n(48),T=n.n(w),C=/{([\d,-]+)}/,P=function(e){void 0===e&&(e=["js","jsBlock","jsx","python","html"]);var t={js:{start:"\\/\\/",end:""},jsBlock:{start:"\\/\\*",end:"\\*\\/"},jsx:{start:"\\{\\s*\\/\\*",end:"\\*\\/\\s*\\}"},python:{start:"#",end:""},html:{start:"\x3c!--",end:"--\x3e"}},n=["highlight-next-line","highlight-start","highlight-end"].join("|"),r=e.map((function(e){return"(?:"+t[e].start+"\\s*("+n+")\\s*"+t[e].end+")"})).join("|");return new RegExp("^\\s*(?:"+r+")\\s*$")},S=/title=".*"/,L=function(e){var t=e.children,n=e.className,c=e.metastring,s=Object(N.a)().prism,u=Object(a.useState)(!1),p=u[0],d=u[1],y=Object(a.useState)(!1),m=y[0],f=y[1];Object(a.useEffect)((function(){f(!0)}),[]);var h=Object(a.useRef)(null),v=[],j="",O=x();if(c&&C.test(c)){var E=c.match(C)[1];v=k.a.parse(E).filter((function(e){return e>0}))}c&&S.test(c)&&(j=c.match(S)[0].split("title=")[1].replace(/"+/g,""));var w=n&&n.replace(/language-/,"");!w&&s.defaultLanguage&&(w=s.defaultLanguage);var L=t.replace(/\n$/,"");if(0===v.length&&void 0!==w){for(var B,D="",_=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return P(["js","jsBlock"]);case"jsx":case"tsx":return P(["js","jsBlock","jsx"]);case"html":return P(["js","jsBlock","html"]);case"python":case"py":return P(["python"]);default:return P()}}(w),A=t.replace(/\n$/,"").split("\n"),I=0;I<A.length;){var R=I+1,F=A[I].match(_);if(null!==F){switch(F.slice(1).reduce((function(e,t){return e||t}),void 0)){case"highlight-next-line":D+=R+",";break;case"highlight-start":B=R;break;case"highlight-end":D+=B+"-"+(R-1)+","}A.splice(I,1)}else I+=1}v=k.a.parse(D),L=A.join("\n")}var $=function(){b()(L),d(!0),setTimeout((function(){return d(!1)}),2e3)};return o.a.createElement(g,Object(r.a)({},i,{key:String(m),theme:O,code:L,language:w}),(function(e){var t,n,a=e.className,c=e.style,s=e.tokens,i=e.getLineProps,u=e.getTokenProps;return o.a.createElement(o.a.Fragment,null,j&&o.a.createElement("div",{style:c,className:T.a.codeBlockTitle},j),o.a.createElement("div",{className:T.a.codeBlockContent},o.a.createElement("button",{tabIndex:0,ref:h,type:"button","aria-label":"Copy code to clipboard",className:Object(l.a)(T.a.copyButton,(t={},t[T.a.copyButtonWithTitle]=j,t)),onClick:$},p?"Copied":"Copy"),o.a.createElement("div",{className:Object(l.a)(a,T.a.codeBlock,(n={},n[T.a.codeBlockWithTitle]=j,n))},o.a.createElement("div",{className:T.a.codeBlockLines,style:c},s.map((function(e,t){1===e.length&&""===e[0].content&&(e[0].content="\n");var n=i({line:e,key:t});return v.includes(t+1)&&(n.className=n.className+" docusaurus-highlight-code-line"),o.a.createElement("div",Object(r.a)({key:t},n),e.map((function(e,t){return o.a.createElement("span",Object(r.a)({key:t},u({token:e,key:t})))})))}))))))}))},B=n(6),D=(n(49),n(50)),_=n.n(D),A=function(e){return function(t){var n,r=t.id,a=Object(B.a)(t,["id"]),c=Object(N.a)().navbar.hideOnScroll;return r?o.a.createElement(e,a,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:Object(l.a)("anchor",(n={},n[_.a.enhancedAnchor]=!c,n)),id:r}),a.children,o.a.createElement("a",{"aria-hidden":"true",tabIndex:-1,className:"hash-link",href:"#"+r,title:"Direct link to heading"},"#")):o.a.createElement(e,a)}},I=n(51),R=n.n(I),F={code:function(e){var t=e.children;return"string"==typeof t?t.includes("\n")?o.a.createElement(L,e):o.a.createElement("code",e):t},a:function(e){return o.a.createElement(c.a,e)},pre:function(e){return o.a.createElement("div",Object(r.a)({className:R.a.mdxCodeBlock},e))},h1:A("h1"),h2:A("h2"),h3:A("h3"),h4:A("h4"),h5:A("h5"),h6:A("h6")};t.a=F},112:function(e,t,n){"use strict";var r=n(0),a=n.n(r);var o=function(e,t,n){var a=Object(r.useState)(void 0),o=a[0],c=a[1];Object(r.useEffect)((function(){function r(){var r=function(){var e=Array.from(document.getElementsByClassName("anchor")),t=e.find((function(e){return e.getBoundingClientRect().top>=n}));if(t){if(t.getBoundingClientRect().top>=n){var r=e[e.indexOf(t)-1];return null!=r?r:t}return t}return e[e.length-1]}();if(r)for(var a=0,l=!1,s=document.getElementsByClassName(e);a<s.length&&!l;){var i=s[a],u=i.href,p=decodeURIComponent(u.substring(u.indexOf("#")+1));r.id===p&&(o&&o.classList.remove(t),i.classList.add(t),c(i),l=!0),a+=1}}return document.addEventListener("scroll",r),document.addEventListener("resize",r),r(),function(){document.removeEventListener("scroll",r),document.removeEventListener("resize",r)}}))},c=n(47),l=n.n(c),s="table-of-contents__link";function i(e){var t=e.headings,n=e.isChild;return t.length?a.a.createElement("ul",{className:n?"":"table-of-contents table-of-contents__left-border"},t.map((function(e){return a.a.createElement("li",{key:e.id},a.a.createElement("a",{href:"#"+e.id,className:s,dangerouslySetInnerHTML:{__html:e.value}}),a.a.createElement(i,{isChild:!0,headings:e.children}))}))):null}t.a=function(e){var t=e.headings;return o(s,"table-of-contents__link--active",100),a.a.createElement("div",{className:l.a.tableOfContents},a.a.createElement(i,{headings:t}))}},64:function(e,t,n){"use strict";n.r(t);var r=n(0),a=n.n(r),o=n(106),c=n(95),l=n(111),s=n(112);t.default=function(e){var t=e.content,n=t.frontMatter,r=t.metadata,i=n.title,u=n.description,p=n.wrapperClassName,d=n.hide_table_of_contents,y=r.permalink;return a.a.createElement(o.a,{title:i,description:u,permalink:y,wrapperClassName:p},a.a.createElement("main",null,a.a.createElement("div",{className:"container container--fluid"},a.a.createElement("div",{className:"margin-vert--lg padding-vert--lg"},a.a.createElement("div",{className:"row"},a.a.createElement("div",{className:"col col--8 col--offset-2"},a.a.createElement("div",{className:"container"},a.a.createElement(c.a,{components:l.a},a.a.createElement(t,null)))),!d&&t.rightToc&&a.a.createElement("div",{className:"col col--2"},a.a.createElement(s.a,{headings:t.rightToc})))))))}},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return m}));var r=n(0),a=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function c(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function l(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?c(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):c(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,a=function(e,t){if(null==e)return{};var n,r,a={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var i=a.a.createContext({}),u=function(e){var t=a.a.useContext(i),n=t;return e&&(n="function"==typeof e?e(t):l(l({},t),e)),n},p=function(e){var t=u(e.components);return a.a.createElement(i.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},y=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,c=e.parentName,i=s(e,["components","mdxType","originalType","parentName"]),p=u(n),y=r,m=p["".concat(c,".").concat(y)]||p[y]||d[y]||o;return n?a.a.createElement(m,l(l({ref:t},i),{},{components:n})):a.a.createElement(m,l({ref:t},i))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,c=new Array(o);c[0]=y;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l.mdxType="string"==typeof e?e:r,c[1]=l;for(var i=2;i<o;i++)c[i]=n[i];return a.a.createElement.apply(null,c)}return a.a.createElement.apply(null,n)}y.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/3b8c55ea.1396475e.js b/3b8c55ea.8319a862.js
similarity index 97%
rename from 3b8c55ea.1396475e.js
rename to 3b8c55ea.8319a862.js
index f9eadf19..31a54822 100644
--- a/3b8c55ea.1396475e.js
+++ b/3b8c55ea.8319a862.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[11],{68:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return u}));var r=n(2),a=n(6),o=(n(0),n(96)),i={id:"installation",title:"Installation",slug:"/"},c={unversionedId:"installation",id:"installation",isDocsHomePage:!1,title:"Installation",description:"1.  Choose how to deploy:",source:"@site/docs/installation.md",slug:"/",permalink:"/oauth2-proxy/docs/next/",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/installation.md",version:"current",sidebar:"docs",next:{title:"Behaviour",permalink:"/oauth2-proxy/docs/next/behaviour"}},p=[],l={rightToc:p};function u(e){var t=e.components,n=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("ol",null,Object(o.b)("li",{parentName:"ol"},Object(o.b)("p",{parentName:"li"},"Choose how to deploy:"),Object(o.b)("p",{parentName:"li"},"a. Download ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/releases"}),"Prebuilt Binary")," (current release is ",Object(o.b)("inlineCode",{parentName:"p"},"v7.0.1"),")"),Object(o.b)("p",{parentName:"li"},"b. Build with ",Object(o.b)("inlineCode",{parentName:"p"},"$ go get github.com/oauth2-proxy/oauth2-proxy/v7")," which will put the binary in ",Object(o.b)("inlineCode",{parentName:"p"},"$GOPATH/bin")),Object(o.b)("p",{parentName:"li"},"c. Using the prebuilt docker image ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://quay.io/oauth2-proxy/oauth2-proxy"}),"quay.io/oauth2-proxy/oauth2-proxy")," (AMD64, ARMv6 and ARM64 tags available)"))),Object(o.b)("p",null,"Prebuilt binaries can be validated by extracting the file and verifying it against the ",Object(o.b)("inlineCode",{parentName:"p"},"sha256sum.txt")," checksum file provided for each release starting with version ",Object(o.b)("inlineCode",{parentName:"p"},"v3.0.0"),"."),Object(o.b)("pre",null,Object(o.b)("code",Object(r.a)({parentName:"pre"},{}),"$ sha256sum -c sha256sum.txt 2>&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(o.b)("ol",{start:2},Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return m}));var r=n(0),a=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,a=function(e,t){if(null==e)return{};var n,r,a={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var l=a.a.createContext({}),u=function(e){var t=a.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},b=function(e){var t=u(e.components);return a.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(n),d=r,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||o;return n?a.a.createElement(m,c(c({ref:t},l),{},{components:n})):a.a.createElement(m,c({ref:t},l))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,i=new Array(o);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<o;l++)i[l]=n[l];return a.a.createElement.apply(null,i)}return a.a.createElement.apply(null,n)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[11],{68:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return u}));var r=n(2),a=n(6),o=(n(0),n(95)),i={id:"installation",title:"Installation",slug:"/"},c={unversionedId:"installation",id:"installation",isDocsHomePage:!1,title:"Installation",description:"1.  Choose how to deploy:",source:"@site/docs/installation.md",slug:"/",permalink:"/oauth2-proxy/docs/next/",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/installation.md",version:"current",sidebar:"docs",next:{title:"Behaviour",permalink:"/oauth2-proxy/docs/next/behaviour"}},p=[],l={rightToc:p};function u(e){var t=e.components,n=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("ol",null,Object(o.b)("li",{parentName:"ol"},Object(o.b)("p",{parentName:"li"},"Choose how to deploy:"),Object(o.b)("p",{parentName:"li"},"a. Download ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/releases"}),"Prebuilt Binary")," (current release is ",Object(o.b)("inlineCode",{parentName:"p"},"v7.0.1"),")"),Object(o.b)("p",{parentName:"li"},"b. Build with ",Object(o.b)("inlineCode",{parentName:"p"},"$ go get github.com/oauth2-proxy/oauth2-proxy/v7")," which will put the binary in ",Object(o.b)("inlineCode",{parentName:"p"},"$GOPATH/bin")),Object(o.b)("p",{parentName:"li"},"c. Using the prebuilt docker image ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://quay.io/oauth2-proxy/oauth2-proxy"}),"quay.io/oauth2-proxy/oauth2-proxy")," (AMD64, ARMv6 and ARM64 tags available)"))),Object(o.b)("p",null,"Prebuilt binaries can be validated by extracting the file and verifying it against the ",Object(o.b)("inlineCode",{parentName:"p"},"sha256sum.txt")," checksum file provided for each release starting with version ",Object(o.b)("inlineCode",{parentName:"p"},"v3.0.0"),"."),Object(o.b)("pre",null,Object(o.b)("code",Object(r.a)({parentName:"pre"},{}),"$ sha256sum -c sha256sum.txt 2>&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(o.b)("ol",{start:2},Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return m}));var r=n(0),a=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,a=function(e,t){if(null==e)return{};var n,r,a={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var l=a.a.createContext({}),u=function(e){var t=a.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},b=function(e){var t=u(e.components);return a.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(n),d=r,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||o;return n?a.a.createElement(m,c(c({ref:t},l),{},{components:n})):a.a.createElement(m,c({ref:t},l))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,i=new Array(o);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<o;l++)i[l]=n[l];return a.a.createElement.apply(null,i)}return a.a.createElement.apply(null,n)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/3def9002.8829538f.js b/3def9002.32c43efe.js
similarity index 99%
rename from 3def9002.8829538f.js
rename to 3def9002.32c43efe.js
index 0bedde0b..a7bc7aa3 100644
--- a/3def9002.8829538f.js
+++ b/3def9002.32c43efe.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[12],{69:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return b}));var o=a(2),n=a(6),r=(a(0),a(96)),i={id:"oauth_provider",title:"OAuth Provider Configuration"},l={unversionedId:"configuration/oauth_provider",id:"version-6.1.x/configuration/oauth_provider",isDocsHomePage:!1,title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/versioned_docs/version-6.1.x/configuration/auth.md",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/auth.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/6.1.x/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[]},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[]},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[]},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[]},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[]},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[]},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[]},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[]},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[]},{value:"login.gov Provider",id:"logingov-provider",children:[]},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[]},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[]},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[]},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[]},{value:"Email Authentication",id:"email-authentication",children:[]},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[]}],p={rightToc:c};function b(e){var t=e.components,a=Object(n.a)(e,["components"]);return Object(r.b)("wrapper",Object(o.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),Object(r.b)("p",null,"Valid providers are :"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#google-auth-provider"}),"Google")," ",Object(r.b)("em",{parentName:"li"},"default")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#azure-auth-provider"}),"Azure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#facebook-auth-provider"}),"Facebook")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#github-auth-provider"}),"GitHub")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#keycloak-auth-provider"}),"Keycloak")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitlab-auth-provider"}),"GitLab")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#linkedin-auth-provider"}),"LinkedIn")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#microsoft-azure-ad-provider"}),"Microsoft Azure AD")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#openid-connect-provider"}),"OpenID Connect")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#logingov-provider"}),"login.gov")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#nextcloud-provider"}),"Nextcloud")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#digitalocean-auth-provider"}),"DigitalOcean")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#bitbucket-auth-provider"}),"Bitbucket")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitea-auth-provider"}),"Gitea"))),Object(r.b)("p",null,"The provider can be selected using the ",Object(r.b)("inlineCode",{parentName:"p"},"provider")," configuration value."),Object(r.b)("p",null,"Please note that not all providers support all claims. The ",Object(r.b)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),Object(r.b)("h3",{id:"google-auth-provider"},"Google Auth Provider"),Object(r.b)("p",null,"For Google, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://console.developers.google.com/project"}),"https://console.developers.google.com/project")),Object(r.b)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),Object(r.b)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"API Manager"')),Object(r.b)("li",{parentName:"ol"},"In the left Nav pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",Object(r.b)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')," tab.",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Open the ",Object(r.b)("strong",{parentName:"li"},'"New credentials"')," drop down"),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth client ID"')),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Web application"')),Object(r.b)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),Object(r.b)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),Object(r.b)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Create"')))),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Client ID")," and ",Object(r.b)("strong",{parentName:"li"},"Client Secret"))),Object(r.b)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",Object(r.b)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),Object(r.b)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a service account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"}),"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),Object(r.b)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),Object(r.b)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),Object(r.b)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"}),"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),Object(r.b)("ol",{start:6},Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://support.google.com/a/answer/60757"}),"https://support.google.com/a/answer/60757")," to enable Admin API access."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),Object(r.b)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",Object(r.b)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),Object(r.b)("li",{parentName:"ol"},"Restart oauth2-proxy.")),Object(r.b)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),Object(r.b)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Add an application: go to ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://portal.azure.com"}),"https://portal.azure.com"),", choose ",Object(r.b)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",Object(r.b)("strong",{parentName:"li"},'"App registrations"')," and then click on ",Object(r.b)("strong",{parentName:"li"},'"New app registration"'),"."),Object(r.b)("li",{parentName:"ol"},"Pick a name and choose ",Object(r.b)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",Object(r.b)("strong",{parentName:"li"},'"Create"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",Object(r.b)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",Object(r.b)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",Object(r.b)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",Object(r.b)("strong",{parentName:"li"},'"Save"')," and then then on ",Object(r.b)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=azure\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 6>\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider=keycloak\n-client-id=<client you have created>\n-client-secret=<your client\'s secret>\n-login-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/auth"\n-redeem-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/token"\n-validate-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/userinfo"\n-keycloak-group=<user_group>\n')),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="gitlab"\n    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n    --client-id=GITLAB_CLIENT_ID\n    --client-secret=GITLAB_CLIENT_SECRET\n    --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url="<your gitlab url>"\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example."),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Launch a Dex instance using the ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide"),"."),Object(r.b)("li",{parentName:"ol"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks."),Object(r.b)("li",{parentName:"ol"},"Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider oidc\n    -provider-display-name "My OIDC Provider"\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -cookie-secure=false\n    -email-domain example.com\n')),Object(r.b)("p",null,"The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform\nthe following steps:"),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta"},"Configuring the OIDC Provider with Okta"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},"Create a configuration file like the following:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n    "https://example.corp.com"\n]\nemail_domains = [\n    "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com"),"\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta---localhost"},"Configuring the OIDC Provider with Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n    "http://0.0.0.0:8080"\n]\nemail_domains = [\n    "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard.  The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol:  make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer:  do what they say for OpenID Connect.  We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle:  Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n  -client-id=${LOGINGOV_ISSUER} \\\n  -redirect-url=http://localhost:4180/oauth2/callback \\\n  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n  -cookie-secure=false \\\n  -email-domain=gsa.gov \\\n  -upstream=http://localhost:3000/ \\\n  -cookie-secret=somerandomstring12341234567890AB \\\n  -cookie-domain=localhost \\\n  -skip-provider-button=true \\\n  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),".  In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"    -provider oidc\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -skip-oidc-discovery\n    -login-url http://127.0.0.1:5556/authorize\n    -redeem-url http://127.0.0.1:5556/token\n    -oidc-jwks-url http://127.0.0.1:5556/keys\n    -cookie-secure=false\n    -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider nextcloud\n    -client-id <from nextcloud admin>\n    -client-secret <from nextcloud admin>\n    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=digitalocean\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=bitbucket\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="github"\n    --redirect-url="https://<proxied host>/oauth2/callback"\n    --provider-display-name="Gitea"\n    --client-id="< client_id as generated by Gitea >"\n    --client-secret="< client_secret as generated by Gitea >"\n    --login-url="https://< your gitea host >/login/oauth/authorize"\n    --redeem-url="https://< your gitea host >/login/oauth/access_token"\n    --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,o,n=function(e,t){if(null==e)return{};var a,o,n={},r=Object.keys(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p<r;p++)i[p]=a[p];return n.a.createElement.apply(null,i)}return n.a.createElement.apply(null,a)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[12],{69:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return b}));var o=a(2),n=a(6),r=(a(0),a(95)),i={id:"oauth_provider",title:"OAuth Provider Configuration"},l={unversionedId:"configuration/oauth_provider",id:"version-6.1.x/configuration/oauth_provider",isDocsHomePage:!1,title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/versioned_docs/version-6.1.x/configuration/auth.md",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/auth.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/6.1.x/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[]},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[]},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[]},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[]},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[]},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[]},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[]},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[]},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[]},{value:"login.gov Provider",id:"logingov-provider",children:[]},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[]},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[]},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[]},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[]},{value:"Email Authentication",id:"email-authentication",children:[]},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[]}],p={rightToc:c};function b(e){var t=e.components,a=Object(n.a)(e,["components"]);return Object(r.b)("wrapper",Object(o.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),Object(r.b)("p",null,"Valid providers are :"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#google-auth-provider"}),"Google")," ",Object(r.b)("em",{parentName:"li"},"default")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#azure-auth-provider"}),"Azure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#facebook-auth-provider"}),"Facebook")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#github-auth-provider"}),"GitHub")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#keycloak-auth-provider"}),"Keycloak")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitlab-auth-provider"}),"GitLab")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#linkedin-auth-provider"}),"LinkedIn")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#microsoft-azure-ad-provider"}),"Microsoft Azure AD")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#openid-connect-provider"}),"OpenID Connect")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#logingov-provider"}),"login.gov")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#nextcloud-provider"}),"Nextcloud")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#digitalocean-auth-provider"}),"DigitalOcean")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#bitbucket-auth-provider"}),"Bitbucket")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitea-auth-provider"}),"Gitea"))),Object(r.b)("p",null,"The provider can be selected using the ",Object(r.b)("inlineCode",{parentName:"p"},"provider")," configuration value."),Object(r.b)("p",null,"Please note that not all providers support all claims. The ",Object(r.b)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),Object(r.b)("h3",{id:"google-auth-provider"},"Google Auth Provider"),Object(r.b)("p",null,"For Google, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://console.developers.google.com/project"}),"https://console.developers.google.com/project")),Object(r.b)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),Object(r.b)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"API Manager"')),Object(r.b)("li",{parentName:"ol"},"In the left Nav pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",Object(r.b)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')," tab.",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Open the ",Object(r.b)("strong",{parentName:"li"},'"New credentials"')," drop down"),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth client ID"')),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Web application"')),Object(r.b)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),Object(r.b)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),Object(r.b)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Create"')))),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Client ID")," and ",Object(r.b)("strong",{parentName:"li"},"Client Secret"))),Object(r.b)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",Object(r.b)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),Object(r.b)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a service account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"}),"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),Object(r.b)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),Object(r.b)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),Object(r.b)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"}),"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),Object(r.b)("ol",{start:6},Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://support.google.com/a/answer/60757"}),"https://support.google.com/a/answer/60757")," to enable Admin API access."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),Object(r.b)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",Object(r.b)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),Object(r.b)("li",{parentName:"ol"},"Restart oauth2-proxy.")),Object(r.b)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),Object(r.b)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Add an application: go to ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://portal.azure.com"}),"https://portal.azure.com"),", choose ",Object(r.b)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",Object(r.b)("strong",{parentName:"li"},'"App registrations"')," and then click on ",Object(r.b)("strong",{parentName:"li"},'"New app registration"'),"."),Object(r.b)("li",{parentName:"ol"},"Pick a name and choose ",Object(r.b)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",Object(r.b)("strong",{parentName:"li"},'"Create"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",Object(r.b)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",Object(r.b)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",Object(r.b)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",Object(r.b)("strong",{parentName:"li"},'"Save"')," and then then on ",Object(r.b)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=azure\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 6>\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider=keycloak\n-client-id=<client you have created>\n-client-secret=<your client\'s secret>\n-login-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/auth"\n-redeem-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/token"\n-validate-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/userinfo"\n-keycloak-group=<user_group>\n')),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="gitlab"\n    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n    --client-id=GITLAB_CLIENT_ID\n    --client-secret=GITLAB_CLIENT_SECRET\n    --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url="<your gitlab url>"\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example."),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Launch a Dex instance using the ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide"),"."),Object(r.b)("li",{parentName:"ol"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks."),Object(r.b)("li",{parentName:"ol"},"Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider oidc\n    -provider-display-name "My OIDC Provider"\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -cookie-secure=false\n    -email-domain example.com\n')),Object(r.b)("p",null,"The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform\nthe following steps:"),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta"},"Configuring the OIDC Provider with Okta"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},"Create a configuration file like the following:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n    "https://example.corp.com"\n]\nemail_domains = [\n    "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com"),"\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta---localhost"},"Configuring the OIDC Provider with Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n    "http://0.0.0.0:8080"\n]\nemail_domains = [\n    "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard.  The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol:  make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer:  do what they say for OpenID Connect.  We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle:  Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n  -client-id=${LOGINGOV_ISSUER} \\\n  -redirect-url=http://localhost:4180/oauth2/callback \\\n  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n  -cookie-secure=false \\\n  -email-domain=gsa.gov \\\n  -upstream=http://localhost:3000/ \\\n  -cookie-secret=somerandomstring12341234567890AB \\\n  -cookie-domain=localhost \\\n  -skip-provider-button=true \\\n  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),".  In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"    -provider oidc\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -skip-oidc-discovery\n    -login-url http://127.0.0.1:5556/authorize\n    -redeem-url http://127.0.0.1:5556/token\n    -oidc-jwks-url http://127.0.0.1:5556/keys\n    -cookie-secure=false\n    -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider nextcloud\n    -client-id <from nextcloud admin>\n    -client-secret <from nextcloud admin>\n    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=digitalocean\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=bitbucket\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="github"\n    --redirect-url="https://<proxied host>/oauth2/callback"\n    --provider-display-name="Gitea"\n    --client-id="< client_id as generated by Gitea >"\n    --client-secret="< client_secret as generated by Gitea >"\n    --login-url="https://< your gitea host >/login/oauth/authorize"\n    --redeem-url="https://< your gitea host >/login/oauth/access_token"\n    --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,o,n=function(e,t){if(null==e)return{};var a,o,n={},r=Object.keys(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p<r;p++)i[p]=a[p];return n.a.createElement.apply(null,i)}return n.a.createElement.apply(null,a)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/3fa022c7.2a08f900.js b/3fa022c7.f2bf9899.js
similarity index 99%
rename from 3fa022c7.2a08f900.js
rename to 3fa022c7.f2bf9899.js
index 2690f1cb..f426b090 100644
--- a/3fa022c7.2a08f900.js
+++ b/3fa022c7.f2bf9899.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[13],{70:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return s}));var n=a(2),r=a(6),b=(a(0),a(96)),i={id:"alpha-config",title:"Alpha Configuration"},l={unversionedId:"configuration/alpha-config",id:"version-7.0.x/configuration/alpha-config",isDocsHomePage:!1,title:"Alpha Configuration",description:"This page contains documentation for alpha features.",source:"@site/versioned_docs/version-7.0.x/configuration/alpha_config.md",slug:"/configuration/alpha-config",permalink:"/oauth2-proxy/docs/configuration/alpha-config",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/alpha_config.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/configuration/tls"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/features/endpoints"}},c=[{value:"Using Alpha Configuration",id:"using-alpha-configuration",children:[{value:"Converting configuration to the new structure",id:"converting-configuration-to-the-new-structure",children:[]}]},{value:"Removed options",id:"removed-options",children:[]},{value:"Configuration Reference",id:"configuration-reference",children:[{value:"AlphaOptions",id:"alphaoptions",children:[]},{value:"ClaimSource",id:"claimsource",children:[]},{value:"Duration",id:"duration",children:[]},{value:"Header",id:"header",children:[]},{value:"HeaderValue",id:"headervalue",children:[]},{value:"SecretSource",id:"secretsource",children:[]},{value:"Upstream",id:"upstream",children:[]},{value:"Upstreams",id:"upstreams",children:[]}]}],o={rightToc:c};function s(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),Object(b.b)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),Object(b.b)("p",null,"This page details a set of ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),Object(b.b)("p",null,"Below is a reference for the structure of the configuration, with\n",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions")," as the root of the configuration."),Object(b.b)("p",null,"When using alpha configuration, your config file will look something like below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),"upstreams:\n  - id: ...\n    ...\ninjectRequestHeaders:\n  - name: ...\n    ...\ninjectResponseHeaders:\n  - name: ...\n    ...\n")),Object(b.b)("p",null,"Please browse the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below for the structure\nof the new configuration format."),Object(b.b)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),Object(b.b)("p",null,"To use the new ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below."),Object(b.b)("p",null,"Provide the path to this file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"When using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," below for more information."))),Object(b.b)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),Object(b.b)("p",null,"Before adding the new ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",Object(b.b)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),Object(b.b)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",Object(b.b)("inlineCode",{parentName:"p"},"STDOUT"),"."),Object(b.b)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," and then start OAuth2 Proxy using\nthe new config."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),Object(b.b)("h2",{id:"removed-options"},"Removed options"),Object(b.b)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"flush-interval"),"/",Object(b.b)("inlineCode",{parentName:"li"},"flush_interval")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-host-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_host_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",Object(b.b)("inlineCode",{parentName:"li"},"proxy_websockets")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",Object(b.b)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"upstream"),"/",Object(b.b)("inlineCode",{parentName:"li"},"upstreams"))),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-access-token"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_access_token")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_user_headers")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_xauthrequest")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",Object(b.b)("inlineCode",{parentName:"li"},"prefer_email_to_user")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",Object(b.b)("inlineCode",{parentName:"li"},"basic_auth_password")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),Object(b.b)("p",null,"Attempting to use these options via flags or via config when ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),Object(b.b)("div",{className:"admonition admonition-important alert alert--info"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")))),Object(b.b)("h2",{id:"configuration-reference"},"Configuration Reference"),Object(b.b)("h3",{id:"alphaoptions"},"AlphaOptions"),Object(b.b)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"upstreams")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#upstreams"}),"Upstreams"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstreams is used to configure upstream servers.",Object(b.b)("br",null),"Once a user is authenticated, requests to the server will be proxied to",Object(b.b)("br",null),"these upstream servers based on the path mappings defined in this list.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectRequestHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectRequestHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to requests to upstream servers.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectResponseHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectResponseHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to responses from the proxy.",Object(b.b)("br",null),"This is typically used when using the proxy as an external authentication",Object(b.b)("br",null),"provider in conjunction with another proxy such as NGINX and its",Object(b.b)("br",null),"auth_request module.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")))),Object(b.b)("h3",{id:"claimsource"},"ClaimSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),")"),Object(b.b)("p",null,"ClaimSource allows loading a header value from a claim within the session"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"duration"},"Duration"),Object(b.b)("h4",{id:"string-alias"},"(",Object(b.b)("inlineCode",{parentName:"h4"},"string")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstream"}),"Upstream"),")"),Object(b.b)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),Object(b.b)("h3",{id:"header"},"Header"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Name is the header name to be used for this set of values.",Object(b.b)("br",null),"Names should be unique within a list of Headers.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"preserveRequestValue")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PreserveRequestValue determines whether any values for this header",Object(b.b)("br",null),"should be preserved for the request to the upstream server.",Object(b.b)("br",null),"This option only takes effet on injected request headers.",Object(b.b)("br",null),"Defaults to false (headers that match this header will be stripped).")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#headervalue"}),"[]HeaderValue"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Values contains the desired values for this header")))),Object(b.b)("h3",{id:"headervalue"},"HeaderValue"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#header"}),"Header"),")"),Object(b.b)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"secretsource"},"SecretSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#claimsource"}),"ClaimSource"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),")"),Object(b.b)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")))),Object(b.b)("h3",{id:"upstream"},"Upstream"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstreams"}),"Upstreams"),")"),Object(b.b)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ID should be a unique identifier for the upstream.",Object(b.b)("br",null),"This value is required for all upstreams.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Path is used to map requests to the upstream server.",Object(b.b)("br",null),"The closest match will take precedence and all Paths must be unique.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"uri")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI of the upstream server. This may be an HTTP(S) server of a File",Object(b.b)("br",null),"based URL. It may include a path, in which case all requests will be served",Object(b.b)("br",null),"under that path.",Object(b.b)("br",null),"Eg:",Object(b.b)("br",null),"- http://localhost:8080",Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost"}),"https://service.localhost"),Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost/path"}),"https://service.localhost/path"),Object(b.b)("br",null),"- file://host/path",Object(b.b)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',Object(b.b)("br",null),'the upstream request will be for "/base/dir".')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",Object(b.b)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",Object(b.b)("br",null),"betweem OAuth2 Proxy and the usptream server.",Object(b.b)("br",null),"Defaults to false.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"static")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Static will make all requests to this upstream have a static response.",Object(b.b)("br",null),'The response will have a body of "Authenticated" and a response code',Object(b.b)("br",null),"matching StaticCode.",Object(b.b)("br",null),"If StaticCode is not set, the response will return a 200 response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"staticCode")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"int")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StaticCode determines the response code for the Static response.",Object(b.b)("br",null),"This option can only be used with Static enabled.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"flushInterval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#duration"}),"Duration"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FlushInterval is the period between flushing the response buffer when",Object(b.b)("br",null),"streaming response from the upstream.",Object(b.b)("br",null),"Defaults to 1 second.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"passHostHeader")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PassHostHeader determines whether the request host header should be proxied",Object(b.b)("br",null),"to the upstream server.",Object(b.b)("br",null),"Defaults to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"proxyWebSockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProxyWebSockets enables proxying of websockets to upstream servers",Object(b.b)("br",null),"Defaults to true.")))),Object(b.b)("h3",{id:"upstreams"},"Upstreams"),Object(b.b)("h4",{id:"upstream-alias"},"(",Object(b.b)("a",Object(n.a)({parentName:"h4"},{href:"#upstream"}),"[]Upstream")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Upstreams is a collection of definitions for upstream servers."))}s.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return O}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),s=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},p=function(e){var t=s(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},u=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,i=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=s(a),u=n,O=p["".concat(i,".").concat(u)]||p[u]||d[u]||b;return a?r.a.createElement(O,l(l({ref:t},o),{},{components:a})):r.a.createElement(O,l({ref:t},o))}));function O(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,i=new Array(b);i[0]=u;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var o=2;o<b;o++)i[o]=a[o];return r.a.createElement.apply(null,i)}return r.a.createElement.apply(null,a)}u.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[13],{70:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return s}));var n=a(2),r=a(6),b=(a(0),a(95)),i={id:"alpha-config",title:"Alpha Configuration"},l={unversionedId:"configuration/alpha-config",id:"version-7.0.x/configuration/alpha-config",isDocsHomePage:!1,title:"Alpha Configuration",description:"This page contains documentation for alpha features.",source:"@site/versioned_docs/version-7.0.x/configuration/alpha_config.md",slug:"/configuration/alpha-config",permalink:"/oauth2-proxy/docs/configuration/alpha-config",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/alpha_config.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/configuration/tls"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/features/endpoints"}},c=[{value:"Using Alpha Configuration",id:"using-alpha-configuration",children:[{value:"Converting configuration to the new structure",id:"converting-configuration-to-the-new-structure",children:[]}]},{value:"Removed options",id:"removed-options",children:[]},{value:"Configuration Reference",id:"configuration-reference",children:[{value:"AlphaOptions",id:"alphaoptions",children:[]},{value:"ClaimSource",id:"claimsource",children:[]},{value:"Duration",id:"duration",children:[]},{value:"Header",id:"header",children:[]},{value:"HeaderValue",id:"headervalue",children:[]},{value:"SecretSource",id:"secretsource",children:[]},{value:"Upstream",id:"upstream",children:[]},{value:"Upstreams",id:"upstreams",children:[]}]}],o={rightToc:c};function s(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),Object(b.b)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),Object(b.b)("p",null,"This page details a set of ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),Object(b.b)("p",null,"Below is a reference for the structure of the configuration, with\n",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions")," as the root of the configuration."),Object(b.b)("p",null,"When using alpha configuration, your config file will look something like below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),"upstreams:\n  - id: ...\n    ...\ninjectRequestHeaders:\n  - name: ...\n    ...\ninjectResponseHeaders:\n  - name: ...\n    ...\n")),Object(b.b)("p",null,"Please browse the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below for the structure\nof the new configuration format."),Object(b.b)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),Object(b.b)("p",null,"To use the new ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below."),Object(b.b)("p",null,"Provide the path to this file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"When using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," below for more information."))),Object(b.b)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),Object(b.b)("p",null,"Before adding the new ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",Object(b.b)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),Object(b.b)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",Object(b.b)("inlineCode",{parentName:"p"},"STDOUT"),"."),Object(b.b)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," and then start OAuth2 Proxy using\nthe new config."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),Object(b.b)("h2",{id:"removed-options"},"Removed options"),Object(b.b)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"flush-interval"),"/",Object(b.b)("inlineCode",{parentName:"li"},"flush_interval")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-host-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_host_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",Object(b.b)("inlineCode",{parentName:"li"},"proxy_websockets")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",Object(b.b)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"upstream"),"/",Object(b.b)("inlineCode",{parentName:"li"},"upstreams"))),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-access-token"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_access_token")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_user_headers")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_xauthrequest")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",Object(b.b)("inlineCode",{parentName:"li"},"prefer_email_to_user")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",Object(b.b)("inlineCode",{parentName:"li"},"basic_auth_password")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),Object(b.b)("p",null,"Attempting to use these options via flags or via config when ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),Object(b.b)("div",{className:"admonition admonition-important alert alert--info"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")))),Object(b.b)("h2",{id:"configuration-reference"},"Configuration Reference"),Object(b.b)("h3",{id:"alphaoptions"},"AlphaOptions"),Object(b.b)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"upstreams")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#upstreams"}),"Upstreams"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstreams is used to configure upstream servers.",Object(b.b)("br",null),"Once a user is authenticated, requests to the server will be proxied to",Object(b.b)("br",null),"these upstream servers based on the path mappings defined in this list.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectRequestHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectRequestHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to requests to upstream servers.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectResponseHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectResponseHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to responses from the proxy.",Object(b.b)("br",null),"This is typically used when using the proxy as an external authentication",Object(b.b)("br",null),"provider in conjunction with another proxy such as NGINX and its",Object(b.b)("br",null),"auth_request module.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")))),Object(b.b)("h3",{id:"claimsource"},"ClaimSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),")"),Object(b.b)("p",null,"ClaimSource allows loading a header value from a claim within the session"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"duration"},"Duration"),Object(b.b)("h4",{id:"string-alias"},"(",Object(b.b)("inlineCode",{parentName:"h4"},"string")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstream"}),"Upstream"),")"),Object(b.b)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),Object(b.b)("h3",{id:"header"},"Header"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Name is the header name to be used for this set of values.",Object(b.b)("br",null),"Names should be unique within a list of Headers.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"preserveRequestValue")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PreserveRequestValue determines whether any values for this header",Object(b.b)("br",null),"should be preserved for the request to the upstream server.",Object(b.b)("br",null),"This option only takes effet on injected request headers.",Object(b.b)("br",null),"Defaults to false (headers that match this header will be stripped).")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#headervalue"}),"[]HeaderValue"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Values contains the desired values for this header")))),Object(b.b)("h3",{id:"headervalue"},"HeaderValue"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#header"}),"Header"),")"),Object(b.b)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"secretsource"},"SecretSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#claimsource"}),"ClaimSource"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),")"),Object(b.b)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")))),Object(b.b)("h3",{id:"upstream"},"Upstream"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstreams"}),"Upstreams"),")"),Object(b.b)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ID should be a unique identifier for the upstream.",Object(b.b)("br",null),"This value is required for all upstreams.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Path is used to map requests to the upstream server.",Object(b.b)("br",null),"The closest match will take precedence and all Paths must be unique.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"uri")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI of the upstream server. This may be an HTTP(S) server of a File",Object(b.b)("br",null),"based URL. It may include a path, in which case all requests will be served",Object(b.b)("br",null),"under that path.",Object(b.b)("br",null),"Eg:",Object(b.b)("br",null),"- http://localhost:8080",Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost"}),"https://service.localhost"),Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost/path"}),"https://service.localhost/path"),Object(b.b)("br",null),"- file://host/path",Object(b.b)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',Object(b.b)("br",null),'the upstream request will be for "/base/dir".')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",Object(b.b)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",Object(b.b)("br",null),"betweem OAuth2 Proxy and the usptream server.",Object(b.b)("br",null),"Defaults to false.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"static")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Static will make all requests to this upstream have a static response.",Object(b.b)("br",null),'The response will have a body of "Authenticated" and a response code',Object(b.b)("br",null),"matching StaticCode.",Object(b.b)("br",null),"If StaticCode is not set, the response will return a 200 response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"staticCode")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"int")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StaticCode determines the response code for the Static response.",Object(b.b)("br",null),"This option can only be used with Static enabled.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"flushInterval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#duration"}),"Duration"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FlushInterval is the period between flushing the response buffer when",Object(b.b)("br",null),"streaming response from the upstream.",Object(b.b)("br",null),"Defaults to 1 second.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"passHostHeader")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PassHostHeader determines whether the request host header should be proxied",Object(b.b)("br",null),"to the upstream server.",Object(b.b)("br",null),"Defaults to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"proxyWebSockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProxyWebSockets enables proxying of websockets to upstream servers",Object(b.b)("br",null),"Defaults to true.")))),Object(b.b)("h3",{id:"upstreams"},"Upstreams"),Object(b.b)("h4",{id:"upstream-alias"},"(",Object(b.b)("a",Object(n.a)({parentName:"h4"},{href:"#upstream"}),"[]Upstream")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Upstreams is a collection of definitions for upstream servers."))}s.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return O}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),s=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},p=function(e){var t=s(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},u=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,i=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=s(a),u=n,O=p["".concat(i,".").concat(u)]||p[u]||d[u]||b;return a?r.a.createElement(O,l(l({ref:t},o),{},{components:a})):r.a.createElement(O,l({ref:t},o))}));function O(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,i=new Array(b);i[0]=u;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var o=2;o<b;o++)i[o]=a[o];return r.a.createElement.apply(null,i)}return r.a.createElement.apply(null,a)}u.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/41.2d80f77f.js b/40.6add7124.js
similarity index 80%
rename from 41.2d80f77f.js
rename to 40.6add7124.js
index 09b09206..453c0f71 100644
--- a/41.2d80f77f.js
+++ b/40.6add7124.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[41],{114:function(e,t,a){"use strict";a.r(t);var n=a(0),o=a.n(n),l=a(107);t.default=function(){return o.a.createElement(l.a,{title:"Page Not Found"},o.a.createElement("div",{className:"container margin-vert--xl"},o.a.createElement("div",{className:"row"},o.a.createElement("div",{className:"col col--6 col--offset-3"},o.a.createElement("h1",{className:"hero__title"},"Page Not Found"),o.a.createElement("p",null,"We could not find what you were looking for."),o.a.createElement("p",null,"Please contact the owner of the site that linked you to the original URL and let them know their link is broken.")))))}}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[40],{113:function(e,t,a){"use strict";a.r(t);var n=a(0),o=a.n(n),l=a(106);t.default=function(){return o.a.createElement(l.a,{title:"Page Not Found"},o.a.createElement("div",{className:"container margin-vert--xl"},o.a.createElement("div",{className:"row"},o.a.createElement("div",{className:"col col--6 col--offset-3"},o.a.createElement("h1",{className:"hero__title"},"Page Not Found"),o.a.createElement("p",null,"We could not find what you were looking for."),o.a.createElement("p",null,"Please contact the owner of the site that linked you to the original URL and let them know their link is broken.")))))}}}]);
\ No newline at end of file
diff --git a/404.html b/404.html
index 827d16b1..e25690d4 100644
--- a/404.html
+++ b/404.html
@@ -6,14 +6,14 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Page Not Found | OAuth2 Proxy</title><meta data-react-helmet="true" property="og:title" content="Page Not Found | OAuth2 Proxy"><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_tag" content="default"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item menu__list-item--collapsed"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="container margin-vert--xl"><div class="row"><div class="col col--6 col--offset-3"><h1 class="hero__title">Page Not Found</h1><p>We could not find what you were looking for.</p><p>Please contact the owner of the site that linked you to the original URL and let them know their link is broken.</p></div></div></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/42326c77.09a0e8e4.js b/42326c77.cbfbbe21.js
similarity index 97%
rename from 42326c77.09a0e8e4.js
rename to 42326c77.cbfbbe21.js
index 09b7b6da..1f35a456 100644
--- a/42326c77.09a0e8e4.js
+++ b/42326c77.cbfbbe21.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[14],{71:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return a})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return s})),r.d(t,"default",(function(){return p}));var n=r(2),o=r(6),i=(r(0),r(96)),a={id:"behaviour",title:"Behaviour"},c={unversionedId:"behaviour",id:"version-6.1.x/behaviour",isDocsHomePage:!1,title:"Behaviour",description:"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).",source:"@site/versioned_docs/version-6.1.x/behaviour.md",slug:"/behaviour",permalink:"/oauth2-proxy/docs/6.1.x/behaviour",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/behaviour.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Installation",permalink:"/oauth2-proxy/docs/6.1.x/"},next:{title:"Overview",permalink:"/oauth2-proxy/docs/6.1.x/configuration/overview"}},s=[],u={rightToc:s};function p(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(n.a)({},u,r,{components:t,mdxType:"MDXLayout"}),Object(i.b)("ol",null,Object(i.b)("li",{parentName:"ol"},"Any request passing through the proxy (and not matched by ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-auth-regex"),") is checked for the proxy's session cookie (",Object(i.b)("inlineCode",{parentName:"li"},"--cookie-name"),") (or, if allowed, a JWT token - see ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-jwt-bearer-tokens"),")."),Object(i.b)("li",{parentName:"ol"},"If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with ",Object(i.b)("inlineCode",{parentName:"li"},"Accept: application/json"),", in which case 401 Unauthorized is returned)"),Object(i.b)("li",{parentName:"ol"},"After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set"),Object(i.b)("li",{parentName:"ol"},"The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)")),Object(i.b)("p",null,"Notice that the proxy also provides a number of useful ",Object(i.b)("a",Object(n.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/features/endpoints"}),"endpoints"),"."))}p.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?a(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):a(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function s(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u<i;u++)a[u]=r[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,r)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[14],{71:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return a})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return s})),r.d(t,"default",(function(){return p}));var n=r(2),o=r(6),i=(r(0),r(95)),a={id:"behaviour",title:"Behaviour"},c={unversionedId:"behaviour",id:"version-6.1.x/behaviour",isDocsHomePage:!1,title:"Behaviour",description:"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).",source:"@site/versioned_docs/version-6.1.x/behaviour.md",slug:"/behaviour",permalink:"/oauth2-proxy/docs/6.1.x/behaviour",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/behaviour.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Installation",permalink:"/oauth2-proxy/docs/6.1.x/"},next:{title:"Overview",permalink:"/oauth2-proxy/docs/6.1.x/configuration/overview"}},s=[],u={rightToc:s};function p(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(n.a)({},u,r,{components:t,mdxType:"MDXLayout"}),Object(i.b)("ol",null,Object(i.b)("li",{parentName:"ol"},"Any request passing through the proxy (and not matched by ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-auth-regex"),") is checked for the proxy's session cookie (",Object(i.b)("inlineCode",{parentName:"li"},"--cookie-name"),") (or, if allowed, a JWT token - see ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-jwt-bearer-tokens"),")."),Object(i.b)("li",{parentName:"ol"},"If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with ",Object(i.b)("inlineCode",{parentName:"li"},"Accept: application/json"),", in which case 401 Unauthorized is returned)"),Object(i.b)("li",{parentName:"ol"},"After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set"),Object(i.b)("li",{parentName:"ol"},"The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)")),Object(i.b)("p",null,"Notice that the proxy also provides a number of useful ",Object(i.b)("a",Object(n.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/features/endpoints"}),"endpoints"),"."))}p.isMDXComponent=!0},95:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?a(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):a(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function s(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u<i;u++)a[u]=r[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,r)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/585bdad0.2c674a88.js b/585bdad0.ccaae809.js
similarity index 98%
rename from 585bdad0.2c674a88.js
rename to 585bdad0.ccaae809.js
index db6c692f..1b875a8b 100644
--- a/585bdad0.2c674a88.js
+++ b/585bdad0.ccaae809.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[15],{72:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return s}));var r=n(2),o=n(6),a=(n(0),n(96)),i={id:"tls",title:"TLS Configuration"},c={unversionedId:"configuration/tls",id:"configuration/tls",isDocsHomePage:!1,title:"TLS Configuration",description:"There are two recommended configurations.",source:"@site/docs/configuration/tls.md",slug:"/configuration/tls",permalink:"/oauth2-proxy/docs/next/configuration/tls",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/tls.md",version:"current",sidebar:"docs",previous:{title:"Session Storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage"},next:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/next/configuration/alpha-config"}},p=[],l={rightToc:p};function s(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("p",null,"There are two recommended configurations."),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with OAuth2 Proxy by providing a ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-cert-file=/path/to/cert.pem")," and ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-key-file=/path/to/cert.key"),"."),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n    --email-domain="yourcompany.com"  \\\n    --upstream=http://127.0.0.1:8080/ \\\n    --tls-cert-file=/path/to/cert.pem \\\n    --tls-key-file=/path/to/cert.key \\\n    --cookie-secret=... \\\n    --cookie-secure=true \\\n    --provider=... \\\n    --client-id=... \\\n    --client-secret=...\n'))),Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://nginx.org/"}),"Nginx")," (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...."),Object(a.b)("p",{parentName:"li"},"Because ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," listens on ",Object(a.b)("inlineCode",{parentName:"p"},"127.0.0.1:4180")," by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use ",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="0.0.0.0:4180"')," or\n",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="http://:4180"'),"."),Object(a.b)("p",{parentName:"li"},"Nginx will listen on port ",Object(a.b)("inlineCode",{parentName:"p"},"443")," and handle SSL connections while proxying to ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on port ",Object(a.b)("inlineCode",{parentName:"p"},"4180"),".\n",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," will then authenticate requests for an upstream application. The external endpoint for this example\nwould be ",Object(a.b)("inlineCode",{parentName:"p"},"https://internal.yourcompany.com/"),"."),Object(a.b)("p",{parentName:"li"},"An example Nginx config follows. Note the use of ",Object(a.b)("inlineCode",{parentName:"p"},"Strict-Transport-Security")," header to pin requests to SSL\nvia ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security"}),"HSTS"),":"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{}),"server {\n    listen 443 default ssl;\n    server_name internal.yourcompany.com;\n    ssl_certificate /path/to/cert.pem;\n    ssl_certificate_key /path/to/cert.key;\n    add_header Strict-Transport-Security max-age=2592000;\n\n    location / {\n        proxy_pass http://127.0.0.1:4180;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Scheme $scheme;\n        proxy_connect_timeout 1;\n        proxy_send_timeout 30;\n        proxy_read_timeout 30;\n    }\n}\n")),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n   --email-domain="yourcompany.com"  \\\n   --upstream=http://127.0.0.1:8080/ \\\n   --cookie-secret=... \\\n   --cookie-secure=true \\\n   --provider=... \\\n   --reverse-proxy=true \\\n   --client-id=... \\\n   --client-secret=...\n')))))}s.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<a;l++)i[l]=n[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[15],{72:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return s}));var r=n(2),o=n(6),a=(n(0),n(95)),i={id:"tls",title:"TLS Configuration"},c={unversionedId:"configuration/tls",id:"configuration/tls",isDocsHomePage:!1,title:"TLS Configuration",description:"There are two recommended configurations.",source:"@site/docs/configuration/tls.md",slug:"/configuration/tls",permalink:"/oauth2-proxy/docs/next/configuration/tls",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/tls.md",version:"current",sidebar:"docs",previous:{title:"Session Storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage"},next:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/next/configuration/alpha-config"}},p=[],l={rightToc:p};function s(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("p",null,"There are two recommended configurations."),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with OAuth2 Proxy by providing a ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-cert-file=/path/to/cert.pem")," and ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-key-file=/path/to/cert.key"),"."),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n    --email-domain="yourcompany.com"  \\\n    --upstream=http://127.0.0.1:8080/ \\\n    --tls-cert-file=/path/to/cert.pem \\\n    --tls-key-file=/path/to/cert.key \\\n    --cookie-secret=... \\\n    --cookie-secure=true \\\n    --provider=... \\\n    --client-id=... \\\n    --client-secret=...\n'))),Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://nginx.org/"}),"Nginx")," (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...."),Object(a.b)("p",{parentName:"li"},"Because ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," listens on ",Object(a.b)("inlineCode",{parentName:"p"},"127.0.0.1:4180")," by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use ",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="0.0.0.0:4180"')," or\n",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="http://:4180"'),"."),Object(a.b)("p",{parentName:"li"},"Nginx will listen on port ",Object(a.b)("inlineCode",{parentName:"p"},"443")," and handle SSL connections while proxying to ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on port ",Object(a.b)("inlineCode",{parentName:"p"},"4180"),".\n",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," will then authenticate requests for an upstream application. The external endpoint for this example\nwould be ",Object(a.b)("inlineCode",{parentName:"p"},"https://internal.yourcompany.com/"),"."),Object(a.b)("p",{parentName:"li"},"An example Nginx config follows. Note the use of ",Object(a.b)("inlineCode",{parentName:"p"},"Strict-Transport-Security")," header to pin requests to SSL\nvia ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security"}),"HSTS"),":"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{}),"server {\n    listen 443 default ssl;\n    server_name internal.yourcompany.com;\n    ssl_certificate /path/to/cert.pem;\n    ssl_certificate_key /path/to/cert.key;\n    add_header Strict-Transport-Security max-age=2592000;\n\n    location / {\n        proxy_pass http://127.0.0.1:4180;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Scheme $scheme;\n        proxy_connect_timeout 1;\n        proxy_send_timeout 30;\n        proxy_read_timeout 30;\n    }\n}\n")),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n   --email-domain="yourcompany.com"  \\\n   --upstream=http://127.0.0.1:8080/ \\\n   --cookie-secret=... \\\n   --cookie-secure=true \\\n   --provider=... \\\n   --reverse-proxy=true \\\n   --client-id=... \\\n   --client-secret=...\n')))))}s.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<a;l++)i[l]=n[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/5a047177.05c93143.js b/5a047177.4377cd87.js
similarity index 97%
rename from 5a047177.05c93143.js
rename to 5a047177.4377cd87.js
index cb12657b..2a421ec1 100644
--- a/5a047177.05c93143.js
+++ b/5a047177.4377cd87.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[16],{73:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return a})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return s})),r.d(t,"default",(function(){return p}));var n=r(2),o=r(6),i=(r(0),r(96)),a={id:"behaviour",title:"Behaviour"},c={unversionedId:"behaviour",id:"version-7.0.x/behaviour",isDocsHomePage:!1,title:"Behaviour",description:"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).",source:"@site/versioned_docs/version-7.0.x/behaviour.md",slug:"/behaviour",permalink:"/oauth2-proxy/docs/behaviour",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/behaviour.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Installation",permalink:"/oauth2-proxy/docs/"},next:{title:"Overview",permalink:"/oauth2-proxy/docs/configuration/overview"}},s=[],u={rightToc:s};function p(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(n.a)({},u,r,{components:t,mdxType:"MDXLayout"}),Object(i.b)("ol",null,Object(i.b)("li",{parentName:"ol"},"Any request passing through the proxy (and not matched by ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-auth-regex"),") is checked for the proxy's session cookie (",Object(i.b)("inlineCode",{parentName:"li"},"--cookie-name"),") (or, if allowed, a JWT token - see ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-jwt-bearer-tokens"),")."),Object(i.b)("li",{parentName:"ol"},"If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with ",Object(i.b)("inlineCode",{parentName:"li"},"Accept: application/json"),", in which case 401 Unauthorized is returned)"),Object(i.b)("li",{parentName:"ol"},"After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set"),Object(i.b)("li",{parentName:"ol"},"The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)")),Object(i.b)("p",null,"Notice that the proxy also provides a number of useful ",Object(i.b)("a",Object(n.a)({parentName:"p"},{href:"/oauth2-proxy/docs/features/endpoints"}),"endpoints"),"."))}p.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?a(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):a(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function s(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u<i;u++)a[u]=r[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,r)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[16],{73:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return a})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return s})),r.d(t,"default",(function(){return p}));var n=r(2),o=r(6),i=(r(0),r(95)),a={id:"behaviour",title:"Behaviour"},c={unversionedId:"behaviour",id:"version-7.0.x/behaviour",isDocsHomePage:!1,title:"Behaviour",description:"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).",source:"@site/versioned_docs/version-7.0.x/behaviour.md",slug:"/behaviour",permalink:"/oauth2-proxy/docs/behaviour",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/behaviour.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Installation",permalink:"/oauth2-proxy/docs/"},next:{title:"Overview",permalink:"/oauth2-proxy/docs/configuration/overview"}},s=[],u={rightToc:s};function p(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(n.a)({},u,r,{components:t,mdxType:"MDXLayout"}),Object(i.b)("ol",null,Object(i.b)("li",{parentName:"ol"},"Any request passing through the proxy (and not matched by ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-auth-regex"),") is checked for the proxy's session cookie (",Object(i.b)("inlineCode",{parentName:"li"},"--cookie-name"),") (or, if allowed, a JWT token - see ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-jwt-bearer-tokens"),")."),Object(i.b)("li",{parentName:"ol"},"If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with ",Object(i.b)("inlineCode",{parentName:"li"},"Accept: application/json"),", in which case 401 Unauthorized is returned)"),Object(i.b)("li",{parentName:"ol"},"After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set"),Object(i.b)("li",{parentName:"ol"},"The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)")),Object(i.b)("p",null,"Notice that the proxy also provides a number of useful ",Object(i.b)("a",Object(n.a)({parentName:"p"},{href:"/oauth2-proxy/docs/features/endpoints"}),"endpoints"),"."))}p.isMDXComponent=!0},95:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?a(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):a(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function s(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u<i;u++)a[u]=r[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,r)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/6f497b56.ffc09987.js b/6f497b56.a16212fe.js
similarity index 97%
rename from 6f497b56.ffc09987.js
rename to 6f497b56.a16212fe.js
index 1ada389f..160a2f5c 100644
--- a/6f497b56.ffc09987.js
+++ b/6f497b56.a16212fe.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[17],{74:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return s})),r.d(t,"rightToc",(function(){return u})),r.d(t,"default",(function(){return p}));var n=r(2),a=r(6),o=(r(0),r(96)),i={id:"request_signatures",title:"Request Signatures"},s={unversionedId:"features/request_signatures",id:"version-6.1.x/features/request_signatures",isDocsHomePage:!1,title:"Request Signatures",description:"If signature_key is defined, proxied requests will be signed with the",source:"@site/versioned_docs/version-6.1.x/features/request_signatures.md",slug:"/features/request_signatures",permalink:"/oauth2-proxy/docs/6.1.x/features/request_signatures",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/request_signatures.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Endpoints",permalink:"/oauth2-proxy/docs/6.1.x/features/endpoints"},next:{title:"Security",permalink:"/oauth2-proxy/docs/6.1.x/community/security"}},u=[],c={rightToc:u};function p(e){var t=e.components,r=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(n.a)({},c,r,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"If ",Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," is defined, proxied requests will be signed with the\n",Object(o.b)("inlineCode",{parentName:"p"},"GAP-Signature")," header, which is a ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://en.wikipedia.org/wiki/Hash-based_message_authentication_code"}),"Hash-based Message Authentication Code\n(HMAC)"),"\nof selected request information and the request body ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go"}),"see ",Object(o.b)("inlineCode",{parentName:"a"},"SIGNATURE_HEADERS"),"\nin ",Object(o.b)("inlineCode",{parentName:"a"},"oauthproxy.go")),"."),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," must be of the form ",Object(o.b)("inlineCode",{parentName:"p"},"algorithm:secretkey"),", (ie: ",Object(o.b)("inlineCode",{parentName:"p"},'signature_key = "sha1:secret0"'),")"),Object(o.b)("p",null,"For more information about HMAC request signature validation, read the\nfollowing:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html"}),"Amazon Web Services: Signing and Authenticating REST\nRequests")),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/"}),"rc3.org: Using HMAC to authenticate Web service\nrequests"))))}p.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){o(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function u(e,t){if(null==e)return{};var r,n,a=function(e,t){if(null==e)return{};var r,n,a={},o=Object.keys(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var c=a.a.createContext({}),p=function(e){var t=a.a.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},l=function(e){var t=p(e.components);return a.a.createElement(c.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,c=u(e,["components","mdxType","originalType","parentName"]),l=p(r),d=n,f=l["".concat(i,".").concat(d)]||l[d]||b[d]||o;return r?a.a.createElement(f,s(s({ref:t},c),{},{components:r})):a.a.createElement(f,s({ref:t},c))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:n,i[1]=s;for(var c=2;c<o;c++)i[c]=r[c];return a.a.createElement.apply(null,i)}return a.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[17],{74:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return s})),r.d(t,"rightToc",(function(){return u})),r.d(t,"default",(function(){return p}));var n=r(2),a=r(6),o=(r(0),r(95)),i={id:"request_signatures",title:"Request Signatures"},s={unversionedId:"features/request_signatures",id:"version-6.1.x/features/request_signatures",isDocsHomePage:!1,title:"Request Signatures",description:"If signature_key is defined, proxied requests will be signed with the",source:"@site/versioned_docs/version-6.1.x/features/request_signatures.md",slug:"/features/request_signatures",permalink:"/oauth2-proxy/docs/6.1.x/features/request_signatures",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/request_signatures.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Endpoints",permalink:"/oauth2-proxy/docs/6.1.x/features/endpoints"},next:{title:"Security",permalink:"/oauth2-proxy/docs/6.1.x/community/security"}},u=[],c={rightToc:u};function p(e){var t=e.components,r=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(n.a)({},c,r,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"If ",Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," is defined, proxied requests will be signed with the\n",Object(o.b)("inlineCode",{parentName:"p"},"GAP-Signature")," header, which is a ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://en.wikipedia.org/wiki/Hash-based_message_authentication_code"}),"Hash-based Message Authentication Code\n(HMAC)"),"\nof selected request information and the request body ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go"}),"see ",Object(o.b)("inlineCode",{parentName:"a"},"SIGNATURE_HEADERS"),"\nin ",Object(o.b)("inlineCode",{parentName:"a"},"oauthproxy.go")),"."),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," must be of the form ",Object(o.b)("inlineCode",{parentName:"p"},"algorithm:secretkey"),", (ie: ",Object(o.b)("inlineCode",{parentName:"p"},'signature_key = "sha1:secret0"'),")"),Object(o.b)("p",null,"For more information about HMAC request signature validation, read the\nfollowing:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html"}),"Amazon Web Services: Signing and Authenticating REST\nRequests")),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/"}),"rc3.org: Using HMAC to authenticate Web service\nrequests"))))}p.isMDXComponent=!0},95:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){o(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function u(e,t){if(null==e)return{};var r,n,a=function(e,t){if(null==e)return{};var r,n,a={},o=Object.keys(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var c=a.a.createContext({}),p=function(e){var t=a.a.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},l=function(e){var t=p(e.components);return a.a.createElement(c.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,c=u(e,["components","mdxType","originalType","parentName"]),l=p(r),d=n,f=l["".concat(i,".").concat(d)]||l[d]||b[d]||o;return r?a.a.createElement(f,s(s({ref:t},c),{},{components:r})):a.a.createElement(f,s({ref:t},c))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:n,i[1]=s;for(var c=2;c<o;c++)i[c]=r[c];return a.a.createElement.apply(null,i)}return a.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/7b04b1d5.49cea530.js b/7b04b1d5.6efeb7d7.js
similarity index 97%
rename from 7b04b1d5.49cea530.js
rename to 7b04b1d5.6efeb7d7.js
index 6af1ec0b..cd6528d5 100644
--- a/7b04b1d5.49cea530.js
+++ b/7b04b1d5.6efeb7d7.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[18],{75:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return p})),r.d(t,"default",(function(){return u}));var n=r(2),o=r(6),a=(r(0),r(96)),i={id:"installation",title:"Installation",slug:"/"},c={unversionedId:"installation",id:"version-6.1.x/installation",isDocsHomePage:!1,title:"Installation",description:"1.  Choose how to deploy:",source:"@site/versioned_docs/version-6.1.x/installation.md",slug:"/",permalink:"/oauth2-proxy/docs/6.1.x/",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/installation.md",version:"6.1.x",sidebar:"version-6.1.x/docs",next:{title:"Behaviour",permalink:"/oauth2-proxy/docs/6.1.x/behaviour"}},p=[],l={rightToc:p};function u(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(n.a)({},l,r,{components:t,mdxType:"MDXLayout"}),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Choose how to deploy:"),Object(a.b)("p",{parentName:"li"},"a. Download ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/releases"}),"Prebuilt Binary")," (current release is ",Object(a.b)("inlineCode",{parentName:"p"},"v6.1.1"),")"),Object(a.b)("p",{parentName:"li"},"b. Build with ",Object(a.b)("inlineCode",{parentName:"p"},"$ go get github.com/oauth2-proxy/oauth2-proxy")," which will put the binary in ",Object(a.b)("inlineCode",{parentName:"p"},"$GOPATH/bin")),Object(a.b)("p",{parentName:"li"},"c. Using the prebuilt docker image ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://quay.io/oauth2-proxy/oauth2-proxy"}),"quay.io/oauth2-proxy/oauth2-proxy")," (AMD64, ARMv6 and ARM64 tags available)"))),Object(a.b)("p",null,"Prebuilt binaries can be validated by extracting the file and verifying it against the ",Object(a.b)("inlineCode",{parentName:"p"},"sha256sum.txt")," checksum file provided for each release starting with version ",Object(a.b)("inlineCode",{parentName:"p"},"v3.0.0"),"."),Object(a.b)("pre",null,Object(a.b)("code",Object(n.a)({parentName:"pre"},{}),"$ sha256sum -c sha256sum.txt 2>&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(a.b)("ol",{start:2},Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return b})),r.d(t,"b",(function(){return m}));var n=r(0),o=r.n(n);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){a(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function p(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},a=Object.keys(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var l=o.a.createContext({}),u=function(e){var t=o.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},d=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||a;return r?o.a.createElement(m,c(c({ref:t},l),{},{components:r})):o.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var a=r.length,i=new Array(a);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l<a;l++)i[l]=r[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[18],{75:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return p})),r.d(t,"default",(function(){return u}));var n=r(2),o=r(6),a=(r(0),r(95)),i={id:"installation",title:"Installation",slug:"/"},c={unversionedId:"installation",id:"version-6.1.x/installation",isDocsHomePage:!1,title:"Installation",description:"1.  Choose how to deploy:",source:"@site/versioned_docs/version-6.1.x/installation.md",slug:"/",permalink:"/oauth2-proxy/docs/6.1.x/",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/installation.md",version:"6.1.x",sidebar:"version-6.1.x/docs",next:{title:"Behaviour",permalink:"/oauth2-proxy/docs/6.1.x/behaviour"}},p=[],l={rightToc:p};function u(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(n.a)({},l,r,{components:t,mdxType:"MDXLayout"}),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Choose how to deploy:"),Object(a.b)("p",{parentName:"li"},"a. Download ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/releases"}),"Prebuilt Binary")," (current release is ",Object(a.b)("inlineCode",{parentName:"p"},"v6.1.1"),")"),Object(a.b)("p",{parentName:"li"},"b. Build with ",Object(a.b)("inlineCode",{parentName:"p"},"$ go get github.com/oauth2-proxy/oauth2-proxy")," which will put the binary in ",Object(a.b)("inlineCode",{parentName:"p"},"$GOPATH/bin")),Object(a.b)("p",{parentName:"li"},"c. Using the prebuilt docker image ",Object(a.b)("a",Object(n.a)({parentName:"p"},{href:"https://quay.io/oauth2-proxy/oauth2-proxy"}),"quay.io/oauth2-proxy/oauth2-proxy")," (AMD64, ARMv6 and ARM64 tags available)"))),Object(a.b)("p",null,"Prebuilt binaries can be validated by extracting the file and verifying it against the ",Object(a.b)("inlineCode",{parentName:"p"},"sha256sum.txt")," checksum file provided for each release starting with version ",Object(a.b)("inlineCode",{parentName:"p"},"v3.0.0"),"."),Object(a.b)("pre",null,Object(a.b)("code",Object(n.a)({parentName:"pre"},{}),"$ sha256sum -c sha256sum.txt 2>&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(a.b)("ol",{start:2},Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0},95:function(e,t,r){"use strict";r.d(t,"a",(function(){return b})),r.d(t,"b",(function(){return m}));var n=r(0),o=r.n(n);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){a(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function p(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},a=Object.keys(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n<a.length;n++)r=a[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var l=o.a.createContext({}),u=function(e){var t=o.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},d=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||a;return r?o.a.createElement(m,c(c({ref:t},l),{},{components:r})):o.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var a=r.length,i=new Array(a);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l<a;l++)i[l]=r[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/7dcecc8d.1a244b07.js b/7dcecc8d.818ddd0c.js
similarity index 99%
rename from 7dcecc8d.1a244b07.js
rename to 7dcecc8d.818ddd0c.js
index 3bef8d05..5b92e4a1 100644
--- a/7dcecc8d.1a244b07.js
+++ b/7dcecc8d.818ddd0c.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[19],{76:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return b}));var o=a(2),n=a(6),r=(a(0),a(96)),i={id:"oauth_provider",title:"OAuth Provider Configuration"},l={unversionedId:"configuration/oauth_provider",id:"version-7.0.x/configuration/oauth_provider",isDocsHomePage:!1,title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/versioned_docs/version-7.0.x/configuration/auth.md",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/auth.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[]},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[]},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[]},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[]},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[]},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[]},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[]},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[]},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[]},{value:"login.gov Provider",id:"logingov-provider",children:[]},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[]},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[]},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[]},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[]},{value:"Email Authentication",id:"email-authentication",children:[]},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[]}],p={rightToc:c};function b(e){var t=e.components,a=Object(n.a)(e,["components"]);return Object(r.b)("wrapper",Object(o.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),Object(r.b)("p",null,"Valid providers are :"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#google-auth-provider"}),"Google")," ",Object(r.b)("em",{parentName:"li"},"default")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#azure-auth-provider"}),"Azure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#facebook-auth-provider"}),"Facebook")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#github-auth-provider"}),"GitHub")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#keycloak-auth-provider"}),"Keycloak")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitlab-auth-provider"}),"GitLab")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#linkedin-auth-provider"}),"LinkedIn")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#microsoft-azure-ad-provider"}),"Microsoft Azure AD")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#openid-connect-provider"}),"OpenID Connect")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#logingov-provider"}),"login.gov")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#nextcloud-provider"}),"Nextcloud")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#digitalocean-auth-provider"}),"DigitalOcean")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#bitbucket-auth-provider"}),"Bitbucket")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitea-auth-provider"}),"Gitea"))),Object(r.b)("p",null,"The provider can be selected using the ",Object(r.b)("inlineCode",{parentName:"p"},"provider")," configuration value."),Object(r.b)("p",null,"Please note that not all providers support all claims. The ",Object(r.b)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),Object(r.b)("h3",{id:"google-auth-provider"},"Google Auth Provider"),Object(r.b)("p",null,"For Google, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://console.developers.google.com/project"}),"https://console.developers.google.com/project")),Object(r.b)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),Object(r.b)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"API Manager"')),Object(r.b)("li",{parentName:"ol"},"In the left Nav pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",Object(r.b)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')," tab.",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Open the ",Object(r.b)("strong",{parentName:"li"},'"New credentials"')," drop down"),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth client ID"')),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Web application"')),Object(r.b)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),Object(r.b)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),Object(r.b)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Create"')))),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Client ID")," and ",Object(r.b)("strong",{parentName:"li"},"Client Secret"))),Object(r.b)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",Object(r.b)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),Object(r.b)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a service account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"}),"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),Object(r.b)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),Object(r.b)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),Object(r.b)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"}),"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),Object(r.b)("ol",{start:6},Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://support.google.com/a/answer/60757"}),"https://support.google.com/a/answer/60757")," to enable Admin API access."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),Object(r.b)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",Object(r.b)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),Object(r.b)("li",{parentName:"ol"},"Restart oauth2-proxy.")),Object(r.b)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),Object(r.b)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Add an application: go to ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://portal.azure.com"}),"https://portal.azure.com"),", choose ",Object(r.b)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",Object(r.b)("strong",{parentName:"li"},'"App registrations"')," and then click on ",Object(r.b)("strong",{parentName:"li"},'"New app registration"'),"."),Object(r.b)("li",{parentName:"ol"},"Pick a name and choose ",Object(r.b)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",Object(r.b)("strong",{parentName:"li"},'"Create"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",Object(r.b)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",Object(r.b)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",Object(r.b)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",Object(r.b)("strong",{parentName:"li"},'"Save"')," and then then on ",Object(r.b)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=azure\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 6>\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--provider=keycloak\n--client-id=<client you have created>\n--client-secret=<your client\'s secret>\n--login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"\n--redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"\n--profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--keycloak-group=<first_allowed_user_group>\n--keycloak-group=<second_allowed_user_group>\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="gitlab"\n    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n    --client-id=GITLAB_CLIENT_ID\n    --client-secret=GITLAB_CLIENT_SECRET\n    --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url="<your gitlab url>"\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n    "https://example.corp.com"\n]\nemail_domains = [\n    "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n    "http://0.0.0.0:8080"\n]\nemail_domains = [\n    "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard.  The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol:  make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer:  do what they say for OpenID Connect.  We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle:  Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n  -client-id=${LOGINGOV_ISSUER} \\\n  -redirect-url=http://localhost:4180/oauth2/callback \\\n  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n  -cookie-secure=false \\\n  -email-domain=gsa.gov \\\n  -upstream=http://localhost:3000/ \\\n  -cookie-secret=somerandomstring12341234567890AB \\\n  -cookie-domain=localhost \\\n  -skip-provider-button=true \\\n  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),".  In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"    -provider oidc\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -skip-oidc-discovery\n    -login-url http://127.0.0.1:5556/authorize\n    -redeem-url http://127.0.0.1:5556/token\n    -oidc-jwks-url http://127.0.0.1:5556/keys\n    -cookie-secure=false\n    -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider nextcloud\n    -client-id <from nextcloud admin>\n    -client-secret <from nextcloud admin>\n    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=digitalocean\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=bitbucket\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="github"\n    --redirect-url="https://<proxied host>/oauth2/callback"\n    --provider-display-name="Gitea"\n    --client-id="< client_id as generated by Gitea >"\n    --client-secret="< client_secret as generated by Gitea >"\n    --login-url="https://< your gitea host >/login/oauth/authorize"\n    --redeem-url="https://< your gitea host >/login/oauth/access_token"\n    --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,o,n=function(e,t){if(null==e)return{};var a,o,n={},r=Object.keys(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p<r;p++)i[p]=a[p];return n.a.createElement.apply(null,i)}return n.a.createElement.apply(null,a)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[19],{76:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return b}));var o=a(2),n=a(6),r=(a(0),a(95)),i={id:"oauth_provider",title:"OAuth Provider Configuration"},l={unversionedId:"configuration/oauth_provider",id:"version-7.0.x/configuration/oauth_provider",isDocsHomePage:!1,title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/versioned_docs/version-7.0.x/configuration/auth.md",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/auth.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[]},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[]},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[]},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[]},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[]},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[]},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[]},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[]},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[]},{value:"login.gov Provider",id:"logingov-provider",children:[]},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[]},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[]},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[]},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[]},{value:"Email Authentication",id:"email-authentication",children:[]},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[]}],p={rightToc:c};function b(e){var t=e.components,a=Object(n.a)(e,["components"]);return Object(r.b)("wrapper",Object(o.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),Object(r.b)("p",null,"Valid providers are :"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#google-auth-provider"}),"Google")," ",Object(r.b)("em",{parentName:"li"},"default")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#azure-auth-provider"}),"Azure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#facebook-auth-provider"}),"Facebook")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#github-auth-provider"}),"GitHub")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#keycloak-auth-provider"}),"Keycloak")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitlab-auth-provider"}),"GitLab")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#linkedin-auth-provider"}),"LinkedIn")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#microsoft-azure-ad-provider"}),"Microsoft Azure AD")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#openid-connect-provider"}),"OpenID Connect")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#logingov-provider"}),"login.gov")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#nextcloud-provider"}),"Nextcloud")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#digitalocean-auth-provider"}),"DigitalOcean")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#bitbucket-auth-provider"}),"Bitbucket")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitea-auth-provider"}),"Gitea"))),Object(r.b)("p",null,"The provider can be selected using the ",Object(r.b)("inlineCode",{parentName:"p"},"provider")," configuration value."),Object(r.b)("p",null,"Please note that not all providers support all claims. The ",Object(r.b)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),Object(r.b)("h3",{id:"google-auth-provider"},"Google Auth Provider"),Object(r.b)("p",null,"For Google, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://console.developers.google.com/project"}),"https://console.developers.google.com/project")),Object(r.b)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),Object(r.b)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"API Manager"')),Object(r.b)("li",{parentName:"ol"},"In the left Nav pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",Object(r.b)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')," tab.",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Open the ",Object(r.b)("strong",{parentName:"li"},'"New credentials"')," drop down"),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth client ID"')),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Web application"')),Object(r.b)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),Object(r.b)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),Object(r.b)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Create"')))),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Client ID")," and ",Object(r.b)("strong",{parentName:"li"},"Client Secret"))),Object(r.b)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",Object(r.b)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),Object(r.b)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a service account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"}),"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),Object(r.b)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),Object(r.b)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),Object(r.b)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"}),"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),Object(r.b)("ol",{start:6},Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://support.google.com/a/answer/60757"}),"https://support.google.com/a/answer/60757")," to enable Admin API access."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),Object(r.b)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",Object(r.b)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),Object(r.b)("li",{parentName:"ol"},"Restart oauth2-proxy.")),Object(r.b)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),Object(r.b)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Add an application: go to ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://portal.azure.com"}),"https://portal.azure.com"),", choose ",Object(r.b)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",Object(r.b)("strong",{parentName:"li"},'"App registrations"')," and then click on ",Object(r.b)("strong",{parentName:"li"},'"New app registration"'),"."),Object(r.b)("li",{parentName:"ol"},"Pick a name and choose ",Object(r.b)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",Object(r.b)("strong",{parentName:"li"},'"Create"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",Object(r.b)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",Object(r.b)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",Object(r.b)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",Object(r.b)("strong",{parentName:"li"},'"Save"')," and then then on ",Object(r.b)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=azure\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 6>\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--provider=keycloak\n--client-id=<client you have created>\n--client-secret=<your client\'s secret>\n--login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"\n--redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"\n--profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n--keycloak-group=<first_allowed_user_group>\n--keycloak-group=<second_allowed_user_group>\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="gitlab"\n    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n    --client-id=GITLAB_CLIENT_ID\n    --client-secret=GITLAB_CLIENT_SECRET\n    --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url="<your gitlab url>"\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n    "https://example.corp.com"\n]\nemail_domains = [\n    "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n    "http://0.0.0.0:8080"\n]\nemail_domains = [\n    "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard.  The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol:  make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer:  do what they say for OpenID Connect.  We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs:  Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle:  Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n  -client-id=${LOGINGOV_ISSUER} \\\n  -redirect-url=http://localhost:4180/oauth2/callback \\\n  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n  -cookie-secure=false \\\n  -email-domain=gsa.gov \\\n  -upstream=http://localhost:3000/ \\\n  -cookie-secret=somerandomstring12341234567890AB \\\n  -cookie-domain=localhost \\\n  -skip-provider-button=true \\\n  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),".  In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"    -provider oidc\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -skip-oidc-discovery\n    -login-url http://127.0.0.1:5556/authorize\n    -redeem-url http://127.0.0.1:5556/token\n    -oidc-jwks-url http://127.0.0.1:5556/keys\n    -cookie-secure=false\n    -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    -provider nextcloud\n    -client-id <from nextcloud admin>\n    -client-secret <from nextcloud admin>\n    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=digitalocean\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"   --provider=bitbucket\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'    --provider="github"\n    --redirect-url="https://<proxied host>/oauth2/callback"\n    --provider-display-name="Gitea"\n    --client-id="< client_id as generated by Gitea >"\n    --client-secret="< client_secret as generated by Gitea >"\n    --login-url="https://< your gitea host >/login/oauth/authorize"\n    --redeem-url="https://< your gitea host >/login/oauth/access_token"\n    --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?i(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):i(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,o,n=function(e,t){if(null==e)return{};var a,o,n={},r=Object.keys(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o<r.length;o++)a=r[o],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p<r;p++)i[p]=a[p];return n.a.createElement.apply(null,i)}return n.a.createElement.apply(null,a)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/8c826f25.19b6a6ee.js b/8c826f25.cf4971b6.js
similarity index 99%
rename from 8c826f25.19b6a6ee.js
rename to 8c826f25.cf4971b6.js
index 3f0196e0..a55fc62f 100644
--- a/8c826f25.19b6a6ee.js
+++ b/8c826f25.cf4971b6.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[20],{77:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),b=(a(0),a(96)),l={id:"overview",title:"Overview"},i={unversionedId:"configuration/overview",id:"version-7.0.x/configuration/overview",isDocsHomePage:!1,title:"Overview",description:"oauth2-proxy can be configured via config file, command line options or environment variables.",source:"@site/versioned_docs/version-7.0.x/configuration/overview.md",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/overview.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"}},c=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[]},{value:"Config File",id:"config-file",children:[]},{value:"Command Line Options",id:"command-line-options",children:[]},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[]},{value:"Environment variables",id:"environment-variables",children:[]},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[]},{value:"Request Log Format",id:"request-log-format",children:[]},{value:"Standard Log Format",id:"standard-log-format",children:[]}]},{value:"Configuring for use with the Nginx <code>auth_request</code> directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables"),"."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-paths")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]<addr>:<port>")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://<path>")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"<addr>:<port>")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"<oauth2>/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://<status_code>")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>\n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),'<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>\n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>\n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n  listen 443 ssl;\n  server_name ...;\n  include ssl/ssl.conf;\n\n  location /oauth2/ {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host                    $host;\n    proxy_set_header X-Real-IP               $remote_addr;\n    proxy_set_header X-Scheme                $scheme;\n    proxy_set_header X-Auth-Request-Redirect $request_uri;\n    # or, if you are handling multiple domains:\n    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n  }\n  location = /oauth2/auth {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host             $host;\n    proxy_set_header X-Real-IP        $remote_addr;\n    proxy_set_header X-Scheme         $scheme;\n    # nginx auth_request includes headers but not body\n    proxy_set_header Content-Length   "";\n    proxy_pass_request_body           off;\n  }\n\n  location / {\n    auth_request /oauth2/auth;\n    error_page 401 = /oauth2/sign_in;\n\n    # pass information via X-User and X-Email headers to backend,\n    # requires running with --set-xauthrequest flag\n    auth_request_set $user   $upstream_http_x_auth_request_user;\n    auth_request_set $email  $upstream_http_x_auth_request_email;\n    proxy_set_header X-User  $user;\n    proxy_set_header X-Email $email;\n\n    # if you enabled --pass-access-token, this will pass the token to the backend\n    auth_request_set $token  $upstream_http_x_auth_request_access_token;\n    proxy_set_header X-Access-Token $token;\n\n    # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n    auth_request_set $auth_cookie $upstream_http_set_cookie;\n    add_header Set-Cookie $auth_cookie;\n\n    # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n    # limit and so the OAuth2 Proxy splits these into multiple parts.\n    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n    # Extract the Cookie attributes from the first Set-Cookie header and append them\n    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n    if ($auth_cookie ~* "(; .*)") {\n        set $auth_cookie_name_0 $auth_cookie;\n        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n    }\n\n    # Send both Set-Cookie headers now if there was a second part\n    if ($auth_cookie_name_upstream_1) {\n        add_header Set-Cookie $auth_cookie_name_0;\n        add_header Set-Cookie $auth_cookie_name_1;\n    }\n\n    proxy_pass http://backend/;\n    # or "root /path/to/site;" or "fastcgi_pass ..." etc\n  }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n  auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n  access_by_lua_block {\n    if ngx.var.name_upstream_1 ~= "" then\n      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n    end\n  }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service:\n      rule: "Host(`a-service.example.com`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-errors\n        - oauth-auth\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth:\n      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n    oauth-errors:\n      errors:\n        status:\n          - "401-403"\n        service: oauth-backend\n        query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service-route-1:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    a-service-route-2:\n      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-wo-redirect # unauthenticated session will return a 401\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    services-oauth2-route:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth2-proxy-route:\n      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    b-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.3:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n    oauth-auth-wo-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),O=n,j=p["".concat(l,".").concat(O)]||p[O]||s[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}O.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[20],{77:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),b=(a(0),a(95)),l={id:"overview",title:"Overview"},i={unversionedId:"configuration/overview",id:"version-7.0.x/configuration/overview",isDocsHomePage:!1,title:"Overview",description:"oauth2-proxy can be configured via config file, command line options or environment variables.",source:"@site/versioned_docs/version-7.0.x/configuration/overview.md",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/overview.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"}},c=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[]},{value:"Config File",id:"config-file",children:[]},{value:"Command Line Options",id:"command-line-options",children:[]},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[]},{value:"Environment variables",id:"environment-variables",children:[]},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[]},{value:"Request Log Format",id:"request-log-format",children:[]},{value:"Standard Log Format",id:"standard-log-format",children:[]}]},{value:"Configuring for use with the Nginx <code>auth_request</code> directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables"),"."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-paths")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]<addr>:<port>")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://<path>")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"<addr>:<port>")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"<oauth2>/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://<status_code>")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>\n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),'<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>\n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>\n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n  listen 443 ssl;\n  server_name ...;\n  include ssl/ssl.conf;\n\n  location /oauth2/ {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host                    $host;\n    proxy_set_header X-Real-IP               $remote_addr;\n    proxy_set_header X-Scheme                $scheme;\n    proxy_set_header X-Auth-Request-Redirect $request_uri;\n    # or, if you are handling multiple domains:\n    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n  }\n  location = /oauth2/auth {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host             $host;\n    proxy_set_header X-Real-IP        $remote_addr;\n    proxy_set_header X-Scheme         $scheme;\n    # nginx auth_request includes headers but not body\n    proxy_set_header Content-Length   "";\n    proxy_pass_request_body           off;\n  }\n\n  location / {\n    auth_request /oauth2/auth;\n    error_page 401 = /oauth2/sign_in;\n\n    # pass information via X-User and X-Email headers to backend,\n    # requires running with --set-xauthrequest flag\n    auth_request_set $user   $upstream_http_x_auth_request_user;\n    auth_request_set $email  $upstream_http_x_auth_request_email;\n    proxy_set_header X-User  $user;\n    proxy_set_header X-Email $email;\n\n    # if you enabled --pass-access-token, this will pass the token to the backend\n    auth_request_set $token  $upstream_http_x_auth_request_access_token;\n    proxy_set_header X-Access-Token $token;\n\n    # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n    auth_request_set $auth_cookie $upstream_http_set_cookie;\n    add_header Set-Cookie $auth_cookie;\n\n    # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n    # limit and so the OAuth2 Proxy splits these into multiple parts.\n    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n    # Extract the Cookie attributes from the first Set-Cookie header and append them\n    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n    if ($auth_cookie ~* "(; .*)") {\n        set $auth_cookie_name_0 $auth_cookie;\n        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n    }\n\n    # Send both Set-Cookie headers now if there was a second part\n    if ($auth_cookie_name_upstream_1) {\n        add_header Set-Cookie $auth_cookie_name_0;\n        add_header Set-Cookie $auth_cookie_name_1;\n    }\n\n    proxy_pass http://backend/;\n    # or "root /path/to/site;" or "fastcgi_pass ..." etc\n  }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n  auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n  access_by_lua_block {\n    if ngx.var.name_upstream_1 ~= "" then\n      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n    end\n  }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service:\n      rule: "Host(`a-service.example.com`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-errors\n        - oauth-auth\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth:\n      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n    oauth-errors:\n      errors:\n        status:\n          - "401-403"\n        service: oauth-backend\n        query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n  routers:\n    a-service-route-1:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    a-service-route-2:\n      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n      service: a-service-backend\n      middlewares:\n        - oauth-auth-wo-redirect # unauthenticated session will return a 401\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    services-oauth2-route:\n      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n    oauth2-proxy-route:\n      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n      middlewares:\n        - auth-headers\n      service: oauth-backend\n      tls:\n        certResolver: default\n        domains:\n          - main: "example.com"\n            sans:\n              - "*.example.com"\n\n  services:\n    a-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.2:7555\n    b-service-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.3:7555\n    oauth-backend:\n      loadBalancer:\n        servers:\n          - url: http://172.16.0.1:4180\n\n  middlewares:\n    auth-headers:\n      headers:\n        sslRedirect: true\n        stsSeconds: 315360000\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        sslHost: example.com\n        stsIncludeSubdomains: true\n        stsPreload: true\n        frameDeny: true\n    oauth-auth-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n    oauth-auth-wo-redirect:\n      forwardAuth:\n        address: https://oauth.example.com/oauth2/auth\n        trustForwardHeader: true\n        authResponseHeaders:\n          - X-Auth-Request-Access-Token\n          - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),O=n,j=p["".concat(l,".").concat(O)]||p[O]||s[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}O.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/935f2afb.86ec86d4.js b/935f2afb.b9b6fa4f.js
similarity index 53%
rename from 935f2afb.86ec86d4.js
rename to 935f2afb.b9b6fa4f.js
index 352c8928..a8bb603b 100644
--- a/935f2afb.86ec86d4.js
+++ b/935f2afb.b9b6fa4f.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[21],{78:function(o){o.exports=JSON.parse('{"pluginId":"default","version":"current","label":"Next","isLast":false,"docsSidebars":{"docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/next/"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/next/behaviour"},{"collapsed":false,"type":"category","label":"Configuration","items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/next/configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/next/configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/next/configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/next/configuration/tls"},{"type":"link","label":"Alpha Configuration","href":"/oauth2-proxy/docs/next/configuration/alpha-config"}]},{"collapsed":false,"type":"category","label":"Features","items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/next/features/endpoints"},{"type":"link","label":"Request Signatures","href":"/oauth2-proxy/docs/next/features/request_signatures"}]},{"collapsed":false,"type":"category","label":"Community","items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/next/community/security"}]}]},"permalinkToSidebar":{"/oauth2-proxy/docs/next/behaviour":"docs","/oauth2-proxy/docs/next/community/security":"docs","/oauth2-proxy/docs/next/configuration/alpha-config":"docs","/oauth2-proxy/docs/next/configuration/oauth_provider":"docs","/oauth2-proxy/docs/next/configuration/overview":"docs","/oauth2-proxy/docs/next/configuration/session_storage":"docs","/oauth2-proxy/docs/next/configuration/tls":"docs","/oauth2-proxy/docs/next/features/endpoints":"docs","/oauth2-proxy/docs/next/features/request_signatures":"docs","/oauth2-proxy/docs/next/":"docs"}}')}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[21],{78:function(o){o.exports=JSON.parse('{"pluginId":"default","version":"current","label":"Next","isLast":false,"docsSidebars":{"docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/next/"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/next/behaviour"},{"collapsed":false,"type":"category","label":"Configuration","items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/next/configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/next/configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/next/configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/next/configuration/tls"},{"type":"link","label":"Alpha Configuration","href":"/oauth2-proxy/docs/next/configuration/alpha-config"}]},{"collapsed":false,"type":"category","label":"Features","items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/next/features/endpoints"}]},{"collapsed":false,"type":"category","label":"Community","items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/next/community/security"}]}]},"permalinkToSidebar":{"/oauth2-proxy/docs/next/behaviour":"docs","/oauth2-proxy/docs/next/community/security":"docs","/oauth2-proxy/docs/next/configuration/alpha-config":"docs","/oauth2-proxy/docs/next/configuration/oauth_provider":"docs","/oauth2-proxy/docs/next/configuration/overview":"docs","/oauth2-proxy/docs/next/configuration/session_storage":"docs","/oauth2-proxy/docs/next/configuration/tls":"docs","/oauth2-proxy/docs/next/features/endpoints":"docs","/oauth2-proxy/docs/next/":"docs"}}')}}]);
\ No newline at end of file
diff --git a/94285305.c1f11fb3.js b/94285305.c77ada9e.js
similarity index 97%
rename from 94285305.c1f11fb3.js
rename to 94285305.c77ada9e.js
index 3d5678fa..0c5c555a 100644
--- a/94285305.c1f11fb3.js
+++ b/94285305.c77ada9e.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[22],{79:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return a})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return s})),r.d(t,"default",(function(){return p}));var n=r(2),o=r(6),i=(r(0),r(96)),a={id:"behaviour",title:"Behaviour"},c={unversionedId:"behaviour",id:"behaviour",isDocsHomePage:!1,title:"Behaviour",description:"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).",source:"@site/docs/behaviour.md",slug:"/behaviour",permalink:"/oauth2-proxy/docs/next/behaviour",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/behaviour.md",version:"current",sidebar:"docs",previous:{title:"Installation",permalink:"/oauth2-proxy/docs/next/"},next:{title:"Overview",permalink:"/oauth2-proxy/docs/next/configuration/overview"}},s=[],u={rightToc:s};function p(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(n.a)({},u,r,{components:t,mdxType:"MDXLayout"}),Object(i.b)("ol",null,Object(i.b)("li",{parentName:"ol"},"Any request passing through the proxy (and not matched by ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-auth-regex"),") is checked for the proxy's session cookie (",Object(i.b)("inlineCode",{parentName:"li"},"--cookie-name"),") (or, if allowed, a JWT token - see ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-jwt-bearer-tokens"),")."),Object(i.b)("li",{parentName:"ol"},"If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with ",Object(i.b)("inlineCode",{parentName:"li"},"Accept: application/json"),", in which case 401 Unauthorized is returned)"),Object(i.b)("li",{parentName:"ol"},"After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set"),Object(i.b)("li",{parentName:"ol"},"The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)")),Object(i.b)("p",null,"Notice that the proxy also provides a number of useful ",Object(i.b)("a",Object(n.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/features/endpoints"}),"endpoints"),"."))}p.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?a(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):a(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function s(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u<i;u++)a[u]=r[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,r)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[22],{79:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return a})),r.d(t,"metadata",(function(){return c})),r.d(t,"rightToc",(function(){return s})),r.d(t,"default",(function(){return p}));var n=r(2),o=r(6),i=(r(0),r(95)),a={id:"behaviour",title:"Behaviour"},c={unversionedId:"behaviour",id:"behaviour",isDocsHomePage:!1,title:"Behaviour",description:"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).",source:"@site/docs/behaviour.md",slug:"/behaviour",permalink:"/oauth2-proxy/docs/next/behaviour",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/behaviour.md",version:"current",sidebar:"docs",previous:{title:"Installation",permalink:"/oauth2-proxy/docs/next/"},next:{title:"Overview",permalink:"/oauth2-proxy/docs/next/configuration/overview"}},s=[],u={rightToc:s};function p(e){var t=e.components,r=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(n.a)({},u,r,{components:t,mdxType:"MDXLayout"}),Object(i.b)("ol",null,Object(i.b)("li",{parentName:"ol"},"Any request passing through the proxy (and not matched by ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-auth-regex"),") is checked for the proxy's session cookie (",Object(i.b)("inlineCode",{parentName:"li"},"--cookie-name"),") (or, if allowed, a JWT token - see ",Object(i.b)("inlineCode",{parentName:"li"},"--skip-jwt-bearer-tokens"),")."),Object(i.b)("li",{parentName:"ol"},"If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with ",Object(i.b)("inlineCode",{parentName:"li"},"Accept: application/json"),", in which case 401 Unauthorized is returned)"),Object(i.b)("li",{parentName:"ol"},"After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set"),Object(i.b)("li",{parentName:"ol"},"The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)")),Object(i.b)("p",null,"Notice that the proxy also provides a number of useful ",Object(i.b)("a",Object(n.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/features/endpoints"}),"endpoints"),"."))}p.isMDXComponent=!0},95:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?a(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):a(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function s(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u<i;u++)a[u]=r[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,r)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/9f61b932.52eb58d3.js b/9f61b932.18ede719.js
similarity index 98%
rename from 9f61b932.52eb58d3.js
rename to 9f61b932.18ede719.js
index 6aca4b18..91cd0844 100644
--- a/9f61b932.52eb58d3.js
+++ b/9f61b932.18ede719.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[23],{80:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return u}));var r=n(2),i=n(6),o=(n(0),n(96)),a={id:"session_storage",title:"Session Storage"},s={unversionedId:"configuration/session_storage",id:"configuration/session_storage",isDocsHomePage:!1,title:"Session Storage",description:"Sessions allow a user's authentication to be tracked between multiple HTTP",source:"@site/docs/configuration/sessions.md",slug:"/configuration/session_storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/sessions.md",version:"current",sidebar:"docs",previous:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider"},next:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/next/configuration/tls"}},c=[{value:"Cookie Storage",id:"cookie-storage",children:[]},{value:"Redis Storage",id:"redis-storage",children:[]}],l={rightToc:c};function u(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"Sessions allow a user's authentication to be tracked between multiple HTTP\nrequests to a service."),Object(o.b)("p",null,"The OAuth2 Proxy uses a Cookie to track user sessions and will store the session\ndata in one of the available session storage backends."),Object(o.b)("p",null,"At present the available backends are (as passed to ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type"),"):"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"#cookie-storage"}),"cookie")," (default)"),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"#redis-storage"}),"redis"))),Object(o.b)("h3",{id:"cookie-storage"},"Cookie Storage"),Object(o.b)("p",null,"The Cookie storage backend is the default backend implementation and has\nbeen used in the OAuth2 Proxy historically."),Object(o.b)("p",null,"With the Cookie storage backend, all session information is stored in client\nside cookies and transferred with each and every request."),Object(o.b)("p",null,"The following should be known when using this implementation:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless"),Object(o.b)("li",{parentName:"ul"},"Cookies are signed server side to prevent modification client-side"),Object(o.b)("li",{parentName:"ul"},"It is mandatory to set a ",Object(o.b)("inlineCode",{parentName:"li"},"cookie-secret")," which will ensure data is encrypted within the cookie data."),Object(o.b)("li",{parentName:"ul"},"Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation\ncannot lock sessions and while updating and refreshing sessions, there can be conflicts which force\nusers to re-authenticate")),Object(o.b)("h3",{id:"redis-storage"},"Redis Storage"),Object(o.b)("p",null,"The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information\nback the the client for storage, as in the ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"#cookie-storage"}),"Cookie storage"),", a ticket is sent back\nto the user as the cookie value instead."),Object(o.b)("p",null,"A ticket is composed as the following:"),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"{CookieName}-{ticketID}.{secret}")),Object(o.b)("p",null,"Where:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"CookieName")," is the OAuth2 cookie name (_oauth2_proxy by default)"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"ticketID")," is a 128 bit random number, hex-encoded"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"secret")," is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session."),Object(o.b)("li",{parentName:"ul"},"The pair of ",Object(o.b)("inlineCode",{parentName:"li"},"{CookieName}-{ticketID}")," comprises a ticket handle, and thus, the redis key\nto which the session is stored. The encoded session is encrypted with the secret and stored\nin redis via the ",Object(o.b)("inlineCode",{parentName:"li"},"SETEX")," command.")),Object(o.b)("p",null,"Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from\ndisclosure."),Object(o.b)("h4",{id:"usage"},"Usage"),Object(o.b)("p",null,"When using the redis store, specify ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," as well as the Redis connection URL, via\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-connection-url=redis://host[:port][/db-number]"),"."),Object(o.b)("p",null,"You may also configure the store for Redis Sentinel. In this case, you will want to use the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," flag, as well as configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-master-name"),"\nand ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-connection-urls")," appropriately."),Object(o.b)("p",null,"Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," flag, and configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-cluster-connection-urls")," appropriately."),Object(o.b)("p",null,"Note that flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," and ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," are mutually exclusive."))}u.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return h}));var r=n(0),i=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=i.a.createContext({}),u=function(e){var t=i.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return i.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},p=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=r,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?i.a.createElement(h,s(s({ref:t},l),{},{components:n})):i.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var l=2;l<o;l++)a[l]=n[l];return i.a.createElement.apply(null,a)}return i.a.createElement.apply(null,n)}p.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[23],{80:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return u}));var r=n(2),i=n(6),o=(n(0),n(95)),a={id:"session_storage",title:"Session Storage"},s={unversionedId:"configuration/session_storage",id:"configuration/session_storage",isDocsHomePage:!1,title:"Session Storage",description:"Sessions allow a user's authentication to be tracked between multiple HTTP",source:"@site/docs/configuration/sessions.md",slug:"/configuration/session_storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/sessions.md",version:"current",sidebar:"docs",previous:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider"},next:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/next/configuration/tls"}},c=[{value:"Cookie Storage",id:"cookie-storage",children:[]},{value:"Redis Storage",id:"redis-storage",children:[]}],l={rightToc:c};function u(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"Sessions allow a user's authentication to be tracked between multiple HTTP\nrequests to a service."),Object(o.b)("p",null,"The OAuth2 Proxy uses a Cookie to track user sessions and will store the session\ndata in one of the available session storage backends."),Object(o.b)("p",null,"At present the available backends are (as passed to ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type"),"):"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"#cookie-storage"}),"cookie")," (default)"),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(r.a)({parentName:"li"},{href:"#redis-storage"}),"redis"))),Object(o.b)("h3",{id:"cookie-storage"},"Cookie Storage"),Object(o.b)("p",null,"The Cookie storage backend is the default backend implementation and has\nbeen used in the OAuth2 Proxy historically."),Object(o.b)("p",null,"With the Cookie storage backend, all session information is stored in client\nside cookies and transferred with each and every request."),Object(o.b)("p",null,"The following should be known when using this implementation:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless"),Object(o.b)("li",{parentName:"ul"},"Cookies are signed server side to prevent modification client-side"),Object(o.b)("li",{parentName:"ul"},"It is mandatory to set a ",Object(o.b)("inlineCode",{parentName:"li"},"cookie-secret")," which will ensure data is encrypted within the cookie data."),Object(o.b)("li",{parentName:"ul"},"Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation\ncannot lock sessions and while updating and refreshing sessions, there can be conflicts which force\nusers to re-authenticate")),Object(o.b)("h3",{id:"redis-storage"},"Redis Storage"),Object(o.b)("p",null,"The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information\nback the the client for storage, as in the ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"#cookie-storage"}),"Cookie storage"),", a ticket is sent back\nto the user as the cookie value instead."),Object(o.b)("p",null,"A ticket is composed as the following:"),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"{CookieName}-{ticketID}.{secret}")),Object(o.b)("p",null,"Where:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"CookieName")," is the OAuth2 cookie name (_oauth2_proxy by default)"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"ticketID")," is a 128 bit random number, hex-encoded"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"secret")," is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session."),Object(o.b)("li",{parentName:"ul"},"The pair of ",Object(o.b)("inlineCode",{parentName:"li"},"{CookieName}-{ticketID}")," comprises a ticket handle, and thus, the redis key\nto which the session is stored. The encoded session is encrypted with the secret and stored\nin redis via the ",Object(o.b)("inlineCode",{parentName:"li"},"SETEX")," command.")),Object(o.b)("p",null,"Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from\ndisclosure."),Object(o.b)("h4",{id:"usage"},"Usage"),Object(o.b)("p",null,"When using the redis store, specify ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," as well as the Redis connection URL, via\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-connection-url=redis://host[:port][/db-number]"),"."),Object(o.b)("p",null,"You may also configure the store for Redis Sentinel. In this case, you will want to use the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," flag, as well as configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-master-name"),"\nand ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-connection-urls")," appropriately."),Object(o.b)("p",null,"Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," flag, and configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-cluster-connection-urls")," appropriately."),Object(o.b)("p",null,"Note that flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," and ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," are mutually exclusive."))}u.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return h}));var r=n(0),i=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=i.a.createContext({}),u=function(e){var t=i.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return i.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},p=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=r,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?i.a.createElement(h,s(s({ref:t},l),{},{components:n})):i.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var l=2;l<o;l++)a[l]=n[l];return i.a.createElement.apply(null,a)}return i.a.createElement.apply(null,n)}p.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/a37c03cb.cb23f5eb.js b/a37c03cb.cd2174f2.js
similarity index 98%
rename from a37c03cb.cb23f5eb.js
rename to a37c03cb.cd2174f2.js
index 3e3b04f0..e740b677 100644
--- a/a37c03cb.cb23f5eb.js
+++ b/a37c03cb.cd2174f2.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[24],{81:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return s}));var r=n(2),o=n(6),a=(n(0),n(96)),i={id:"tls",title:"TLS Configuration"},c={unversionedId:"configuration/tls",id:"version-6.1.x/configuration/tls",isDocsHomePage:!1,title:"TLS Configuration",description:"There are two recommended configurations.",source:"@site/versioned_docs/version-6.1.x/configuration/tls.md",slug:"/configuration/tls",permalink:"/oauth2-proxy/docs/6.1.x/configuration/tls",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/tls.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Session Storage",permalink:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/6.1.x/features/endpoints"}},p=[],l={rightToc:p};function s(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("p",null,"There are two recommended configurations."),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with OAuth2 Proxy by providing a ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-cert-file=/path/to/cert.pem")," and ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-key-file=/path/to/cert.key"),"."),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n    --email-domain="yourcompany.com"  \\\n    --upstream=http://127.0.0.1:8080/ \\\n    --tls-cert-file=/path/to/cert.pem \\\n    --tls-key-file=/path/to/cert.key \\\n    --cookie-secret=... \\\n    --cookie-secure=true \\\n    --provider=... \\\n    --client-id=... \\\n    --client-secret=...\n'))),Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://nginx.org/"}),"Nginx")," (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...."),Object(a.b)("p",{parentName:"li"},"Because ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," listens on ",Object(a.b)("inlineCode",{parentName:"p"},"127.0.0.1:4180")," by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use ",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="0.0.0.0:4180"')," or\n",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="http://:4180"'),"."),Object(a.b)("p",{parentName:"li"},"Nginx will listen on port ",Object(a.b)("inlineCode",{parentName:"p"},"443")," and handle SSL connections while proxying to ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on port ",Object(a.b)("inlineCode",{parentName:"p"},"4180"),".\n",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," will then authenticate requests for an upstream application. The external endpoint for this example\nwould be ",Object(a.b)("inlineCode",{parentName:"p"},"https://internal.yourcompany.com/"),"."),Object(a.b)("p",{parentName:"li"},"An example Nginx config follows. Note the use of ",Object(a.b)("inlineCode",{parentName:"p"},"Strict-Transport-Security")," header to pin requests to SSL\nvia ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security"}),"HSTS"),":"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{}),"server {\n    listen 443 default ssl;\n    server_name internal.yourcompany.com;\n    ssl_certificate /path/to/cert.pem;\n    ssl_certificate_key /path/to/cert.key;\n    add_header Strict-Transport-Security max-age=2592000;\n\n    location / {\n        proxy_pass http://127.0.0.1:4180;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Scheme $scheme;\n        proxy_connect_timeout 1;\n        proxy_send_timeout 30;\n        proxy_read_timeout 30;\n    }\n}\n")),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n   --email-domain="yourcompany.com"  \\\n   --upstream=http://127.0.0.1:8080/ \\\n   --cookie-secret=... \\\n   --cookie-secure=true \\\n   --provider=... \\\n   --reverse-proxy=true \\\n   --client-id=... \\\n   --client-secret=...\n')))))}s.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<a;l++)i[l]=n[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[24],{81:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return s}));var r=n(2),o=n(6),a=(n(0),n(95)),i={id:"tls",title:"TLS Configuration"},c={unversionedId:"configuration/tls",id:"version-6.1.x/configuration/tls",isDocsHomePage:!1,title:"TLS Configuration",description:"There are two recommended configurations.",source:"@site/versioned_docs/version-6.1.x/configuration/tls.md",slug:"/configuration/tls",permalink:"/oauth2-proxy/docs/6.1.x/configuration/tls",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/tls.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Session Storage",permalink:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/6.1.x/features/endpoints"}},p=[],l={rightToc:p};function s(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("p",null,"There are two recommended configurations."),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with OAuth2 Proxy by providing a ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-cert-file=/path/to/cert.pem")," and ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-key-file=/path/to/cert.key"),"."),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n    --email-domain="yourcompany.com"  \\\n    --upstream=http://127.0.0.1:8080/ \\\n    --tls-cert-file=/path/to/cert.pem \\\n    --tls-key-file=/path/to/cert.key \\\n    --cookie-secret=... \\\n    --cookie-secure=true \\\n    --provider=... \\\n    --client-id=... \\\n    --client-secret=...\n'))),Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://nginx.org/"}),"Nginx")," (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...."),Object(a.b)("p",{parentName:"li"},"Because ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," listens on ",Object(a.b)("inlineCode",{parentName:"p"},"127.0.0.1:4180")," by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use ",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="0.0.0.0:4180"')," or\n",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="http://:4180"'),"."),Object(a.b)("p",{parentName:"li"},"Nginx will listen on port ",Object(a.b)("inlineCode",{parentName:"p"},"443")," and handle SSL connections while proxying to ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on port ",Object(a.b)("inlineCode",{parentName:"p"},"4180"),".\n",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," will then authenticate requests for an upstream application. The external endpoint for this example\nwould be ",Object(a.b)("inlineCode",{parentName:"p"},"https://internal.yourcompany.com/"),"."),Object(a.b)("p",{parentName:"li"},"An example Nginx config follows. Note the use of ",Object(a.b)("inlineCode",{parentName:"p"},"Strict-Transport-Security")," header to pin requests to SSL\nvia ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security"}),"HSTS"),":"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{}),"server {\n    listen 443 default ssl;\n    server_name internal.yourcompany.com;\n    ssl_certificate /path/to/cert.pem;\n    ssl_certificate_key /path/to/cert.key;\n    add_header Strict-Transport-Security max-age=2592000;\n\n    location / {\n        proxy_pass http://127.0.0.1:4180;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Scheme $scheme;\n        proxy_connect_timeout 1;\n        proxy_send_timeout 30;\n        proxy_read_timeout 30;\n    }\n}\n")),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n   --email-domain="yourcompany.com"  \\\n   --upstream=http://127.0.0.1:8080/ \\\n   --cookie-secret=... \\\n   --cookie-secure=true \\\n   --provider=... \\\n   --reverse-proxy=true \\\n   --client-id=... \\\n   --client-secret=...\n')))))}s.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function p(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l<a;l++)i[l]=n[l];return o.a.createElement.apply(null,i)}return o.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/a991188b.3c713607.js b/a991188b.462763a5.js
similarity index 98%
rename from a991188b.3c713607.js
rename to a991188b.462763a5.js
index 2e94dc54..2d0bcc43 100644
--- a/a991188b.3c713607.js
+++ b/a991188b.462763a5.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[25],{82:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return s})),n.d(t,"default",(function(){return p}));var r=n(2),o=n(6),i=(n(0),n(96)),a={id:"endpoints",title:"Endpoints"},c={unversionedId:"features/endpoints",id:"version-6.1.x/features/endpoints",isDocsHomePage:!1,title:"Endpoints",description:"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.",source:"@site/versioned_docs/version-6.1.x/features/endpoints.md",slug:"/features/endpoints",permalink:"/oauth2-proxy/docs/6.1.x/features/endpoints",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/endpoints.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/tls"},next:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/6.1.x/features/request_signatures"}},s=[{value:"Sign out",id:"sign-out",children:[]}],u={rightToc:s};function p(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(i.b)("p",null,"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2")," prefix can be changed with the ",Object(i.b)("inlineCode",{parentName:"p"},"--proxy-prefix")," config variable."),Object(i.b)("ul",null,Object(i.b)("li",{parentName:"ul"},"/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"http://www.robotstxt.org/"}),"robotstxt.org")," for more info"),Object(i.b)("li",{parentName:"ul"},"/ping - returns a 200 OK response, which is intended for use with health checks"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_out - this URL is used to clear the session cookie"),Object(i.b)("li",{parentName:"ul"},"/oauth2/start - a URL that will redirect to start the OAuth cycle"),Object(i.b)("li",{parentName:"ul"},"/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url."),Object(i.b)("li",{parentName:"ul"},"/oauth2/userinfo - the URL is used to return user's email from the session in JSON format."),Object(i.b)("li",{parentName:"ul"},"/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive"}),"Nginx ",Object(i.b)("inlineCode",{parentName:"a"},"auth_request")," directive"))),Object(i.b)("h3",{id:"sign-out"},"Sign out"),Object(i.b)("p",null,"To sign the user out, redirect them to ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2/sign_out"),". This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the ",Object(i.b)("inlineCode",{parentName:"p"},"rd")," query parameter, i.e. redirect the user to something like (notice the url-encoding!):"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page\n")),Object(i.b)("p",null,"Alternatively, include the redirect URL in the ",Object(i.b)("inlineCode",{parentName:"p"},"X-Auth-Request-Redirect")," header:"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"GET /oauth2/sign_out HTTP/1.1\nX-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page\n...\n")),Object(i.b)("p",null,'(The "sign_out_page" should be the ',Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1"}),Object(i.b)("inlineCode",{parentName:"a"},"end_session_endpoint"))," from ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig"}),"the metadata")," if your OIDC provider supports Session Management and Discovery.)"),Object(i.b)("p",null,"BEWARE that the domain you want to redirect to (",Object(i.b)("inlineCode",{parentName:"p"},"my-oidc-provider.example.com")," in the example) must be added to the ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"../configuration/overview"}),Object(i.b)("inlineCode",{parentName:"a"},"--whitelist-domain"))," configuration option otherwise the redirect will be ignored."))}p.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u<i;u++)a[u]=n[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,n)}h.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[25],{82:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return s})),n.d(t,"default",(function(){return p}));var r=n(2),o=n(6),i=(n(0),n(95)),a={id:"endpoints",title:"Endpoints"},c={unversionedId:"features/endpoints",id:"version-6.1.x/features/endpoints",isDocsHomePage:!1,title:"Endpoints",description:"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.",source:"@site/versioned_docs/version-6.1.x/features/endpoints.md",slug:"/features/endpoints",permalink:"/oauth2-proxy/docs/6.1.x/features/endpoints",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/endpoints.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/tls"},next:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/6.1.x/features/request_signatures"}},s=[{value:"Sign out",id:"sign-out",children:[]}],u={rightToc:s};function p(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(i.b)("p",null,"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2")," prefix can be changed with the ",Object(i.b)("inlineCode",{parentName:"p"},"--proxy-prefix")," config variable."),Object(i.b)("ul",null,Object(i.b)("li",{parentName:"ul"},"/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"http://www.robotstxt.org/"}),"robotstxt.org")," for more info"),Object(i.b)("li",{parentName:"ul"},"/ping - returns a 200 OK response, which is intended for use with health checks"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_out - this URL is used to clear the session cookie"),Object(i.b)("li",{parentName:"ul"},"/oauth2/start - a URL that will redirect to start the OAuth cycle"),Object(i.b)("li",{parentName:"ul"},"/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url."),Object(i.b)("li",{parentName:"ul"},"/oauth2/userinfo - the URL is used to return user's email from the session in JSON format."),Object(i.b)("li",{parentName:"ul"},"/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive"}),"Nginx ",Object(i.b)("inlineCode",{parentName:"a"},"auth_request")," directive"))),Object(i.b)("h3",{id:"sign-out"},"Sign out"),Object(i.b)("p",null,"To sign the user out, redirect them to ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2/sign_out"),". This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the ",Object(i.b)("inlineCode",{parentName:"p"},"rd")," query parameter, i.e. redirect the user to something like (notice the url-encoding!):"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page\n")),Object(i.b)("p",null,"Alternatively, include the redirect URL in the ",Object(i.b)("inlineCode",{parentName:"p"},"X-Auth-Request-Redirect")," header:"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"GET /oauth2/sign_out HTTP/1.1\nX-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page\n...\n")),Object(i.b)("p",null,'(The "sign_out_page" should be the ',Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1"}),Object(i.b)("inlineCode",{parentName:"a"},"end_session_endpoint"))," from ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig"}),"the metadata")," if your OIDC provider supports Session Management and Discovery.)"),Object(i.b)("p",null,"BEWARE that the domain you want to redirect to (",Object(i.b)("inlineCode",{parentName:"p"},"my-oidc-provider.example.com")," in the example) must be added to the ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"../configuration/overview"}),Object(i.b)("inlineCode",{parentName:"a"},"--whitelist-domain"))," configuration option otherwise the redirect will be ignored."))}p.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u<i;u++)a[u]=n[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,n)}h.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/ade45c9a.0673a20d.js b/ade45c9a.6b8ce017.js
similarity index 99%
rename from ade45c9a.0673a20d.js
rename to ade45c9a.6b8ce017.js
index e12892f0..d727b3b3 100644
--- a/ade45c9a.0673a20d.js
+++ b/ade45c9a.6b8ce017.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[26],{83:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),b=(a(0),a(96)),l={id:"overview",title:"Overview"},i={unversionedId:"configuration/overview",id:"version-6.1.x/configuration/overview",isDocsHomePage:!1,title:"Overview",description:"oauth2-proxy can be configured via config file, command line options or environment variables.",source:"@site/versioned_docs/version-6.1.x/configuration/overview.md",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/6.1.x/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/overview.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/6.1.x/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"}},c=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[]},{value:"Config File",id:"config-file",children:[]},{value:"Command Line Options",id:"command-line-options",children:[]},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[]},{value:"Environment variables",id:"environment-variables",children:[]},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[]},{value:"Request Log Format",id:"request-log-format",children:[]},{value:"Standard Log Format",id:"standard-log-format",children:[]}]},{value:"Configuring for use with the Nginx <code>auth_request</code> directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables"),"."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-paths")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -s")," for SHA encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]<addr>:<port>")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://<path>")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"<addr>:<port>")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"<oauth2>/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy for request paths in ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://<status_code>")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--user-id-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which claim contains the user ID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"[",'"email"',"]")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>\n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),'<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>\n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>\n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n  listen 443 ssl;\n  server_name ...;\n  include ssl/ssl.conf;\n\n  location /oauth2/ {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host                    $host;\n    proxy_set_header X-Real-IP               $remote_addr;\n    proxy_set_header X-Scheme                $scheme;\n    proxy_set_header X-Auth-Request-Redirect $request_uri;\n    # or, if you are handling multiple domains:\n    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n  }\n  location = /oauth2/auth {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host             $host;\n    proxy_set_header X-Real-IP        $remote_addr;\n    proxy_set_header X-Scheme         $scheme;\n    # nginx auth_request includes headers but not body\n    proxy_set_header Content-Length   "";\n    proxy_pass_request_body           off;\n  }\n\n  location / {\n    auth_request /oauth2/auth;\n    error_page 401 = /oauth2/sign_in;\n\n    # pass information via X-User and X-Email headers to backend,\n    # requires running with --set-xauthrequest flag\n    auth_request_set $user   $upstream_http_x_auth_request_user;\n    auth_request_set $email  $upstream_http_x_auth_request_email;\n    proxy_set_header X-User  $user;\n    proxy_set_header X-Email $email;\n\n    # if you enabled --pass-access-token, this will pass the token to the backend\n    auth_request_set $token  $upstream_http_x_auth_request_access_token;\n    proxy_set_header X-Access-Token $token;\n\n    # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n    auth_request_set $auth_cookie $upstream_http_set_cookie;\n    add_header Set-Cookie $auth_cookie;\n\n    # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n    # limit and so the OAuth2 Proxy splits these into multiple parts.\n    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n    # Extract the Cookie attributes from the first Set-Cookie header and append them\n    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n    if ($auth_cookie ~* "(; .*)") {\n        set $auth_cookie_name_0 $auth_cookie;\n        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n    }\n\n    # Send both Set-Cookie headers now if there was a second part\n    if ($auth_cookie_name_upstream_1) {\n        add_header Set-Cookie $auth_cookie_name_0;\n        add_header Set-Cookie $auth_cookie_name_1;\n    }\n\n    proxy_pass http://backend/;\n    # or "root /path/to/site;" or "fastcgi_pass ..." etc\n  }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n  auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n  access_by_lua_block {\n    if ngx.var.name_upstream_1 ~= "" then\n      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n    end\n  }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return O})),a.d(t,"b",(function(){return m}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},O=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},j=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),O=d(a),j=n,m=O["".concat(l,".").concat(j)]||O[j]||p[j]||b;return a?r.a.createElement(m,i(i({ref:t},o),{},{components:a})):r.a.createElement(m,i({ref:t},o))}));function m(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=j;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}j.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[26],{83:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),b=(a(0),a(95)),l={id:"overview",title:"Overview"},i={unversionedId:"configuration/overview",id:"version-6.1.x/configuration/overview",isDocsHomePage:!1,title:"Overview",description:"oauth2-proxy can be configured via config file, command line options or environment variables.",source:"@site/versioned_docs/version-6.1.x/configuration/overview.md",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/6.1.x/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/overview.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/6.1.x/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"}},c=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[]},{value:"Config File",id:"config-file",children:[]},{value:"Command Line Options",id:"command-line-options",children:[]},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[]},{value:"Environment variables",id:"environment-variables",children:[]},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[]},{value:"Request Log Format",id:"request-log-format",children:[]},{value:"Standard Log Format",id:"standard-log-format",children:[]}]},{value:"Configuring for use with the Nginx <code>auth_request</code> directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables"),"."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-paths")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -s")," for SHA encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]<addr>:<port>")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://<path>")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"<addr>:<port>")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"<oauth2>/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy for request paths in ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://<status_code>")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--user-id-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which claim contains the user ID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"[",'"email"',"]")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>\n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),'<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>\n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>\n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n  listen 443 ssl;\n  server_name ...;\n  include ssl/ssl.conf;\n\n  location /oauth2/ {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host                    $host;\n    proxy_set_header X-Real-IP               $remote_addr;\n    proxy_set_header X-Scheme                $scheme;\n    proxy_set_header X-Auth-Request-Redirect $request_uri;\n    # or, if you are handling multiple domains:\n    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n  }\n  location = /oauth2/auth {\n    proxy_pass       http://127.0.0.1:4180;\n    proxy_set_header Host             $host;\n    proxy_set_header X-Real-IP        $remote_addr;\n    proxy_set_header X-Scheme         $scheme;\n    # nginx auth_request includes headers but not body\n    proxy_set_header Content-Length   "";\n    proxy_pass_request_body           off;\n  }\n\n  location / {\n    auth_request /oauth2/auth;\n    error_page 401 = /oauth2/sign_in;\n\n    # pass information via X-User and X-Email headers to backend,\n    # requires running with --set-xauthrequest flag\n    auth_request_set $user   $upstream_http_x_auth_request_user;\n    auth_request_set $email  $upstream_http_x_auth_request_email;\n    proxy_set_header X-User  $user;\n    proxy_set_header X-Email $email;\n\n    # if you enabled --pass-access-token, this will pass the token to the backend\n    auth_request_set $token  $upstream_http_x_auth_request_access_token;\n    proxy_set_header X-Access-Token $token;\n\n    # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n    auth_request_set $auth_cookie $upstream_http_set_cookie;\n    add_header Set-Cookie $auth_cookie;\n\n    # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n    # limit and so the OAuth2 Proxy splits these into multiple parts.\n    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n    # Extract the Cookie attributes from the first Set-Cookie header and append them\n    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n    if ($auth_cookie ~* "(; .*)") {\n        set $auth_cookie_name_0 $auth_cookie;\n        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n    }\n\n    # Send both Set-Cookie headers now if there was a second part\n    if ($auth_cookie_name_upstream_1) {\n        add_header Set-Cookie $auth_cookie_name_0;\n        add_header Set-Cookie $auth_cookie_name_1;\n    }\n\n    proxy_pass http://backend/;\n    # or "root /path/to/site;" or "fastcgi_pass ..." etc\n  }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n  auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n  access_by_lua_block {\n    if ngx.var.name_upstream_1 ~= "" then\n      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n    end\n  }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return O})),a.d(t,"b",(function(){return m}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},O=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},j=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),O=d(a),j=n,m=O["".concat(l,".").concat(j)]||O[j]||p[j]||b;return a?r.a.createElement(m,i(i({ref:t},o),{},{components:a})):r.a.createElement(m,i({ref:t},o))}));function m(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=j;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}j.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/b5649f1e.3a95cf7b.js b/b5649f1e.3a95cf7b.js
deleted file mode 100644
index 425db9db..00000000
--- a/b5649f1e.3a95cf7b.js
+++ /dev/null
@@ -1 +0,0 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[27],{84:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return s})),r.d(t,"rightToc",(function(){return u})),r.d(t,"default",(function(){return p}));var n=r(2),a=r(6),o=(r(0),r(96)),i={id:"request_signatures",title:"Request Signatures"},s={unversionedId:"features/request_signatures",id:"features/request_signatures",isDocsHomePage:!1,title:"Request Signatures",description:"If signature_key is defined, proxied requests will be signed with the",source:"@site/docs/features/request_signatures.md",slug:"/features/request_signatures",permalink:"/oauth2-proxy/docs/next/features/request_signatures",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/request_signatures.md",version:"current",sidebar:"docs",previous:{title:"Endpoints",permalink:"/oauth2-proxy/docs/next/features/endpoints"},next:{title:"Security",permalink:"/oauth2-proxy/docs/next/community/security"}},u=[],c={rightToc:u};function p(e){var t=e.components,r=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(n.a)({},c,r,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"If ",Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," is defined, proxied requests will be signed with the\n",Object(o.b)("inlineCode",{parentName:"p"},"GAP-Signature")," header, which is a ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://en.wikipedia.org/wiki/Hash-based_message_authentication_code"}),"Hash-based Message Authentication Code\n(HMAC)"),"\nof selected request information and the request body ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go"}),"see ",Object(o.b)("inlineCode",{parentName:"a"},"SIGNATURE_HEADERS"),"\nin ",Object(o.b)("inlineCode",{parentName:"a"},"oauthproxy.go")),"."),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," must be of the form ",Object(o.b)("inlineCode",{parentName:"p"},"algorithm:secretkey"),", (ie: ",Object(o.b)("inlineCode",{parentName:"p"},'signature_key = "sha1:secret0"'),")"),Object(o.b)("p",null,"For more information about HMAC request signature validation, read the\nfollowing:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html"}),"Amazon Web Services: Signing and Authenticating REST\nRequests")),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/"}),"rc3.org: Using HMAC to authenticate Web service\nrequests"))))}p.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){o(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function u(e,t){if(null==e)return{};var r,n,a=function(e,t){if(null==e)return{};var r,n,a={},o=Object.keys(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var c=a.a.createContext({}),p=function(e){var t=a.a.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},l=function(e){var t=p(e.components);return a.a.createElement(c.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,c=u(e,["components","mdxType","originalType","parentName"]),l=p(r),d=n,f=l["".concat(i,".").concat(d)]||l[d]||b[d]||o;return r?a.a.createElement(f,s(s({ref:t},c),{},{components:r})):a.a.createElement(f,s({ref:t},c))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:n,i[1]=s;for(var c=2;c<o;c++)i[c]=r[c];return a.a.createElement.apply(null,i)}return a.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/b89e1cb0.3196bbbd.js b/b89e1cb0.4d7a9b41.js
similarity index 96%
rename from b89e1cb0.3196bbbd.js
rename to b89e1cb0.4d7a9b41.js
index fbf94dc9..b885b2c9 100644
--- a/b89e1cb0.3196bbbd.js
+++ b/b89e1cb0.4d7a9b41.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[28],{85:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return s})),r.d(t,"rightToc",(function(){return u})),r.d(t,"default",(function(){return p}));var n=r(2),a=r(6),o=(r(0),r(96)),i={id:"request_signatures",title:"Request Signatures"},s={unversionedId:"features/request_signatures",id:"version-7.0.x/features/request_signatures",isDocsHomePage:!1,title:"Request Signatures",description:"If signature_key is defined, proxied requests will be signed with the",source:"@site/versioned_docs/version-7.0.x/features/request_signatures.md",slug:"/features/request_signatures",permalink:"/oauth2-proxy/docs/features/request_signatures",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/request_signatures.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Endpoints",permalink:"/oauth2-proxy/docs/features/endpoints"},next:{title:"Security",permalink:"/oauth2-proxy/docs/community/security"}},u=[],c={rightToc:u};function p(e){var t=e.components,r=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(n.a)({},c,r,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"If ",Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," is defined, proxied requests will be signed with the\n",Object(o.b)("inlineCode",{parentName:"p"},"GAP-Signature")," header, which is a ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://en.wikipedia.org/wiki/Hash-based_message_authentication_code"}),"Hash-based Message Authentication Code\n(HMAC)"),"\nof selected request information and the request body ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go"}),"see ",Object(o.b)("inlineCode",{parentName:"a"},"SIGNATURE_HEADERS"),"\nin ",Object(o.b)("inlineCode",{parentName:"a"},"oauthproxy.go")),"."),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," must be of the form ",Object(o.b)("inlineCode",{parentName:"p"},"algorithm:secretkey"),", (ie: ",Object(o.b)("inlineCode",{parentName:"p"},'signature_key = "sha1:secret0"'),")"),Object(o.b)("p",null,"For more information about HMAC request signature validation, read the\nfollowing:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html"}),"Amazon Web Services: Signing and Authenticating REST\nRequests")),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/"}),"rc3.org: Using HMAC to authenticate Web service\nrequests"))))}p.isMDXComponent=!0},96:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){o(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function u(e,t){if(null==e)return{};var r,n,a=function(e,t){if(null==e)return{};var r,n,a={},o=Object.keys(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var c=a.a.createContext({}),p=function(e){var t=a.a.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},l=function(e){var t=p(e.components);return a.a.createElement(c.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,c=u(e,["components","mdxType","originalType","parentName"]),l=p(r),d=n,f=l["".concat(i,".").concat(d)]||l[d]||b[d]||o;return r?a.a.createElement(f,s(s({ref:t},c),{},{components:r})):a.a.createElement(f,s({ref:t},c))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:n,i[1]=s;for(var c=2;c<o;c++)i[c]=r[c];return a.a.createElement.apply(null,i)}return a.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[27],{84:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return s})),r.d(t,"rightToc",(function(){return u})),r.d(t,"default",(function(){return p}));var n=r(2),a=r(6),o=(r(0),r(95)),i={id:"request_signatures",title:"Request Signatures"},s={unversionedId:"features/request_signatures",id:"version-7.0.x/features/request_signatures",isDocsHomePage:!1,title:"Request Signatures",description:"If signature_key is defined, proxied requests will be signed with the",source:"@site/versioned_docs/version-7.0.x/features/request_signatures.md",slug:"/features/request_signatures",permalink:"/oauth2-proxy/docs/features/request_signatures",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/request_signatures.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Endpoints",permalink:"/oauth2-proxy/docs/features/endpoints"},next:{title:"Security",permalink:"/oauth2-proxy/docs/community/security"}},u=[],c={rightToc:u};function p(e){var t=e.components,r=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(n.a)({},c,r,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"If ",Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," is defined, proxied requests will be signed with the\n",Object(o.b)("inlineCode",{parentName:"p"},"GAP-Signature")," header, which is a ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://en.wikipedia.org/wiki/Hash-based_message_authentication_code"}),"Hash-based Message Authentication Code\n(HMAC)"),"\nof selected request information and the request body ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go"}),"see ",Object(o.b)("inlineCode",{parentName:"a"},"SIGNATURE_HEADERS"),"\nin ",Object(o.b)("inlineCode",{parentName:"a"},"oauthproxy.go")),"."),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," must be of the form ",Object(o.b)("inlineCode",{parentName:"p"},"algorithm:secretkey"),", (ie: ",Object(o.b)("inlineCode",{parentName:"p"},'signature_key = "sha1:secret0"'),")"),Object(o.b)("p",null,"For more information about HMAC request signature validation, read the\nfollowing:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html"}),"Amazon Web Services: Signing and Authenticating REST\nRequests")),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/"}),"rc3.org: Using HMAC to authenticate Web service\nrequests"))))}p.isMDXComponent=!0},95:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){o(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function u(e,t){if(null==e)return{};var r,n,a=function(e,t){if(null==e)return{};var r,n,a={},o=Object.keys(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var c=a.a.createContext({}),p=function(e){var t=a.a.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},l=function(e){var t=p(e.components);return a.a.createElement(c.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,c=u(e,["components","mdxType","originalType","parentName"]),l=p(r),d=n,f=l["".concat(i,".").concat(d)]||l[d]||b[d]||o;return r?a.a.createElement(f,s(s({ref:t},c),{},{components:r})):a.a.createElement(f,s({ref:t},c))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:n,i[1]=s;for(var c=2;c<o;c++)i[c]=r[c];return a.a.createElement.apply(null,i)}return a.a.createElement.apply(null,r)}d.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/be200c4b.0ad1e075.js b/be200c4b.2b4796e9.js
similarity index 96%
rename from be200c4b.0ad1e075.js
rename to be200c4b.2b4796e9.js
index d6adbfa3..459b383e 100644
--- a/be200c4b.0ad1e075.js
+++ b/be200c4b.2b4796e9.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[29],{86:function(o){o.exports=JSON.parse('{"pluginId":"default","version":"6.1.x","label":"6.1.x","isLast":false,"docsSidebars":{"version-6.1.x/docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/6.1.x/"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/6.1.x/behaviour"},{"collapsed":false,"type":"category","label":"Configuration","items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/6.1.x/configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/6.1.x/configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/6.1.x/configuration/tls"}]},{"collapsed":false,"type":"category","label":"Features","items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/6.1.x/features/endpoints"},{"type":"link","label":"Request Signatures","href":"/oauth2-proxy/docs/6.1.x/features/request_signatures"}]},{"collapsed":false,"type":"category","label":"Community","items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/6.1.x/community/security"}]}]},"permalinkToSidebar":{"/oauth2-proxy/docs/6.1.x/behaviour":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/community/security":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/oauth_provider":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/overview":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/session_storage":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/tls":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/features/endpoints":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/features/request_signatures":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/":"version-6.1.x/docs"}}')}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[28],{85:function(o){o.exports=JSON.parse('{"pluginId":"default","version":"6.1.x","label":"6.1.x","isLast":false,"docsSidebars":{"version-6.1.x/docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/6.1.x/"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/6.1.x/behaviour"},{"collapsed":false,"type":"category","label":"Configuration","items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/6.1.x/configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/6.1.x/configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/6.1.x/configuration/tls"}]},{"collapsed":false,"type":"category","label":"Features","items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/6.1.x/features/endpoints"},{"type":"link","label":"Request Signatures","href":"/oauth2-proxy/docs/6.1.x/features/request_signatures"}]},{"collapsed":false,"type":"category","label":"Community","items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/6.1.x/community/security"}]}]},"permalinkToSidebar":{"/oauth2-proxy/docs/6.1.x/behaviour":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/community/security":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/oauth_provider":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/overview":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/session_storage":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/configuration/tls":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/features/endpoints":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/features/request_signatures":"version-6.1.x/docs","/oauth2-proxy/docs/6.1.x/":"version-6.1.x/docs"}}')}}]);
\ No newline at end of file
diff --git a/cd4a49c1.8ba23d44.js b/cd4a49c1.6b38e80e.js
similarity index 99%
rename from cd4a49c1.8ba23d44.js
rename to cd4a49c1.6b38e80e.js
index d5a6bdaf..2026100e 100644
--- a/cd4a49c1.8ba23d44.js
+++ b/cd4a49c1.6b38e80e.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[30],{87:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return s}));var n=a(2),r=a(6),b=(a(0),a(96)),l={id:"alpha-config",title:"Alpha Configuration"},i={unversionedId:"configuration/alpha-config",id:"configuration/alpha-config",isDocsHomePage:!1,title:"Alpha Configuration",description:"This page contains documentation for alpha features.",source:"@site/docs/configuration/alpha_config.md",slug:"/configuration/alpha-config",permalink:"/oauth2-proxy/docs/next/configuration/alpha-config",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/alpha_config.md",version:"current",sidebar:"docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/next/configuration/tls"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/next/features/endpoints"}},c=[{value:"Using Alpha Configuration",id:"using-alpha-configuration",children:[{value:"Converting configuration to the new structure",id:"converting-configuration-to-the-new-structure",children:[]}]},{value:"Removed options",id:"removed-options",children:[]},{value:"Configuration Reference",id:"configuration-reference",children:[{value:"AlphaOptions",id:"alphaoptions",children:[]},{value:"ClaimSource",id:"claimsource",children:[]},{value:"Duration",id:"duration",children:[]},{value:"Header",id:"header",children:[]},{value:"HeaderValue",id:"headervalue",children:[]},{value:"SecretSource",id:"secretsource",children:[]},{value:"Server",id:"server",children:[]},{value:"TLS",id:"tls",children:[]},{value:"Upstream",id:"upstream",children:[]},{value:"Upstreams",id:"upstreams",children:[]}]}],o={rightToc:c};function s(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),Object(b.b)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),Object(b.b)("p",null,"This page details a set of ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),Object(b.b)("p",null,"Below is a reference for the structure of the configuration, with\n",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions")," as the root of the configuration."),Object(b.b)("p",null,"When using alpha configuration, your config file will look something like below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),"upstreams:\n  - id: ...\n    ...\ninjectRequestHeaders:\n  - name: ...\n    ...\ninjectResponseHeaders:\n  - name: ...\n    ...\n")),Object(b.b)("p",null,"Please browse the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below for the structure\nof the new configuration format."),Object(b.b)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),Object(b.b)("p",null,"To use the new ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below."),Object(b.b)("p",null,"Provide the path to this file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"When using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," below for more information."))),Object(b.b)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),Object(b.b)("p",null,"Before adding the new ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",Object(b.b)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),Object(b.b)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",Object(b.b)("inlineCode",{parentName:"p"},"STDOUT"),"."),Object(b.b)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," and then start OAuth2 Proxy using\nthe new config."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),Object(b.b)("h2",{id:"removed-options"},"Removed options"),Object(b.b)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"flush-interval"),"/",Object(b.b)("inlineCode",{parentName:"li"},"flush_interval")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-host-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_host_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",Object(b.b)("inlineCode",{parentName:"li"},"proxy_websockets")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",Object(b.b)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"upstream"),"/",Object(b.b)("inlineCode",{parentName:"li"},"upstreams"))),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-access-token"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_access_token")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_user_headers")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_xauthrequest")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",Object(b.b)("inlineCode",{parentName:"li"},"prefer_email_to_user")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",Object(b.b)("inlineCode",{parentName:"li"},"basic_auth_password")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),Object(b.b)("p",null,"Attempting to use these options via flags or via config when ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),Object(b.b)("div",{className:"admonition admonition-important alert alert--info"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")))),Object(b.b)("h2",{id:"configuration-reference"},"Configuration Reference"),Object(b.b)("h3",{id:"alphaoptions"},"AlphaOptions"),Object(b.b)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"upstreams")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#upstreams"}),"Upstreams"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstreams is used to configure upstream servers.",Object(b.b)("br",null),"Once a user is authenticated, requests to the server will be proxied to",Object(b.b)("br",null),"these upstream servers based on the path mappings defined in this list.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectRequestHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectRequestHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to requests to upstream servers.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectResponseHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectResponseHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to responses from the proxy.",Object(b.b)("br",null),"This is typically used when using the proxy as an external authentication",Object(b.b)("br",null),"provider in conjunction with another proxy such as NGINX and its",Object(b.b)("br",null),"auth_request module.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"server")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#server"}),"Server"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Server is used to configure the HTTP(S) server for the proxy application.",Object(b.b)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",Object(b.b)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",Object(b.b)("br",null),"To use the secure server you must configure a TLS certificate and key.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"metricsServer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#server"}),"Server"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"MetricsServer is used to configure the HTTP(S) server for metrics.",Object(b.b)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",Object(b.b)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",Object(b.b)("br",null),"To use the secure server you must configure a TLS certificate and key.")))),Object(b.b)("h3",{id:"claimsource"},"ClaimSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),")"),Object(b.b)("p",null,"ClaimSource allows loading a header value from a claim within the session"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"duration"},"Duration"),Object(b.b)("h4",{id:"string-alias"},"(",Object(b.b)("inlineCode",{parentName:"h4"},"string")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstream"}),"Upstream"),")"),Object(b.b)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),Object(b.b)("h3",{id:"header"},"Header"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Name is the header name to be used for this set of values.",Object(b.b)("br",null),"Names should be unique within a list of Headers.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"preserveRequestValue")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PreserveRequestValue determines whether any values for this header",Object(b.b)("br",null),"should be preserved for the request to the upstream server.",Object(b.b)("br",null),"This option only takes effet on injected request headers.",Object(b.b)("br",null),"Defaults to false (headers that match this header will be stripped).")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#headervalue"}),"[]HeaderValue"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Values contains the desired values for this header")))),Object(b.b)("h3",{id:"headervalue"},"HeaderValue"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#header"}),"Header"),")"),Object(b.b)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"secretsource"},"SecretSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#claimsource"}),"ClaimSource"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#tls"}),"TLS"),")"),Object(b.b)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")))),Object(b.b)("h3",{id:"server"},"Server"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Server represents the configuration for an HTTP(S) server"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"BindAddress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BindAddress is the the address on which to serve traffic.",Object(b.b)("br",null),'Leave blank or set to "-" to disable.')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"SecureBindAddress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"SecureBindAddress is the the address on which to serve secure traffic.",Object(b.b)("br",null),'Leave blank or set to "-" to disable.')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"TLS")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#tls"}),"TLS"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"TLS contains the information for loading the certificate and key for the",Object(b.b)("br",null),"secure traffic.")))),Object(b.b)("h3",{id:"tls"},"TLS"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#server"}),"Server"),")"),Object(b.b)("p",null,"TLS contains the information for loading a TLS certifcate and key."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"Key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Key is the the TLS key data to use.",Object(b.b)("br",null),"Typically this will come from a file.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"Cert")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Cert is the TLS certificate data to use.",Object(b.b)("br",null),"Typically this will come from a file.")))),Object(b.b)("h3",{id:"upstream"},"Upstream"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstreams"}),"Upstreams"),")"),Object(b.b)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ID should be a unique identifier for the upstream.",Object(b.b)("br",null),"This value is required for all upstreams.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Path is used to map requests to the upstream server.",Object(b.b)("br",null),"The closest match will take precedence and all Paths must be unique.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"uri")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI of the upstream server. This may be an HTTP(S) server of a File",Object(b.b)("br",null),"based URL. It may include a path, in which case all requests will be served",Object(b.b)("br",null),"under that path.",Object(b.b)("br",null),"Eg:",Object(b.b)("br",null),"- http://localhost:8080",Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost"}),"https://service.localhost"),Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost/path"}),"https://service.localhost/path"),Object(b.b)("br",null),"- file://host/path",Object(b.b)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',Object(b.b)("br",null),'the upstream request will be for "/base/dir".')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",Object(b.b)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",Object(b.b)("br",null),"betweem OAuth2 Proxy and the usptream server.",Object(b.b)("br",null),"Defaults to false.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"static")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Static will make all requests to this upstream have a static response.",Object(b.b)("br",null),'The response will have a body of "Authenticated" and a response code',Object(b.b)("br",null),"matching StaticCode.",Object(b.b)("br",null),"If StaticCode is not set, the response will return a 200 response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"staticCode")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"int")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StaticCode determines the response code for the Static response.",Object(b.b)("br",null),"This option can only be used with Static enabled.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"flushInterval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#duration"}),"Duration"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FlushInterval is the period between flushing the response buffer when",Object(b.b)("br",null),"streaming response from the upstream.",Object(b.b)("br",null),"Defaults to 1 second.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"passHostHeader")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PassHostHeader determines whether the request host header should be proxied",Object(b.b)("br",null),"to the upstream server.",Object(b.b)("br",null),"Defaults to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"proxyWebSockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProxyWebSockets enables proxying of websockets to upstream servers",Object(b.b)("br",null),"Defaults to true.")))),Object(b.b)("h3",{id:"upstreams"},"Upstreams"),Object(b.b)("h4",{id:"upstream-alias"},"(",Object(b.b)("a",Object(n.a)({parentName:"h4"},{href:"#upstream"}),"[]Upstream")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Upstreams is a collection of definitions for upstream servers."))}s.isMDXComponent=!0},96:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),s=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=s(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=s(a),O=n,j=p["".concat(l,".").concat(O)]||p[O]||d[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}O.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[29],{86:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return s}));var n=a(2),r=a(6),b=(a(0),a(95)),l={id:"alpha-config",title:"Alpha Configuration"},i={unversionedId:"configuration/alpha-config",id:"configuration/alpha-config",isDocsHomePage:!1,title:"Alpha Configuration",description:"This page contains documentation for alpha features.",source:"@site/docs/configuration/alpha_config.md",slug:"/configuration/alpha-config",permalink:"/oauth2-proxy/docs/next/configuration/alpha-config",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/alpha_config.md",version:"current",sidebar:"docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/next/configuration/tls"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/next/features/endpoints"}},c=[{value:"Using Alpha Configuration",id:"using-alpha-configuration",children:[{value:"Converting configuration to the new structure",id:"converting-configuration-to-the-new-structure",children:[]}]},{value:"Removed options",id:"removed-options",children:[]},{value:"Configuration Reference",id:"configuration-reference",children:[{value:"AlphaOptions",id:"alphaoptions",children:[]},{value:"ClaimSource",id:"claimsource",children:[]},{value:"Duration",id:"duration",children:[]},{value:"Header",id:"header",children:[]},{value:"HeaderValue",id:"headervalue",children:[]},{value:"SecretSource",id:"secretsource",children:[]},{value:"Server",id:"server",children:[]},{value:"TLS",id:"tls",children:[]},{value:"Upstream",id:"upstream",children:[]},{value:"Upstreams",id:"upstreams",children:[]}]}],o={rightToc:c};function s(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),Object(b.b)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),Object(b.b)("p",null,"This page details a set of ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),Object(b.b)("p",null,"Below is a reference for the structure of the configuration, with\n",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions")," as the root of the configuration."),Object(b.b)("p",null,"When using alpha configuration, your config file will look something like below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),"upstreams:\n  - id: ...\n    ...\ninjectRequestHeaders:\n  - name: ...\n    ...\ninjectResponseHeaders:\n  - name: ...\n    ...\n")),Object(b.b)("p",null,"Please browse the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below for the structure\nof the new configuration format."),Object(b.b)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),Object(b.b)("p",null,"To use the new ",Object(b.b)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below."),Object(b.b)("p",null,"Provide the path to this file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"When using the ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," below for more information."))),Object(b.b)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),Object(b.b)("p",null,"Before adding the new ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",Object(b.b)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),Object(b.b)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",Object(b.b)("inlineCode",{parentName:"p"},"STDOUT"),"."),Object(b.b)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," and then start OAuth2 Proxy using\nthe new config."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),Object(b.b)("h2",{id:"removed-options"},"Removed options"),Object(b.b)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"flush-interval"),"/",Object(b.b)("inlineCode",{parentName:"li"},"flush_interval")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-host-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_host_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",Object(b.b)("inlineCode",{parentName:"li"},"proxy_websockets")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",Object(b.b)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"upstream"),"/",Object(b.b)("inlineCode",{parentName:"li"},"upstreams"))),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-access-token"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_access_token")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_user_headers")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"pass_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_basic_auth")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_xauthrequest")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",Object(b.b)("inlineCode",{parentName:"li"},"set_authorization_header")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",Object(b.b)("inlineCode",{parentName:"li"},"prefer_email_to_user")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",Object(b.b)("inlineCode",{parentName:"li"},"basic_auth_password")),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",Object(b.b)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),Object(b.b)("p",null,"Attempting to use these options via flags or via config when ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),Object(b.b)("div",{className:"admonition admonition-important alert alert--info"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",Object(b.b)("inlineCode",{parentName:"p"},"--alpha-config")))),Object(b.b)("h2",{id:"configuration-reference"},"Configuration Reference"),Object(b.b)("h3",{id:"alphaoptions"},"AlphaOptions"),Object(b.b)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),Object(b.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"upstreams")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#upstreams"}),"Upstreams"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstreams is used to configure upstream servers.",Object(b.b)("br",null),"Once a user is authenticated, requests to the server will be proxied to",Object(b.b)("br",null),"these upstream servers based on the path mappings defined in this list.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectRequestHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectRequestHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to requests to upstream servers.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"injectResponseHeaders")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectResponseHeaders is used to configure headers that should be added",Object(b.b)("br",null),"to responses from the proxy.",Object(b.b)("br",null),"This is typically used when using the proxy as an external authentication",Object(b.b)("br",null),"provider in conjunction with another proxy such as NGINX and its",Object(b.b)("br",null),"auth_request module.",Object(b.b)("br",null),"Headers may source values from either the authenticated user's session",Object(b.b)("br",null),"or from a static secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"server")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#server"}),"Server"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Server is used to configure the HTTP(S) server for the proxy application.",Object(b.b)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",Object(b.b)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",Object(b.b)("br",null),"To use the secure server you must configure a TLS certificate and key.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"metricsServer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#server"}),"Server"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"MetricsServer is used to configure the HTTP(S) server for metrics.",Object(b.b)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",Object(b.b)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",Object(b.b)("br",null),"To use the secure server you must configure a TLS certificate and key.")))),Object(b.b)("h3",{id:"claimsource"},"ClaimSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),")"),Object(b.b)("p",null,"ClaimSource allows loading a header value from a claim within the session"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"duration"},"Duration"),Object(b.b)("h4",{id:"string-alias"},"(",Object(b.b)("inlineCode",{parentName:"h4"},"string")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstream"}),"Upstream"),")"),Object(b.b)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),Object(b.b)("h3",{id:"header"},"Header"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Name is the header name to be used for this set of values.",Object(b.b)("br",null),"Names should be unique within a list of Headers.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"preserveRequestValue")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PreserveRequestValue determines whether any values for this header",Object(b.b)("br",null),"should be preserved for the request to the upstream server.",Object(b.b)("br",null),"This option only takes effet on injected request headers.",Object(b.b)("br",null),"Defaults to false (headers that match this header will be stripped).")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#headervalue"}),"[]HeaderValue"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Values contains the desired values for this header")))),Object(b.b)("h3",{id:"headervalue"},"HeaderValue"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#header"}),"Header"),")"),Object(b.b)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(b.b)("br",null),"loaded from.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(b.b)("br",null),"claim if it is non-empty.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(b.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(b.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(b.b)("h3",{id:"secretsource"},"SecretSource"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#claimsource"}),"ClaimSource"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#tls"}),"TLS"),")"),Object(b.b)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"value")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"[]byte")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"fromFile")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")))),Object(b.b)("h3",{id:"server"},"Server"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Server represents the configuration for an HTTP(S) server"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"BindAddress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BindAddress is the the address on which to serve traffic.",Object(b.b)("br",null),'Leave blank or set to "-" to disable.')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"SecureBindAddress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"SecureBindAddress is the the address on which to serve secure traffic.",Object(b.b)("br",null),'Leave blank or set to "-" to disable.')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"TLS")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#tls"}),"TLS"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"TLS contains the information for loading the certificate and key for the",Object(b.b)("br",null),"secure traffic.")))),Object(b.b)("h3",{id:"tls"},"TLS"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#server"}),"Server"),")"),Object(b.b)("p",null,"TLS contains the information for loading a TLS certifcate and key."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"Key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Key is the the TLS key data to use.",Object(b.b)("br",null),"Typically this will come from a file.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"Cert")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Cert is the TLS certificate data to use.",Object(b.b)("br",null),"Typically this will come from a file.")))),Object(b.b)("h3",{id:"upstream"},"Upstream"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#upstreams"}),"Upstreams"),")"),Object(b.b)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ID should be a unique identifier for the upstream.",Object(b.b)("br",null),"This value is required for all upstreams.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Path is used to map requests to the upstream server.",Object(b.b)("br",null),"The closest match will take precedence and all Paths must be unique.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"uri")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"string")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI of the upstream server. This may be an HTTP(S) server of a File",Object(b.b)("br",null),"based URL. It may include a path, in which case all requests will be served",Object(b.b)("br",null),"under that path.",Object(b.b)("br",null),"Eg:",Object(b.b)("br",null),"- http://localhost:8080",Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost"}),"https://service.localhost"),Object(b.b)("br",null),"- ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost/path"}),"https://service.localhost/path"),Object(b.b)("br",null),"- file://host/path",Object(b.b)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',Object(b.b)("br",null),'the upstream request will be for "/base/dir".')),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",Object(b.b)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",Object(b.b)("br",null),"betweem OAuth2 Proxy and the usptream server.",Object(b.b)("br",null),"Defaults to false.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"static")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Static will make all requests to this upstream have a static response.",Object(b.b)("br",null),'The response will have a body of "Authenticated" and a response code',Object(b.b)("br",null),"matching StaticCode.",Object(b.b)("br",null),"If StaticCode is not set, the response will return a 200 response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"staticCode")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"int")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StaticCode determines the response code for the Static response.",Object(b.b)("br",null),"This option can only be used with Static enabled.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"flushInterval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},Object(b.b)("a",Object(n.a)({parentName:"em"},{href:"#duration"}),"Duration"))),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FlushInterval is the period between flushing the response buffer when",Object(b.b)("br",null),"streaming response from the upstream.",Object(b.b)("br",null),"Defaults to 1 second.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"passHostHeader")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PassHostHeader determines whether the request host header should be proxied",Object(b.b)("br",null),"to the upstream server.",Object(b.b)("br",null),"Defaults to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"proxyWebSockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("em",{parentName:"td"},"bool")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProxyWebSockets enables proxying of websockets to upstream servers",Object(b.b)("br",null),"Defaults to true.")))),Object(b.b)("h3",{id:"upstreams"},"Upstreams"),Object(b.b)("h4",{id:"upstream-alias"},"(",Object(b.b)("a",Object(n.a)({parentName:"h4"},{href:"#upstream"}),"[]Upstream")," alias)"),Object(b.b)("p",null,"(",Object(b.b)("strong",{parentName:"p"},"Appears on:")," ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(b.b)("p",null,"Upstreams is a collection of definitions for upstream servers."))}s.isMDXComponent=!0},95:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?l(Object(a),!0).forEach((function(t){b(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):l(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function c(e,t){if(null==e)return{};var a,n,r=function(e,t){if(null==e)return{};var a,n,r={},b=Object.keys(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n<b.length;n++)a=b[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),s=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=s(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=s(a),O=n,j=p["".concat(l,".").concat(O)]||p[O]||d[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o<b;o++)l[o]=a[o];return r.a.createElement.apply(null,l)}return r.a.createElement.apply(null,a)}O.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/docs/6.1.x/behaviour/index.html b/docs/6.1.x/behaviour/index.html
index 8d3cbfab..5013317f 100644
--- a/docs/6.1.x/behaviour/index.html
+++ b/docs/6.1.x/behaviour/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy&#x27;s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy&#x27;s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/42326c77.09a0e8e4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/42326c77.cbfbbe21.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for OAuth2 Proxy <strong>6.1.x</strong>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/behaviour">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 6.1.x</span></div><header><h1 class="docTitle_1Lrw">Behaviour</h1></header><div class="markdown"><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy&#x27;s session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/6.1.x/features/endpoints">endpoints</a>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/behaviour.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/42326c77.09a0e8e4.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/42326c77.cbfbbe21.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/community/security/index.html b/docs/6.1.x/community/security/index.html
index dc6b1677..474df25a 100644
--- a/docs/6.1.x/community/security/index.html
+++ b/docs/6.1.x/community/security/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/ea7cbf6d.51c5dea8.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/ea7cbf6d.ef6dfe15.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -38,14 +38,14 @@ merging fixes until all patches are ready.
 We may also backport the fix to previous releases,
 but this will be at the discretion of the maintainers.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/community/security.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Request Signatures</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/ea7cbf6d.51c5dea8.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/ea7cbf6d.ef6dfe15.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/oauth_provider/index.html b/docs/6.1.x/configuration/oauth_provider/index.html
index 5deada02..a7d7389b 100644
--- a/docs/6.1.x/configuration/oauth_provider/index.html
+++ b/docs/6.1.x/configuration/oauth_provider/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/3def9002.8829538f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/3def9002.32c43efe.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -55,14 +55,14 @@ to setup the client id and client secret. Your &quot;Redirection URI&quot; will
 <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
 new <code>Provider</code>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/auth.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/3def9002.8829538f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/3def9002.32c43efe.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/overview/index.html b/docs/6.1.x/configuration/overview/index.html
index 1b582101..180caf47 100644
--- a/docs/6.1.x/configuration/overview/index.html
+++ b/docs/6.1.x/configuration/overview/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via config file, command line options or environment variables."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via config file, command line options or environment variables."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/ade45c9a.0673a20d.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/ade45c9a.6b8ce017.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -39,14 +39,14 @@ Variables set with <code>auth_request_set</code> are not <code>set</code>-able i
 Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-yaml codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)">  auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block">
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">  access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    if ngx.var.name_upstream_1 ~= &quot;&quot; then</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">&quot;Set-Cookie&quot;</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = &quot;name_1=&quot; .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match(&quot;(; .*)&quot;)</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    end</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">  </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span></div></div></div></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don&#x27;t set a custom cookie name the variable  should be &quot;$upstream_cookie__oauth2_proxy_1&quot; instead of &quot;$upstream_cookie_name_1&quot; and the new cookie-name should be &quot;_oauth2_proxy_1=&quot; instead of &quot;name_1=&quot;.</p><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/overview.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link">Configuring for use with the Nginx <code>auth_request</code> directive</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/ade45c9a.0673a20d.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/ade45c9a.6b8ce017.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/session_storage/index.html b/docs/6.1.x/configuration/session_storage/index.html
index 3260f67b..be1040f2 100644
--- a/docs/6.1.x/configuration/session_storage/index.html
+++ b/docs/6.1.x/configuration/session_storage/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/f5839aac.d42acf97.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/f5839aac.a11a203a.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -35,14 +35,14 @@ disclosure.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnc
 and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
 <code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/f5839aac.d42acf97.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/f5839aac.a11a203a.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/tls/index.html b/docs/6.1.x/configuration/tls/index.html
index e10e0123..a7d5a9b8 100644
--- a/docs/6.1.x/configuration/tls/index.html
+++ b/docs/6.1.x/configuration/tls/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/a37c03cb.cb23f5eb.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/a37c03cb.cd2174f2.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -26,14 +26,14 @@ would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx
 via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    listen 443 default ssl;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    server_name internal.yourcompany.com;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    ssl_certificate /path/to/cert.pem;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    ssl_certificate_key /path/to/cert.key;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    add_header Strict-Transport-Security max-age=2592000;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block">
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    location / {</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_pass http://127.0.0.1:4180;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header Host $host;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header X-Real-IP $remote_addr;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header X-Scheme $scheme;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_connect_timeout 1;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_send_timeout 30;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_read_timeout 30;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    }</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">}</span></div></div></div></div></div><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-bash codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">&quot;yourcompany.com&quot;</span><span class="token plain">  </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span></div></div></div></div></div></li></ol></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/tls.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/a37c03cb.cb23f5eb.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/a37c03cb.cd2174f2.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/features/endpoints/index.html b/docs/6.1.x/features/endpoints/index.html
index 749b1a80..8c86d57a 100644
--- a/docs/6.1.x/features/endpoints/index.html
+++ b/docs/6.1.x/features/endpoints/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/a991188b.3c713607.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/a991188b.462763a5.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for OAuth2 Proxy <strong>6.1.x</strong>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 6.1.x</span></div><header><h1 class="docTitle_1Lrw">Endpoints</h1></header><div class="markdown"><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user&#x27;s email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/6.1.x/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="sign-out"></a>Sign out<a aria-hidden="true" tabindex="-1" class="hash-link" href="#sign-out" title="Direct link to heading">#</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy&#x27;s own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider&#x27;s sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span></div></div></div></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">...</span></div></div></div></div></div><p>(The &quot;sign_out_page&quot; should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/6.1.x/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/endpoints.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Request Signatures »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/a991188b.3c713607.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/a991188b.462763a5.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/features/request_signatures/index.html b/docs/6.1.x/features/request_signatures/index.html
index 57a69c8f..60cf2e15 100644
--- a/docs/6.1.x/features/request_signatures/index.html
+++ b/docs/6.1.x/features/request_signatures/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Request Signatures | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Request Signatures | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/6f497b56.ffc09987.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/6f497b56.a16212fe.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/request_signatures">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/features/request_signatures">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for OAuth2 Proxy <strong>6.1.x</strong>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/features/request_signatures">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 6.1.x</span></div><header><h1 class="docTitle_1Lrw">Request Signatures</h1></header><div class="markdown"><p>If <code>signature_key</code> is defined, proxied requests will be signed with the
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for OAuth2 Proxy <strong>6.1.x</strong>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/features/request_signatures">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 6.1.x</span></div><header><h1 class="docTitle_1Lrw">Request Signatures</h1></header><div class="markdown"><p>If <code>signature_key</code> is defined, proxied requests will be signed with the
 <code>GAP-Signature</code> header, which is a <a href="https://en.wikipedia.org/wiki/Hash-based_message_authentication_code" target="_blank" rel="noopener noreferrer">Hash-based Message Authentication Code
 (HMAC)</a>
 of selected request information and the request body <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go" target="_blank" rel="noopener noreferrer">see <code>SIGNATURE_HEADERS</code>
@@ -27,14 +27,14 @@ following:</p><ul><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/R
 Requests</a></li><li><a href="http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/" target="_blank" rel="noopener noreferrer">rc3.org: Using HMAC to authenticate Web service
 requests</a></li></ul></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/request_signatures.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/6f497b56.ffc09987.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/6f497b56.a16212fe.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/6.1.x/index.html b/docs/6.1.x/index.html
index 671dbba8..eee79700 100644
--- a/docs/6.1.x/index.html
+++ b/docs/6.1.x/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1.  Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1.  Choose how to deploy:"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/be200c4b.0ad1e075.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/7b04b1d5.49cea530.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/be200c4b.2b4796e9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/7b04b1d5.6efeb7d7.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for OAuth2 Proxy <strong>6.1.x</strong>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 6.1.x</span></div><header><h1 class="docTitle_1Lrw">Installation</h1></header><div class="markdown"><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v6.1.1</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt 2&gt;&amp;1 | grep OK</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span></div></div></div></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/6.1.x/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/6.1.x/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/installation.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/be200c4b.0ad1e075.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/7b04b1d5.49cea530.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/be200c4b.2b4796e9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/7b04b1d5.6efeb7d7.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/behaviour/index.html b/docs/behaviour/index.html
index 7963ed26..c4c3629b 100644
--- a/docs/behaviour/index.html
+++ b/docs/behaviour/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy&#x27;s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy&#x27;s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/5a047177.05c93143.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/5a047177.4377cd87.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 7.0.x</span></div><header><h1 class="docTitle_1Lrw">Behaviour</h1></header><div class="markdown"><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy&#x27;s session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/features/endpoints">endpoints</a>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/behaviour.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/5a047177.05c93143.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/5a047177.4377cd87.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/community/security/index.html b/docs/community/security/index.html
index a9c93fb3..ef19ccfc 100644
--- a/docs/community/security/index.html
+++ b/docs/community/security/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/f4c9d322.ee82cb40.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/f4c9d322.8594a982.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -38,14 +38,14 @@ merging fixes until all patches are ready.
 We may also backport the fix to previous releases,
 but this will be at the discretion of the maintainers.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/community/security.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/features/request_signatures"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Request Signatures</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/f4c9d322.ee82cb40.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/f4c9d322.8594a982.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/configuration/alpha-config/index.html b/docs/configuration/alpha-config/index.html
index 656727dd..b58a6ba4 100644
--- a/docs/configuration/alpha-config/index.html
+++ b/docs/configuration/alpha-config/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Alpha Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Alpha Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/3fa022c7.2a08f900.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/3fa022c7.f2bf9899.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -44,14 +44,14 @@ make up the header value</p><table><thead><tr><th>Field</th><th>Type</th><th>Des
 Only one source within the struct should be defined at any time.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr></tbody></table><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstream"></a>Upstream<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstream" title="Direct link to heading">#</a></h3><p>(<strong>Appears on:</strong> <a href="#upstreams">Upstreams</a>)</p><p>Upstream represents the configuration for an upstream server.
 Requests will be proxied to this upstream if the path matches the request path.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the upstream.<br>This value is required for all upstreams.</td></tr><tr><td><code>path</code></td><td><em>string</em></td><td>Path is used to map requests to the upstream server.<br>The closest match will take precedence and all Paths must be unique.</td></tr><tr><td><code>uri</code></td><td><em>string</em></td><td>The URI of the upstream server. This may be an HTTP(S) server of a File<br>based URL. It may include a path, in which case all requests will be served<br>under that path.<br>Eg:<br>- http://localhost:8080<br>- <a href="https://service.localhost" target="_blank" rel="noopener noreferrer">https://service.localhost</a><br>- <a href="https://service.localhost/path" target="_blank" rel="noopener noreferrer">https://service.localhost/path</a><br>- file://host/path<br>If the URI&#x27;s path is &quot;/base&quot; and the incoming request was for &quot;/dir&quot;,<br>the upstream request will be for &quot;/base/dir&quot;.</td></tr><tr><td><code>insecureSkipTLSVerify</code></td><td><em>bool</em></td><td>InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br>This option is insecure and will allow potential Man-In-The-Middle attacks<br>betweem OAuth2 Proxy and the usptream server.<br>Defaults to false.</td></tr><tr><td><code>static</code></td><td><em>bool</em></td><td>Static will make all requests to this upstream have a static response.<br>The response will have a body of &quot;Authenticated&quot; and a response code<br>matching StaticCode.<br>If StaticCode is not set, the response will return a 200 response.</td></tr><tr><td><code>staticCode</code></td><td><em>int</em></td><td>StaticCode determines the response code for the Static response.<br>This option can only be used with Static enabled.</td></tr><tr><td><code>flushInterval</code></td><td><em><a href="#duration">Duration</a></em></td><td>FlushInterval is the period between flushing the response buffer when<br>streaming response from the upstream.<br>Defaults to 1 second.</td></tr><tr><td><code>passHostHeader</code></td><td><em>bool</em></td><td>PassHostHeader determines whether the request host header should be proxied<br>to the upstream server.<br>Defaults to true.</td></tr><tr><td><code>proxyWebSockets</code></td><td><em>bool</em></td><td>ProxyWebSockets enables proxying of websockets to upstream servers<br>Defaults to true.</td></tr></tbody></table><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstreams"></a>Upstreams<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstreams" title="Direct link to heading">#</a></h3><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstream-alias"></a>(<a href="#upstream">[]Upstream</a> alias)<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstream-alias" title="Direct link to heading">#</a></h4><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Upstreams is a collection of definitions for upstream servers.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/alpha_config.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#using-alpha-configuration" class="table-of-contents__link">Using Alpha Configuration</a><ul><li><a href="#converting-configuration-to-the-new-structure" class="table-of-contents__link">Converting configuration to the new structure</a></li></ul></li><li><a href="#removed-options" class="table-of-contents__link">Removed options</a></li><li><a href="#configuration-reference" class="table-of-contents__link">Configuration Reference</a><ul><li><a href="#alphaoptions" class="table-of-contents__link">AlphaOptions</a></li><li><a href="#claimsource" class="table-of-contents__link">ClaimSource</a></li><li><a href="#duration" class="table-of-contents__link">Duration</a></li><li><a href="#header" class="table-of-contents__link">Header</a></li><li><a href="#headervalue" class="table-of-contents__link">HeaderValue</a></li><li><a href="#secretsource" class="table-of-contents__link">SecretSource</a></li><li><a href="#upstream" class="table-of-contents__link">Upstream</a></li><li><a href="#upstreams" class="table-of-contents__link">Upstreams</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/3fa022c7.2a08f900.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/3fa022c7.f2bf9899.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/configuration/oauth_provider/index.html b/docs/configuration/oauth_provider/index.html
index 20f90e01..c71e77e3 100644
--- a/docs/configuration/oauth_provider/index.html
+++ b/docs/configuration/oauth_provider/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/7dcecc8d.1a244b07.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/7dcecc8d.818ddd0c.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -59,14 +59,14 @@ to setup the client id and client secret. Your &quot;Redirection URI&quot; will
 <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
 new <code>Provider</code>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/auth.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/7dcecc8d.1a244b07.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/7dcecc8d.818ddd0c.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/configuration/overview/index.html b/docs/configuration/overview/index.html
index 548f8d95..78ca553f 100644
--- a/docs/configuration/overview/index.html
+++ b/docs/configuration/overview/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via config file, command line options or environment variables."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via config file, command line options or environment variables."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/8c826f25.19b6a6ee.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/8c826f25.cf4971b6.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -43,14 +43,14 @@ Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua modu
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">  </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block">
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">  </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span></div></div></div></div></div><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/overview.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/8c826f25.19b6a6ee.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/8c826f25.cf4971b6.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/configuration/session_storage/index.html b/docs/configuration/session_storage/index.html
index a2521b69..9691637d 100644
--- a/docs/configuration/session_storage/index.html
+++ b/docs/configuration/session_storage/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/edfc6e1b.4df93a8a.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/edfc6e1b.b4905114.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -35,14 +35,14 @@ disclosure.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnc
 and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
 <code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/edfc6e1b.4df93a8a.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/edfc6e1b.b4905114.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/configuration/tls/index.html b/docs/configuration/tls/index.html
index caabfd35..5b096a3c 100644
--- a/docs/configuration/tls/index.html
+++ b/docs/configuration/tls/index.html
@@ -6,15 +6,15 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/00691219.5a332c9c.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/00691219.947d552d.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -26,14 +26,14 @@ would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx
 via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    listen 443 default ssl;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    server_name internal.yourcompany.com;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    ssl_certificate /path/to/cert.pem;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    ssl_certificate_key /path/to/cert.key;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    add_header Strict-Transport-Security max-age=2592000;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block">
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    location / {</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_pass http://127.0.0.1:4180;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header Host $host;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header X-Real-IP $remote_addr;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header X-Scheme $scheme;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_connect_timeout 1;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_send_timeout 30;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_read_timeout 30;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    }</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">}</span></div></div></div></div></div><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-bash codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">&quot;yourcompany.com&quot;</span><span class="token plain">  </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span></div></div></div></div></div></li></ol></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/tls.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/alpha-config"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Alpha Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/00691219.5a332c9c.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/00691219.947d552d.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/features/endpoints/index.html b/docs/features/endpoints/index.html
index 25c75c48..643d41fe 100644
--- a/docs/features/endpoints/index.html
+++ b/docs/features/endpoints/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/001ca130.864ff6c9.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/001ca130.e0bd119c.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 7.0.x</span></div><header><h1 class="docTitle_1Lrw">Endpoints</h1></header><div class="markdown"><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user&#x27;s email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="sign-out"></a>Sign out<a aria-hidden="true" tabindex="-1" class="hash-link" href="#sign-out" title="Direct link to heading">#</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy&#x27;s own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider&#x27;s sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span></div></div></div></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">...</span></div></div></div></div></div><p>(The &quot;sign_out_page&quot; should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/endpoints.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/features/request_signatures"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Request Signatures »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/001ca130.864ff6c9.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/001ca130.e0bd119c.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/features/request_signatures/index.html b/docs/features/request_signatures/index.html
index 7f7c992f..32373bf0 100644
--- a/docs/features/request_signatures/index.html
+++ b/docs/features/request_signatures/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Request Signatures | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Request Signatures | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/request_signatures"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/request_signatures"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/b89e1cb0.3196bbbd.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/b89e1cb0.4d7a9b41.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/request_signatures">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/features/request_signatures">Next</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 7.0.x</span></div><header><h1 class="docTitle_1Lrw">Request Signatures</h1></header><div class="markdown"><p>If <code>signature_key</code> is defined, proxied requests will be signed with the
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Next</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 7.0.x</span></div><header><h1 class="docTitle_1Lrw">Request Signatures</h1></header><div class="markdown"><p>If <code>signature_key</code> is defined, proxied requests will be signed with the
 <code>GAP-Signature</code> header, which is a <a href="https://en.wikipedia.org/wiki/Hash-based_message_authentication_code" target="_blank" rel="noopener noreferrer">Hash-based Message Authentication Code
 (HMAC)</a>
 of selected request information and the request body <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go" target="_blank" rel="noopener noreferrer">see <code>SIGNATURE_HEADERS</code>
@@ -27,14 +27,14 @@ following:</p><ul><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/R
 Requests</a></li><li><a href="http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/" target="_blank" rel="noopener noreferrer">rc3.org: Using HMAC to authenticate Web service
 requests</a></li></ul></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/request_signatures.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/b89e1cb0.3196bbbd.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/b89e1cb0.4d7a9b41.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/index.html b/docs/index.html
index 69a5f142..b14a38f6 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1.  Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1.  Choose how to deploy:"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
 <link rel="preload" href="/oauth2-proxy/230aeb34.b0a8f7b9.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/0721a2c0.c40b0d06.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/0721a2c0.31d87bed.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Next</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: 7.0.x</span></div><header><h1 class="docTitle_1Lrw">Installation</h1></header><div class="markdown"><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.0.1</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt 2&gt;&amp;1 | grep OK</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span></div></div></div></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/installation.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
 <script src="/oauth2-proxy/230aeb34.b0a8f7b9.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/0721a2c0.c40b0d06.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/0721a2c0.31d87bed.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/behaviour/index.html b/docs/next/behaviour/index.html
index 4e784eb5..6ac48346 100644
--- a/docs/next/behaviour/index.html
+++ b/docs/next/behaviour/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy&#x27;s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy&#x27;s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/94285305.c1f11fb3.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/94285305.c77ada9e.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/behaviour">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Behaviour</h1></header><div class="markdown"><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy&#x27;s session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/next/features/endpoints">endpoints</a>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/behaviour.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/behaviour">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Behaviour</h1></header><div class="markdown"><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy&#x27;s session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/next/features/endpoints">endpoints</a>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/behaviour.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/94285305.c1f11fb3.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/94285305.c77ada9e.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/community/security/index.html b/docs/next/community/security/index.html
index b2cbef24..626f65c1 100644
--- a/docs/next/community/security/index.html
+++ b/docs/next/community/security/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/35234f08.540f1aca.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/35234f08.b5c25545.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/community/security">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/community/security">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/community/security">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/community/security">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/community/security">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/community/security">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/community/security">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Security</h1></header><div class="markdown"><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>OAuth2 Proxy is a community project.
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/community/security">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/community/security">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/community/security">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/community/security">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/community/security">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/community/security">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/community/security">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Security</h1></header><div class="markdown"><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>OAuth2 Proxy is a community project.
 Maintainers do not work on this project full time, and as such,
 while we endeavour to respond to disclosures as quickly as possible,
 this may take longer than in projects with corporate sponsorship.</p></div></div><h2><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="security-disclosures"></a>Security Disclosures<a aria-hidden="true" tabindex="-1" class="hash-link" href="#security-disclosures" title="Direct link to heading">#</a></h2><div class="admonition admonition-important alert alert--info"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"></path></svg></span>important</h5></div><div class="admonition-content"><p>If you believe you have found a vulnerability within OAuth2 Proxy or any of its
@@ -36,16 +36,16 @@ dependencies), we may use regular PRs for fixes and forego the security advisory
 If we have multiple security issues in flight simultaneously, we may delay
 merging fixes until all patches are ready.
 We may also backport the fix to previous releases,
-but this will be at the discretion of the maintainers.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/community/security.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/features/request_signatures"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Request Signatures</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
+but this will be at the discretion of the maintainers.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/community/security.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/35234f08.540f1aca.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/35234f08.b5c25545.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/configuration/alpha-config/index.html b/docs/next/configuration/alpha-config/index.html
index bb658e21..e1845eac 100644
--- a/docs/next/configuration/alpha-config/index.html
+++ b/docs/next/configuration/alpha-config/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Alpha Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Alpha Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/cd4a49c1.8ba23d44.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/cd4a49c1.6b38e80e.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/alpha-config">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/alpha-config">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/alpha-config">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/alpha-config">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/alpha-config">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Alpha Configuration</h1></header><div class="markdown"><div class="admonition admonition-warning alert alert--danger"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="16" viewBox="0 0 12 16"><path fill-rule="evenodd" d="M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"></path></svg></span>warning</h5></div><div class="admonition-content"><p>This page contains documentation for alpha features.
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/alpha-config">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/alpha-config">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/alpha-config">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/alpha-config">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/alpha-config">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Alpha Configuration</h1></header><div class="markdown"><div class="admonition admonition-warning alert alert--danger"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="16" viewBox="0 0 12 16"><path fill-rule="evenodd" d="M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"></path></svg></span>warning</h5></div><div class="admonition-content"><p>This page contains documentation for alpha features.
 We reserve the right to make breaking changes to the features detailed within this page with no notice.</p><p>Options described in this page may be changed, removed, renamed or moved without prior warning.
 Please beware of this before you use alpha configuration options.</p></div></div><p>This page details a set of <strong>alpha</strong> configuration options in a new format.
 Going forward we are intending to add structured configuration in YAML format to
@@ -44,14 +44,14 @@ make up the header value</p><table><thead><tr><th>Field</th><th>Type</th><th>Des
 Only one source within the struct should be defined at any time.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr></tbody></table><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="server"></a>Server<a aria-hidden="true" tabindex="-1" class="hash-link" href="#server" title="Direct link to heading">#</a></h3><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Server represents the configuration for an HTTP(S) server</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>BindAddress</code></td><td><em>string</em></td><td>BindAddress is the the address on which to serve traffic.<br>Leave blank or set to &quot;-&quot; to disable.</td></tr><tr><td><code>SecureBindAddress</code></td><td><em>string</em></td><td>SecureBindAddress is the the address on which to serve secure traffic.<br>Leave blank or set to &quot;-&quot; to disable.</td></tr><tr><td><code>TLS</code></td><td><em><a href="#tls">TLS</a></em></td><td>TLS contains the information for loading the certificate and key for the<br>secure traffic.</td></tr></tbody></table><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="tls"></a>TLS<a aria-hidden="true" tabindex="-1" class="hash-link" href="#tls" title="Direct link to heading">#</a></h3><p>(<strong>Appears on:</strong> <a href="#server">Server</a>)</p><p>TLS contains the information for loading a TLS certifcate and key.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>Key</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>Key is the the TLS key data to use.<br>Typically this will come from a file.</td></tr><tr><td><code>Cert</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>Cert is the TLS certificate data to use.<br>Typically this will come from a file.</td></tr></tbody></table><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstream"></a>Upstream<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstream" title="Direct link to heading">#</a></h3><p>(<strong>Appears on:</strong> <a href="#upstreams">Upstreams</a>)</p><p>Upstream represents the configuration for an upstream server.
 Requests will be proxied to this upstream if the path matches the request path.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the upstream.<br>This value is required for all upstreams.</td></tr><tr><td><code>path</code></td><td><em>string</em></td><td>Path is used to map requests to the upstream server.<br>The closest match will take precedence and all Paths must be unique.</td></tr><tr><td><code>uri</code></td><td><em>string</em></td><td>The URI of the upstream server. This may be an HTTP(S) server of a File<br>based URL. It may include a path, in which case all requests will be served<br>under that path.<br>Eg:<br>- http://localhost:8080<br>- <a href="https://service.localhost" target="_blank" rel="noopener noreferrer">https://service.localhost</a><br>- <a href="https://service.localhost/path" target="_blank" rel="noopener noreferrer">https://service.localhost/path</a><br>- file://host/path<br>If the URI&#x27;s path is &quot;/base&quot; and the incoming request was for &quot;/dir&quot;,<br>the upstream request will be for &quot;/base/dir&quot;.</td></tr><tr><td><code>insecureSkipTLSVerify</code></td><td><em>bool</em></td><td>InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br>This option is insecure and will allow potential Man-In-The-Middle attacks<br>betweem OAuth2 Proxy and the usptream server.<br>Defaults to false.</td></tr><tr><td><code>static</code></td><td><em>bool</em></td><td>Static will make all requests to this upstream have a static response.<br>The response will have a body of &quot;Authenticated&quot; and a response code<br>matching StaticCode.<br>If StaticCode is not set, the response will return a 200 response.</td></tr><tr><td><code>staticCode</code></td><td><em>int</em></td><td>StaticCode determines the response code for the Static response.<br>This option can only be used with Static enabled.</td></tr><tr><td><code>flushInterval</code></td><td><em><a href="#duration">Duration</a></em></td><td>FlushInterval is the period between flushing the response buffer when<br>streaming response from the upstream.<br>Defaults to 1 second.</td></tr><tr><td><code>passHostHeader</code></td><td><em>bool</em></td><td>PassHostHeader determines whether the request host header should be proxied<br>to the upstream server.<br>Defaults to true.</td></tr><tr><td><code>proxyWebSockets</code></td><td><em>bool</em></td><td>ProxyWebSockets enables proxying of websockets to upstream servers<br>Defaults to true.</td></tr></tbody></table><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstreams"></a>Upstreams<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstreams" title="Direct link to heading">#</a></h3><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstream-alias"></a>(<a href="#upstream">[]Upstream</a> alias)<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstream-alias" title="Direct link to heading">#</a></h4><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Upstreams is a collection of definitions for upstream servers.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/alpha_config.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#using-alpha-configuration" class="table-of-contents__link">Using Alpha Configuration</a><ul><li><a href="#converting-configuration-to-the-new-structure" class="table-of-contents__link">Converting configuration to the new structure</a></li></ul></li><li><a href="#removed-options" class="table-of-contents__link">Removed options</a></li><li><a href="#configuration-reference" class="table-of-contents__link">Configuration Reference</a><ul><li><a href="#alphaoptions" class="table-of-contents__link">AlphaOptions</a></li><li><a href="#claimsource" class="table-of-contents__link">ClaimSource</a></li><li><a href="#duration" class="table-of-contents__link">Duration</a></li><li><a href="#header" class="table-of-contents__link">Header</a></li><li><a href="#headervalue" class="table-of-contents__link">HeaderValue</a></li><li><a href="#secretsource" class="table-of-contents__link">SecretSource</a></li><li><a href="#server" class="table-of-contents__link">Server</a></li><li><a href="#tls" class="table-of-contents__link">TLS</a></li><li><a href="#upstream" class="table-of-contents__link">Upstream</a></li><li><a href="#upstreams" class="table-of-contents__link">Upstreams</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/cd4a49c1.8ba23d44.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/cd4a49c1.6b38e80e.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/configuration/oauth_provider/index.html b/docs/next/configuration/oauth_provider/index.html
index b59f06ab..58052031 100644
--- a/docs/next/configuration/oauth_provider/index.html
+++ b/docs/next/configuration/oauth_provider/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/357fe94d.f0a0c172.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/357fe94d.283fb6a4.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/oauth_provider">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/oauth_provider">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/oauth_provider">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/oauth_provider">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/oauth_provider">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">OAuth Provider Configuration</h1></header><div class="markdown"><p>You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run <code>oauth2-proxy</code> on.</p><p>Valid providers are :</p><ul><li><a href="#google-auth-provider">Google</a> <em>default</em></li><li><a href="#azure-auth-provider">Azure</a></li><li><a href="#facebook-auth-provider">Facebook</a></li><li><a href="#github-auth-provider">GitHub</a></li><li><a href="#keycloak-auth-provider">Keycloak</a></li><li><a href="#gitlab-auth-provider">GitLab</a></li><li><a href="#linkedin-auth-provider">LinkedIn</a></li><li><a href="#microsoft-azure-ad-provider">Microsoft Azure AD</a></li><li><a href="#openid-connect-provider">OpenID Connect</a></li><li><a href="#logingov-provider">login.gov</a></li><li><a href="#nextcloud-provider">Nextcloud</a></li><li><a href="#digitalocean-auth-provider">DigitalOcean</a></li><li><a href="#bitbucket-auth-provider">Bitbucket</a></li><li><a href="#gitea-auth-provider">Gitea</a></li></ul><p>The provider can be selected using the <code>provider</code> configuration value.</p><p>Please note that not all providers support all claims. The <code>preferred_username</code> claim is currently only supported by the OpenID Connect provider.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="google-auth-provider"></a>Google Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#google-auth-provider" title="Direct link to heading">#</a></h3><p>For Google, the registration steps are:</p><ol><li>Create a new project: <a href="https://console.developers.google.com/project" target="_blank" rel="noopener noreferrer">https://console.developers.google.com/project</a></li><li>Choose the new project from the top right project dropdown (only if another project is selected)</li><li>In the project Dashboard center pane, choose <strong>&quot;API Manager&quot;</strong></li><li>In the left Nav pane, choose <strong>&quot;Credentials&quot;</strong></li><li>In the center pane, choose <strong>&quot;OAuth consent screen&quot;</strong> tab. Fill in <strong>&quot;Product name shown to users&quot;</strong> and hit save.</li><li>In the center pane, choose <strong>&quot;Credentials&quot;</strong> tab.<ul><li>Open the <strong>&quot;New credentials&quot;</strong> drop down</li><li>Choose <strong>&quot;OAuth client ID&quot;</strong></li><li>Choose <strong>&quot;Web application&quot;</strong></li><li>Application name is freeform, choose something appropriate</li><li>Authorized JavaScript origins is your domain ex: <code>https://internal.yourcompany.com</code></li><li>Authorized redirect URIs is the location of oauth2/callback ex: <code>https://internal.yourcompany.com/oauth2/callback</code></li><li>Choose <strong>&quot;Create&quot;</strong></li></ul></li><li>Take note of the <strong>Client ID</strong> and <strong>Client Secret</strong></li></ol><p>It&#x27;s recommended to refresh sessions on a short interval (1h) with <code>cookie-refresh</code> setting which validates that the account is still authorized.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="restrict-auth-to-specific-google-groups-on-your-domain-optional"></a>Restrict auth to specific Google groups on your domain. (optional)<a aria-hidden="true" tabindex="-1" class="hash-link" href="#restrict-auth-to-specific-google-groups-on-your-domain-optional" title="Direct link to heading">#</a></h4><ol><li>Create a service account: <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount" target="_blank" rel="noopener noreferrer">https://developers.google.com/identity/protocols/OAuth2ServiceAccount</a> and make sure to download the json file.</li><li>Make note of the Client ID for a future step.</li><li>Under &quot;APIs &amp; Auth&quot;, choose APIs.</li><li>Click on Admin SDK and then Enable API.</li><li>Follow the steps on <a href="https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account" target="_blank" rel="noopener noreferrer">https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account</a> and give the client id from step 2 the following oauth scopes:</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.group.readonly</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.user.readonly</span></div></div></div></div></div><ol start="6"><li>Follow the steps on <a href="https://support.google.com/a/answer/60757" target="_blank" rel="noopener noreferrer">https://support.google.com/a/answer/60757</a> to enable Admin API access.</li><li>Create or choose an existing administrative email address on the Gmail domain to assign to the <code>google-admin-email</code> flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.</li><li>Create or choose an existing email group and set that email to the <code>google-group</code> flag. You can pass multiple instances of this flag with different groups
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/oauth_provider">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/oauth_provider">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/oauth_provider">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/oauth_provider">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/oauth_provider">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">OAuth Provider Configuration</h1></header><div class="markdown"><p>You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run <code>oauth2-proxy</code> on.</p><p>Valid providers are :</p><ul><li><a href="#google-auth-provider">Google</a> <em>default</em></li><li><a href="#azure-auth-provider">Azure</a></li><li><a href="#facebook-auth-provider">Facebook</a></li><li><a href="#github-auth-provider">GitHub</a></li><li><a href="#keycloak-auth-provider">Keycloak</a></li><li><a href="#gitlab-auth-provider">GitLab</a></li><li><a href="#linkedin-auth-provider">LinkedIn</a></li><li><a href="#microsoft-azure-ad-provider">Microsoft Azure AD</a></li><li><a href="#openid-connect-provider">OpenID Connect</a></li><li><a href="#logingov-provider">login.gov</a></li><li><a href="#nextcloud-provider">Nextcloud</a></li><li><a href="#digitalocean-auth-provider">DigitalOcean</a></li><li><a href="#bitbucket-auth-provider">Bitbucket</a></li><li><a href="#gitea-auth-provider">Gitea</a></li></ul><p>The provider can be selected using the <code>provider</code> configuration value.</p><p>Please note that not all providers support all claims. The <code>preferred_username</code> claim is currently only supported by the OpenID Connect provider.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="google-auth-provider"></a>Google Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#google-auth-provider" title="Direct link to heading">#</a></h3><p>For Google, the registration steps are:</p><ol><li>Create a new project: <a href="https://console.developers.google.com/project" target="_blank" rel="noopener noreferrer">https://console.developers.google.com/project</a></li><li>Choose the new project from the top right project dropdown (only if another project is selected)</li><li>In the project Dashboard center pane, choose <strong>&quot;API Manager&quot;</strong></li><li>In the left Nav pane, choose <strong>&quot;Credentials&quot;</strong></li><li>In the center pane, choose <strong>&quot;OAuth consent screen&quot;</strong> tab. Fill in <strong>&quot;Product name shown to users&quot;</strong> and hit save.</li><li>In the center pane, choose <strong>&quot;Credentials&quot;</strong> tab.<ul><li>Open the <strong>&quot;New credentials&quot;</strong> drop down</li><li>Choose <strong>&quot;OAuth client ID&quot;</strong></li><li>Choose <strong>&quot;Web application&quot;</strong></li><li>Application name is freeform, choose something appropriate</li><li>Authorized JavaScript origins is your domain ex: <code>https://internal.yourcompany.com</code></li><li>Authorized redirect URIs is the location of oauth2/callback ex: <code>https://internal.yourcompany.com/oauth2/callback</code></li><li>Choose <strong>&quot;Create&quot;</strong></li></ul></li><li>Take note of the <strong>Client ID</strong> and <strong>Client Secret</strong></li></ol><p>It&#x27;s recommended to refresh sessions on a short interval (1h) with <code>cookie-refresh</code> setting which validates that the account is still authorized.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="restrict-auth-to-specific-google-groups-on-your-domain-optional"></a>Restrict auth to specific Google groups on your domain. (optional)<a aria-hidden="true" tabindex="-1" class="hash-link" href="#restrict-auth-to-specific-google-groups-on-your-domain-optional" title="Direct link to heading">#</a></h4><ol><li>Create a service account: <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount" target="_blank" rel="noopener noreferrer">https://developers.google.com/identity/protocols/OAuth2ServiceAccount</a> and make sure to download the json file.</li><li>Make note of the Client ID for a future step.</li><li>Under &quot;APIs &amp; Auth&quot;, choose APIs.</li><li>Click on Admin SDK and then Enable API.</li><li>Follow the steps on <a href="https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account" target="_blank" rel="noopener noreferrer">https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account</a> and give the client id from step 2 the following oauth scopes:</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.group.readonly</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.user.readonly</span></div></div></div></div></div><ol start="6"><li>Follow the steps on <a href="https://support.google.com/a/answer/60757" target="_blank" rel="noopener noreferrer">https://support.google.com/a/answer/60757</a> to enable Admin API access.</li><li>Create or choose an existing administrative email address on the Gmail domain to assign to the <code>google-admin-email</code> flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.</li><li>Create or choose an existing email group and set that email to the <code>google-group</code> flag. You can pass multiple instances of this flag with different groups
 and the user will be checked against all the provided groups.</li><li>Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the <code>google-service-account-json</code> flag.</li><li>Restart oauth2-proxy.</li></ol><p>Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="azure-auth-provider"></a>Azure Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#azure-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Add an application: go to <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">https://portal.azure.com</a>, choose <strong>&quot;Azure Active Directory&quot;</strong> in the left menu, select <strong>&quot;App registrations&quot;</strong> and then click on <strong>&quot;New app registration&quot;</strong>.</li><li>Pick a name and choose <strong>&quot;Webapp / API&quot;</strong> as application type. Use <code>https://internal.yourcompany.com</code> as Sign-on URL. Click <strong>&quot;Create&quot;</strong>.</li><li>On the <strong>&quot;Settings&quot;</strong> / <strong>&quot;Properties&quot;</strong> page of the app, pick a logo and select <strong>&quot;Multi-tenanted&quot;</strong> if you want to allow users from multiple organizations to access your app. Note down the application ID. Click <strong>&quot;Save&quot;</strong>.</li><li>On the <strong>&quot;Settings&quot;</strong> / <strong>&quot;Required Permissions&quot;</strong> page of the app, click on <strong>&quot;Windows Azure Active Directory&quot;</strong> and then on <strong>&quot;Access the directory as the signed in user&quot;</strong>. Hit <strong>&quot;Save&quot;</strong> and then then on <strong>&quot;Grant permissions&quot;</strong> (you might need another admin to do this).</li><li>On the <strong>&quot;Settings&quot;</strong> / <strong>&quot;Reply URLs&quot;</strong> page of the app, add <code>https://internal.yourcompanycom/oauth2/callback</code> for each host that you want to protect by the oauth2 proxy. Click <strong>&quot;Save&quot;</strong>.</li><li>On the <strong>&quot;Settings&quot;</strong> / <strong>&quot;Keys&quot;</strong> page of the app, add a new key and note down the value after hitting <strong>&quot;Save&quot;</strong>.</li><li>Configure the proxy with</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --provider=azure</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-id=&lt;application ID from step 3&gt;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-secret=&lt;value from step 6&gt;</span></div></div></div></div></div><p>Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn&#x27;t get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <a href="/oauth2-proxy/docs/next/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="facebook-auth-provider"></a>Facebook Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#facebook-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create a new FB App from <a href="https://developers.facebook.com/" target="_blank" rel="noopener noreferrer">https://developers.facebook.com/</a></li><li>Under FB Login, set your Valid OAuth redirect URIs to <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="github-auth-provider"></a>GitHub Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#github-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create a new project: <a href="https://github.com/settings/developers" target="_blank" rel="noopener noreferrer">https://github.com/settings/developers</a></li><li>Under <code>Authorization callback URL</code> enter the correct url ie <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><p>The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with <code>--email-domain=*</code></p><p>NOTE: When <code>--github-user</code> is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.</p><p>To restrict by organization only, include the following flag:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-org=&quot;&quot;: restrict logins to members of this organisation</span></div></div></div></div></div><p>To restrict within an organization to specific teams, include the following flag in addition to <code>-github-org</code>:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-team=&quot;&quot;: restrict logins to members of any of these teams (slug), separated by a comma</span></div></div></div></div></div><p>If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-repo=&quot;&quot;: restrict logins to collaborators of this repository formatted as orgname/repo</span></div></div></div></div></div><p>If you&#x27;d like to allow access to users with <strong>read only</strong> access to a <strong>public</strong> repository you will need to provide a <a href="https://github.com/settings/tokens" target="_blank" rel="noopener noreferrer">token</a> for a user that has write access to the repository. The token must be created with at least the <code>public_repo</code> scope:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-token=&quot;&quot;: the token to use when verifying repository collaborators</span></div></div></div></div></div><p>To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-user=&quot;&quot;: allow logins by username, separated by a comma</span></div></div></div></div></div><p>If you are using GitHub enterprise, make sure you set the following to the appropriate url:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-login-url=&quot;http(s)://&lt;enterprise github host&gt;/login/oauth/authorize&quot;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-redeem-url=&quot;http(s)://&lt;enterprise github host&gt;/login/oauth/access_token&quot;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-validate-url=&quot;http(s)://&lt;enterprise github host&gt;/api/v3&quot;</span></div></div></div></div></div><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="keycloak-auth-provider"></a>Keycloak Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#keycloak-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create new client in your Keycloak with <strong>Access Type</strong> &#x27;confidental&#x27; and <strong>Valid Redirect URIs</strong> &#x27;<a href="https://internal.yourcompany.com/oauth2/callback&#x27;" target="_blank" rel="noopener noreferrer">https://internal.yourcompany.com/oauth2/callback&#x27;</a></li><li>Take note of the Secret in the credential tab of the client</li><li>Create a mapper with <strong>Mapper Type</strong> &#x27;Group Membership&#x27; and <strong>Token Claim Name</strong> &#x27;groups&#x27;.</li></ol><p>Make sure you set the following to the appropriate url:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">--provider=keycloak</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--client-id=&lt;client you have created&gt;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--client-secret=&lt;your client&#x27;s secret&gt;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--login-url=&quot;http(s)://&lt;keycloak host&gt;/auth/realms/&lt;your realm&gt;/protocol/openid-connect/auth&quot;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--redeem-url=&quot;http(s)://&lt;keycloak host&gt;/auth/realms/&lt;your realm&gt;/protocol/openid-connect/token&quot;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--profile-url=&quot;http(s)://&lt;keycloak host&gt;/auth/realms/&lt;your realm&gt;/protocol/openid-connect/userinfo&quot;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--validate-url=&quot;http(s)://&lt;keycloak host&gt;/auth/realms/&lt;your realm&gt;/protocol/openid-connect/userinfo&quot;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--keycloak-group=&lt;first_allowed_user_group&gt;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">--keycloak-group=&lt;second_allowed_user_group&gt;</span></div></div></div></div></div><p>For group based authorization, the optional <code>--keycloak-group</code> (legacy) or <code>--allowed-group</code> (global standard)
 flags can be used to specify which groups to limit access to.</p><p>If these are unset but a <code>groups</code> mapper is set up above in step (3), the provider will still
 populate the <code>X-Forwarded-Groups</code> header to your upstream server with the <code>groups</code> data in the
@@ -59,14 +59,14 @@ to setup the client id and client secret. Your &quot;Redirection URI&quot; will
 <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
 new <code>Provider</code>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/357fe94d.f0a0c172.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/357fe94d.283fb6a4.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/configuration/overview/index.html b/docs/next/configuration/overview/index.html
index 510247e9..e655768c 100644
--- a/docs/next/configuration/overview/index.html
+++ b/docs/next/configuration/overview/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via config file, command line options or environment variables."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via config file, command line options or environment variables."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/0f425520.6e17044c.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/0f425520.f6f59f9b.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/overview">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/overview">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/overview">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/overview">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/overview">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Overview</h1></header><div class="markdown"><p><code>oauth2-proxy</code> can be configured via <a href="#config-file">config file</a>, <a href="#command-line-options">command line options</a> or <a href="#environment-variables">environment variables</a>.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="generating-a-cookie-secret"></a>Generating a Cookie Secret<a aria-hidden="true" tabindex="-1" class="hash-link" href="#generating-a-cookie-secret" title="Direct link to heading">#</a></h3><p>To generate a strong cookie secret use <code>python -c &#x27;import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())&#x27;</code></p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="config-file"></a>Config File<a aria-hidden="true" tabindex="-1" class="hash-link" href="#config-file" title="Direct link to heading">#</a></h3><p>Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (_). If the argument can be specified multiple times, the config option should be plural (trailing s).</p><p>An example <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example" target="_blank" rel="noopener noreferrer">oauth2-proxy.cfg</a> config file is in the contrib directory. It can be used by specifying <code>--config=/etc/oauth2-proxy.cfg</code></p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="command-line-options"></a>Command Line Options<a aria-hidden="true" tabindex="-1" class="hash-link" href="#command-line-options" title="Direct link to heading">#</a></h3><table><thead><tr><th>Option</th><th>Type</th><th>Description</th><th>Default</th></tr></thead><tbody><tr><td><code>--acr-values</code></td><td>string</td><td>optional, see <a href="https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues" target="_blank" rel="noopener noreferrer">docs</a></td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--approval-prompt</code></td><td>string</td><td>OAuth approval_prompt</td><td><code>&quot;force&quot;</code></td></tr><tr><td><code>--auth-logging</code></td><td>bool</td><td>Log authentication attempts</td><td>true</td></tr><tr><td><code>--auth-logging-format</code></td><td>string</td><td>Template for authentication log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--authenticated-emails-file</code></td><td>string</td><td>authenticate against emails via file (one per line)</td><td></td></tr><tr><td><code>--azure-tenant</code></td><td>string</td><td>go to a tenant-specific or common (tenant-independent) endpoint.</td><td><code>&quot;common&quot;</code></td></tr><tr><td><code>--basic-auth-password</code></td><td>string</td><td>the password to set when passing the HTTP Basic Auth header</td><td></td></tr><tr><td><code>--client-id</code></td><td>string</td><td>the OAuth Client ID, e.g. <code>&quot;123456.apps.googleusercontent.com&quot;</code></td><td></td></tr><tr><td><code>--client-secret</code></td><td>string</td><td>the OAuth Client Secret</td><td></td></tr><tr><td><code>--client-secret-file</code></td><td>string</td><td>the file with OAuth Client Secret</td><td></td></tr><tr><td><code>--config</code></td><td>string</td><td>path to config file</td><td></td></tr><tr><td><code>--cookie-domain</code></td><td>string | list</td><td>Optional cookie domains to force cookies to (e.g. <code>.yourcompany.com</code>). The longest domain matching the request&#x27;s host will be used (or the shortest cookie domain if there is no match).</td><td></td></tr><tr><td><code>--cookie-expire</code></td><td>duration</td><td>expire timeframe for cookie</td><td>168h0m0s</td></tr><tr><td><code>--cookie-httponly</code></td><td>bool</td><td>set HttpOnly cookie flag</td><td>true</td></tr><tr><td><code>--cookie-name</code></td><td>string</td><td>the name of the cookie that the oauth_proxy creates</td><td><code>&quot;_oauth2_proxy&quot;</code></td></tr><tr><td><code>--cookie-path</code></td><td>string</td><td>an optional cookie path to force cookies to (e.g. <code>/poc/</code>)</td><td><code>&quot;/&quot;</code></td></tr><tr><td><code>--cookie-refresh</code></td><td>duration</td><td>refresh the cookie after this duration; <code>0</code> to disable; not supported by all providers [<a href="#footnote1">1</a>]</td><td></td></tr><tr><td><code>--cookie-secret</code></td><td>string</td><td>the seed string for secure cookies (optionally base64 encoded)</td><td></td></tr><tr><td><code>--cookie-secure</code></td><td>bool</td><td>set <a href="https://owasp.org/www-community/controls/SecureFlag" target="_blank" rel="noopener noreferrer">secure (HTTPS only) cookie flag</a></td><td>true</td></tr><tr><td><code>--cookie-samesite</code></td><td>string</td><td>set SameSite cookie attribute (<code>&quot;lax&quot;</code>, <code>&quot;strict&quot;</code>, <code>&quot;none&quot;</code>, or <code>&quot;&quot;</code>).</td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--custom-templates-dir</code></td><td>string</td><td>path to custom html templates</td><td></td></tr><tr><td><code>--custom-sign-in-logo</code></td><td>string</td><td>path to an custom image for the sign_in page logo. Use \&quot;-\&quot; to disable default logo.</td><td></td></tr><tr><td><code>--display-htpasswd-form</code></td><td>bool</td><td>display username / password login form if an htpasswd file is provided</td><td>true</td></tr><tr><td><code>--email-domain</code></td><td>string | list</td><td>authenticate emails with the specified domain (may be given multiple times). Use <code>*</code> to authenticate any email</td><td></td></tr><tr><td><code>--errors-to-info-log</code></td><td>bool</td><td>redirects error-level logging to default log channel instead of stderr</td><td></td></tr><tr><td><code>--extra-jwt-issuers</code></td><td>string</td><td>if <code>--skip-jwt-bearer-tokens</code> is set, a list of extra JWT <code>issuer=audience</code> (see a token&#x27;s <code>iss</code>, <code>aud</code> fields) pairs (where the issuer URL has a <code>.well-known/openid-configuration</code> or a <code>.well-known/jwks.json</code>)</td><td></td></tr><tr><td><code>--exclude-logging-paths</code></td><td>string</td><td>comma separated list of paths to exclude from logging, e.g. <code>&quot;/ping,/path2&quot;</code></td><td><code>&quot;&quot;</code> (no paths excluded)</td></tr><tr><td><code>--flush-interval</code></td><td>duration</td><td>period between flushing response buffers when streaming responses</td><td><code>&quot;1s&quot;</code></td></tr><tr><td><code>--force-https</code></td><td>bool</td><td>enforce https redirect</td><td><code>false</code></td></tr><tr><td><code>--banner</code></td><td>string</td><td>custom (html) banner string. Use <code>&quot;-&quot;</code> to disable default banner.</td><td></td></tr><tr><td><code>--footer</code></td><td>string</td><td>custom (html) footer string. Use <code>&quot;-&quot;</code> to disable default footer.</td><td></td></tr><tr><td><code>--gcp-healthchecks</code></td><td>bool</td><td>will enable <code>/liveness_check</code>, <code>/readiness_check</code>, and <code>/</code> (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses</td><td>false</td></tr><tr><td><code>--github-org</code></td><td>string</td><td>restrict logins to members of this organisation</td><td></td></tr><tr><td><code>--github-team</code></td><td>string</td><td>restrict logins to members of any of these teams (slug), separated by a comma</td><td></td></tr><tr><td><code>--github-repo</code></td><td>string</td><td>restrict logins to collaborators of this repository formatted as <code>orgname/repo</code></td><td></td></tr><tr><td><code>--github-token</code></td><td>string</td><td>the token to use when verifying repository collaborators (must have push access to the repository)</td><td></td></tr><tr><td><code>--github-user</code></td><td>string | list</td><td>To allow users to login by username even if they do not belong to the specified org and team or collaborators</td><td></td></tr><tr><td><code>--gitlab-group</code></td><td>string | list</td><td>restrict logins to members of any of these groups (slug), separated by a comma</td><td></td></tr><tr><td><code>--gitlab-projects</code></td><td>string | list</td><td>restrict logins to members of any of these projects (may be given multiple times) formatted as <code>orgname/repo=accesslevel</code>. Access level should be a value matching <a href="https://docs.gitlab.com/ee/api/members.html#valid-access-levels" target="_blank" rel="noopener noreferrer">Gitlab access levels</a>, defaulted to 20 if absent</td><td></td></tr><tr><td><code>--google-admin-email</code></td><td>string</td><td>the google admin to impersonate for api calls</td><td></td></tr><tr><td><code>--google-group</code></td><td>string</td><td>restrict logins to members of this google group (may be given multiple times).</td><td></td></tr><tr><td><code>--google-service-account-json</code></td><td>string</td><td>the path to the service account json credentials</td><td></td></tr><tr><td><code>--htpasswd-file</code></td><td>string</td><td>additionally authenticate against a htpasswd file. Entries must be created with <code>htpasswd -B</code> for bcrypt encryption</td><td></td></tr><tr><td><code>--htpasswd-user-group</code></td><td>string | list</td><td>the groups to be set on sessions for htpasswd users</td><td></td></tr><tr><td><code>--http-address</code></td><td>string</td><td><code>[http://]&lt;addr&gt;:&lt;port&gt;</code> or <code>unix://&lt;path&gt;</code> to listen on for HTTP clients</td><td><code>&quot;127.0.0.1:4180&quot;</code></td></tr><tr><td><code>--https-address</code></td><td>string</td><td><code>&lt;addr&gt;:&lt;port&gt;</code> to listen on for HTTPS clients</td><td><code>&quot;:443&quot;</code></td></tr><tr><td><code>--logging-compress</code></td><td>bool</td><td>Should rotated log files be compressed using gzip</td><td>false</td></tr><tr><td><code>--logging-filename</code></td><td>string</td><td>File to log requests to, empty for <code>stdout</code></td><td><code>&quot;&quot;</code> (stdout)</td></tr><tr><td><code>--logging-local-time</code></td><td>bool</td><td>Use local time in log files and backup filenames instead of UTC</td><td>true (local time)</td></tr><tr><td><code>--logging-max-age</code></td><td>int</td><td>Maximum number of days to retain old log files</td><td>7</td></tr><tr><td><code>--logging-max-backups</code></td><td>int</td><td>Maximum number of old log files to retain; 0 to disable</td><td>0</td></tr><tr><td><code>--logging-max-size</code></td><td>int</td><td>Maximum size in megabytes of the log file before rotation</td><td>100</td></tr><tr><td><code>--jwt-key</code></td><td>string</td><td>private key in PEM format used to sign JWT, so that you can say something like <code>--jwt-key=&quot;${OAUTH2_PROXY_JWT_KEY}&quot;</code>: required by login.gov</td><td></td></tr><tr><td><code>--jwt-key-file</code></td><td>string</td><td>path to the private key file in PEM format used to sign the JWT so that you can say something like <code>--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem</code>: required by login.gov</td><td></td></tr><tr><td><code>--login-url</code></td><td>string</td><td>Authentication endpoint</td><td></td></tr><tr><td><code>--insecure-oidc-allow-unverified-email</code></td><td>bool</td><td>don&#x27;t fail if an email address in an id_token is not verified</td><td>false</td></tr><tr><td><code>--insecure-oidc-skip-issuer-verification</code></td><td>bool</td><td>allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)</td><td>false</td></tr><tr><td><code>--oidc-issuer-url</code></td><td>string</td><td>the OpenID Connect issuer URL, e.g. <code>&quot;https://accounts.google.com&quot;</code></td><td></td></tr><tr><td><code>--oidc-jwks-url</code></td><td>string</td><td>OIDC JWKS URI for token verification; required if OIDC discovery is disabled</td><td></td></tr><tr><td><code>--oidc-email-claim</code></td><td>string</td><td>which OIDC claim contains the user&#x27;s email</td><td><code>&quot;email&quot;</code></td></tr><tr><td><code>--oidc-groups-claim</code></td><td>string</td><td>which OIDC claim contains the user groups</td><td><code>&quot;groups&quot;</code></td></tr><tr><td><code>--pass-access-token</code></td><td>bool</td><td>pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with <code>--set-xauthrequest</code> this adds the X-Auth-Request-Access-Token header to the response</td><td>false</td></tr><tr><td><code>--pass-authorization-header</code></td><td>bool</td><td>pass OIDC IDToken to upstream via Authorization Bearer header</td><td>false</td></tr><tr><td><code>--pass-basic-auth</code></td><td>bool</td><td>pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream</td><td>true</td></tr><tr><td><code>--prefer-email-to-user</code></td><td>bool</td><td>Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with <code>--pass-basic-auth</code> and <code>--pass-user-headers</code></td><td>false</td></tr><tr><td><code>--pass-host-header</code></td><td>bool</td><td>pass the request Host Header to upstream</td><td>true</td></tr><tr><td><code>--pass-user-headers</code></td><td>bool</td><td>pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream</td><td>true</td></tr><tr><td><code>--profile-url</code></td><td>string</td><td>Profile access endpoint</td><td></td></tr><tr><td><code>--prompt</code></td><td>string</td><td><a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" target="_blank" rel="noopener noreferrer">OIDC prompt</a>; if present, <code>approval-prompt</code> is ignored</td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--provider</code></td><td>string</td><td>OAuth provider</td><td>google</td></tr><tr><td><code>--provider-ca-file</code></td><td>string | list</td><td>Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead.</td><td></td></tr><tr><td><code>--provider-display-name</code></td><td>string</td><td>Override the provider&#x27;s name with the given string; used for the sign-in page</td><td>(depends on provider)</td></tr><tr><td><code>--ping-path</code></td><td>string</td><td>the ping endpoint that can be used for basic health checks</td><td><code>&quot;/ping&quot;</code></td></tr><tr><td><code>--ping-user-agent</code></td><td>string</td><td>a User-Agent that can be used for basic health checks</td><td><code>&quot;&quot;</code> (don&#x27;t check user agent)</td></tr><tr><td><code>--metrics-address</code></td><td>string</td><td>the address prometheus metrics will be scraped from</td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--proxy-prefix</code></td><td>string</td><td>the url root path that this proxy should be nested under (e.g. /<code>&lt;oauth2&gt;/sign_in</code>)</td><td><code>&quot;/oauth2&quot;</code></td></tr><tr><td><code>--proxy-websockets</code></td><td>bool</td><td>enables WebSocket proxying</td><td>true</td></tr><tr><td><code>--pubjwk-url</code></td><td>string</td><td>JWK pubkey access endpoint: required by login.gov</td><td></td></tr><tr><td><code>--real-client-ip-header</code></td><td>string</td><td>Header used to determine the real IP of the client, requires <code>--reverse-proxy</code> to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)</td><td>X-Real-IP</td></tr><tr><td><code>--redeem-url</code></td><td>string</td><td>Token redemption endpoint</td><td></td></tr><tr><td><code>--redirect-url</code></td><td>string</td><td>the OAuth Redirect URL, e.g. <code>&quot;https://internalapp.yourcompany.com/oauth2/callback&quot;</code></td><td></td></tr><tr><td><code>--redis-cluster-connection-urls</code></td><td>string | list</td><td>List of Redis cluster connection URLs (e.g. <code>redis://HOST[:PORT]</code>). Used in conjunction with <code>--redis-use-cluster</code></td><td></td></tr><tr><td><code>--redis-connection-url</code></td><td>string</td><td>URL of redis server for redis session storage (e.g. <code>redis://HOST[:PORT]</code>)</td><td></td></tr><tr><td><code>--redis-password</code></td><td>string</td><td>Redis password. Applicable for all Redis configurations. Will override any password set in <code>--redis-connection-url</code></td><td></td></tr><tr><td><code>--redis-sentinel-password</code></td><td>string</td><td>Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use <code>--redis-password</code></td><td></td></tr><tr><td><code>--redis-sentinel-master-name</code></td><td>string</td><td>Redis sentinel master name. Used in conjunction with <code>--redis-use-sentinel</code></td><td></td></tr><tr><td><code>--redis-sentinel-connection-urls</code></td><td>string | list</td><td>List of Redis sentinel connection URLs (e.g. <code>redis://HOST[:PORT]</code>). Used in conjunction with <code>--redis-use-sentinel</code></td><td></td></tr><tr><td><code>--redis-use-cluster</code></td><td>bool</td><td>Connect to redis cluster. Must set <code>--redis-cluster-connection-urls</code> to use this feature</td><td>false</td></tr><tr><td><code>--redis-use-sentinel</code></td><td>bool</td><td>Connect to redis via sentinels. Must set <code>--redis-sentinel-master-name</code> and <code>--redis-sentinel-connection-urls</code> to use this feature</td><td>false</td></tr><tr><td><code>--request-logging</code></td><td>bool</td><td>Log requests</td><td>true</td></tr><tr><td><code>--request-logging-format</code></td><td>string</td><td>Template for request log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--resource</code></td><td>string</td><td>The resource that is protected (Azure AD only)</td><td></td></tr><tr><td><code>--reverse-proxy</code></td><td>bool</td><td>are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection</td><td>false</td></tr><tr><td><code>--scope</code></td><td>string</td><td>OAuth scope specification</td><td></td></tr><tr><td><code>--session-cookie-minimal</code></td><td>bool</td><td>strip OAuth tokens from cookie session stores if they aren&#x27;t needed (cookie session store only)</td><td>false</td></tr><tr><td><code>--session-store-type</code></td><td>string</td><td><a href="/oauth2-proxy/docs/next/configuration/session_storage">Session data storage backend</a>; redis or cookie</td><td>cookie</td></tr><tr><td><code>--set-xauthrequest</code></td><td>bool</td><td>set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with <code>--pass-access-token</code>, X-Auth-Request-Access-Token is added to response headers.</td><td>false</td></tr><tr><td><code>--set-authorization-header</code></td><td>bool</td><td>set Authorization Bearer response header (useful in Nginx auth_request mode)</td><td>false</td></tr><tr><td><code>--set-basic-auth</code></td><td>bool</td><td>set HTTP Basic Auth information in response (useful in Nginx auth_request mode)</td><td>false</td></tr><tr><td><code>--show-debug-on-error</code></td><td>bool</td><td>show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)</td><td>false</td></tr><tr><td><code>--signature-key</code></td><td>string</td><td>GAP-Signature request signature key (algorithm:secretkey)</td><td></td></tr><tr><td><code>--silence-ping-logging</code></td><td>bool</td><td>disable logging of requests to ping endpoint</td><td>false</td></tr><tr><td><code>--skip-auth-preflight</code></td><td>bool</td><td>will skip authentication for OPTIONS requests</td><td>false</td></tr><tr><td><code>--skip-auth-regex</code></td><td>string | list</td><td>(DEPRECATED for <code>--skip-auth-route</code>) bypass authentication for requests paths that match (may be given multiple times)</td><td></td></tr><tr><td><code>--skip-auth-route</code></td><td>string | list</td><td>bypass authentication for requests that match the method &amp; path. Format: method=path_regex OR path_regex alone for all methods</td><td></td></tr><tr><td><code>--skip-auth-strip-headers</code></td><td>bool</td><td>strips <code>X-Forwarded-*</code> style authentication headers &amp; <code>Authorization</code> header if they would be set by oauth2-proxy</td><td>true</td></tr><tr><td><code>--skip-jwt-bearer-tokens</code></td><td>bool</td><td>will skip requests that have verified JWT bearer tokens (the token must have <a href="https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields" target="_blank" rel="noopener noreferrer"><code>aud</code></a> that matches this client id or one of the extras from <code>extra-jwt-issuers</code>)</td><td>false</td></tr><tr><td><code>--skip-oidc-discovery</code></td><td>bool</td><td>bypass OIDC endpoint discovery. <code>--login-url</code>, <code>--redeem-url</code> and <code>--oidc-jwks-url</code> must be configured in this case</td><td>false</td></tr><tr><td><code>--skip-provider-button</code></td><td>bool</td><td>will skip sign-in-page to directly reach the next step: oauth/start</td><td>false</td></tr><tr><td><code>--ssl-insecure-skip-verify</code></td><td>bool</td><td>skip validation of certificates presented when using HTTPS providers</td><td>false</td></tr><tr><td><code>--ssl-upstream-insecure-skip-verify</code></td><td>bool</td><td>skip validation of certificates presented when using HTTPS upstreams</td><td>false</td></tr><tr><td><code>--standard-logging</code></td><td>bool</td><td>Log standard runtime information</td><td>true</td></tr><tr><td><code>--standard-logging-format</code></td><td>string</td><td>Template for standard log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--tls-cert-file</code></td><td>string</td><td>path to certificate file</td><td></td></tr><tr><td><code>--tls-key-file</code></td><td>string</td><td>path to private key file</td><td></td></tr><tr><td><code>--upstream</code></td><td>string | list</td><td>the http url(s) of the upstream endpoint, file:// paths for static files or <code>static://&lt;status_code&gt;</code> for static response. Routing is based on the path</td><td></td></tr><tr><td><code>--allowed-group</code></td><td>string | list</td><td>restrict logins to members of this group (may be given multiple times)</td><td></td></tr><tr><td><code>--validate-url</code></td><td>string</td><td>Access token validation endpoint</td><td></td></tr><tr><td><code>--version</code></td><td>n/a</td><td>print version string</td><td></td></tr><tr><td><code>--whitelist-domain</code></td><td>string | list</td><td>allowed domains for redirection after authentication. Prefix domain with a <code>.</code> to allow subdomains (e.g. <code>.example.com</code>) [<a href="#footnote2">2</a>]</td><td></td></tr><tr><td><code>--trusted-ip</code></td><td>string | list</td><td>list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with <code>--reverse-proxy</code> and optionally <code>--real-client-ip-header</code> this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them.</td><td></td></tr></tbody></table><p>[<a name="footnote1">1</a>]: Only these providers support <code>--cookie-refresh</code>: GitLab, Google and OIDC</p><p>[<a name="footnote2">2</a>]: When using the <code>whitelist-domain</code> option, any domain prefixed with a <code>.</code> will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL&#x27;s protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: <code>example.com:8080</code>. To allow any port, use <code>*</code>: <code>example.com:*</code>.</p><p>See below for provider specific options</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstreams-configuration"></a>Upstreams Configuration<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstreams-configuration" title="Direct link to heading">#</a></h3><p><code>oauth2-proxy</code> supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as <code>http://127.0.0.1:8080/</code> for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide <code>http://127.0.0.1:8080/some/path/</code> then it will only be requests that start with <code>/some/path/</code> which are forwarded to the upstream.</p><p>Static file paths are configured as a file:// URL. <code>file:///var/www/static/</code> will serve the files from that directory at <code>http://[oauth2-proxy url]/var/www/static/</code>, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. <code>file:///var/www/static/#/static/</code> will make <code>/var/www/static/</code> available at <code>http://[oauth2-proxy url]/static/</code>.</p><p>Multiple upstreams can either be configured by supplying a comma separated list to the <code>--upstream</code> parameter, supplying the parameter multiple times or providing a list in the <a href="#config-file">config file</a>. When multiple upstreams are used routing to them will be based on the path they are set up with.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="environment-variables"></a>Environment variables<a aria-hidden="true" tabindex="-1" class="hash-link" href="#environment-variables" title="Direct link to heading">#</a></h3><p>Every command line argument can be specified as an environment variable by
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/overview">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/overview">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/overview">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/overview">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/overview">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Overview</h1></header><div class="markdown"><p><code>oauth2-proxy</code> can be configured via <a href="#config-file">config file</a>, <a href="#command-line-options">command line options</a> or <a href="#environment-variables">environment variables</a>.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="generating-a-cookie-secret"></a>Generating a Cookie Secret<a aria-hidden="true" tabindex="-1" class="hash-link" href="#generating-a-cookie-secret" title="Direct link to heading">#</a></h3><p>To generate a strong cookie secret use <code>python -c &#x27;import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())&#x27;</code></p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="config-file"></a>Config File<a aria-hidden="true" tabindex="-1" class="hash-link" href="#config-file" title="Direct link to heading">#</a></h3><p>Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (_). If the argument can be specified multiple times, the config option should be plural (trailing s).</p><p>An example <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example" target="_blank" rel="noopener noreferrer">oauth2-proxy.cfg</a> config file is in the contrib directory. It can be used by specifying <code>--config=/etc/oauth2-proxy.cfg</code></p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="command-line-options"></a>Command Line Options<a aria-hidden="true" tabindex="-1" class="hash-link" href="#command-line-options" title="Direct link to heading">#</a></h3><table><thead><tr><th>Option</th><th>Type</th><th>Description</th><th>Default</th></tr></thead><tbody><tr><td><code>--acr-values</code></td><td>string</td><td>optional, see <a href="https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues" target="_blank" rel="noopener noreferrer">docs</a></td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--approval-prompt</code></td><td>string</td><td>OAuth approval_prompt</td><td><code>&quot;force&quot;</code></td></tr><tr><td><code>--auth-logging</code></td><td>bool</td><td>Log authentication attempts</td><td>true</td></tr><tr><td><code>--auth-logging-format</code></td><td>string</td><td>Template for authentication log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--authenticated-emails-file</code></td><td>string</td><td>authenticate against emails via file (one per line)</td><td></td></tr><tr><td><code>--azure-tenant</code></td><td>string</td><td>go to a tenant-specific or common (tenant-independent) endpoint.</td><td><code>&quot;common&quot;</code></td></tr><tr><td><code>--basic-auth-password</code></td><td>string</td><td>the password to set when passing the HTTP Basic Auth header</td><td></td></tr><tr><td><code>--client-id</code></td><td>string</td><td>the OAuth Client ID, e.g. <code>&quot;123456.apps.googleusercontent.com&quot;</code></td><td></td></tr><tr><td><code>--client-secret</code></td><td>string</td><td>the OAuth Client Secret</td><td></td></tr><tr><td><code>--client-secret-file</code></td><td>string</td><td>the file with OAuth Client Secret</td><td></td></tr><tr><td><code>--config</code></td><td>string</td><td>path to config file</td><td></td></tr><tr><td><code>--cookie-domain</code></td><td>string | list</td><td>Optional cookie domains to force cookies to (e.g. <code>.yourcompany.com</code>). The longest domain matching the request&#x27;s host will be used (or the shortest cookie domain if there is no match).</td><td></td></tr><tr><td><code>--cookie-expire</code></td><td>duration</td><td>expire timeframe for cookie</td><td>168h0m0s</td></tr><tr><td><code>--cookie-httponly</code></td><td>bool</td><td>set HttpOnly cookie flag</td><td>true</td></tr><tr><td><code>--cookie-name</code></td><td>string</td><td>the name of the cookie that the oauth_proxy creates</td><td><code>&quot;_oauth2_proxy&quot;</code></td></tr><tr><td><code>--cookie-path</code></td><td>string</td><td>an optional cookie path to force cookies to (e.g. <code>/poc/</code>)</td><td><code>&quot;/&quot;</code></td></tr><tr><td><code>--cookie-refresh</code></td><td>duration</td><td>refresh the cookie after this duration; <code>0</code> to disable; not supported by all providers [<a href="#footnote1">1</a>]</td><td></td></tr><tr><td><code>--cookie-secret</code></td><td>string</td><td>the seed string for secure cookies (optionally base64 encoded)</td><td></td></tr><tr><td><code>--cookie-secure</code></td><td>bool</td><td>set <a href="https://owasp.org/www-community/controls/SecureFlag" target="_blank" rel="noopener noreferrer">secure (HTTPS only) cookie flag</a></td><td>true</td></tr><tr><td><code>--cookie-samesite</code></td><td>string</td><td>set SameSite cookie attribute (<code>&quot;lax&quot;</code>, <code>&quot;strict&quot;</code>, <code>&quot;none&quot;</code>, or <code>&quot;&quot;</code>).</td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--custom-templates-dir</code></td><td>string</td><td>path to custom html templates</td><td></td></tr><tr><td><code>--custom-sign-in-logo</code></td><td>string</td><td>path to an custom image for the sign_in page logo. Use \&quot;-\&quot; to disable default logo.</td><td></td></tr><tr><td><code>--display-htpasswd-form</code></td><td>bool</td><td>display username / password login form if an htpasswd file is provided</td><td>true</td></tr><tr><td><code>--email-domain</code></td><td>string | list</td><td>authenticate emails with the specified domain (may be given multiple times). Use <code>*</code> to authenticate any email</td><td></td></tr><tr><td><code>--errors-to-info-log</code></td><td>bool</td><td>redirects error-level logging to default log channel instead of stderr</td><td></td></tr><tr><td><code>--extra-jwt-issuers</code></td><td>string</td><td>if <code>--skip-jwt-bearer-tokens</code> is set, a list of extra JWT <code>issuer=audience</code> (see a token&#x27;s <code>iss</code>, <code>aud</code> fields) pairs (where the issuer URL has a <code>.well-known/openid-configuration</code> or a <code>.well-known/jwks.json</code>)</td><td></td></tr><tr><td><code>--exclude-logging-paths</code></td><td>string</td><td>comma separated list of paths to exclude from logging, e.g. <code>&quot;/ping,/path2&quot;</code></td><td><code>&quot;&quot;</code> (no paths excluded)</td></tr><tr><td><code>--flush-interval</code></td><td>duration</td><td>period between flushing response buffers when streaming responses</td><td><code>&quot;1s&quot;</code></td></tr><tr><td><code>--force-https</code></td><td>bool</td><td>enforce https redirect</td><td><code>false</code></td></tr><tr><td><code>--banner</code></td><td>string</td><td>custom (html) banner string. Use <code>&quot;-&quot;</code> to disable default banner.</td><td></td></tr><tr><td><code>--footer</code></td><td>string</td><td>custom (html) footer string. Use <code>&quot;-&quot;</code> to disable default footer.</td><td></td></tr><tr><td><code>--gcp-healthchecks</code></td><td>bool</td><td>will enable <code>/liveness_check</code>, <code>/readiness_check</code>, and <code>/</code> (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses</td><td>false</td></tr><tr><td><code>--github-org</code></td><td>string</td><td>restrict logins to members of this organisation</td><td></td></tr><tr><td><code>--github-team</code></td><td>string</td><td>restrict logins to members of any of these teams (slug), separated by a comma</td><td></td></tr><tr><td><code>--github-repo</code></td><td>string</td><td>restrict logins to collaborators of this repository formatted as <code>orgname/repo</code></td><td></td></tr><tr><td><code>--github-token</code></td><td>string</td><td>the token to use when verifying repository collaborators (must have push access to the repository)</td><td></td></tr><tr><td><code>--github-user</code></td><td>string | list</td><td>To allow users to login by username even if they do not belong to the specified org and team or collaborators</td><td></td></tr><tr><td><code>--gitlab-group</code></td><td>string | list</td><td>restrict logins to members of any of these groups (slug), separated by a comma</td><td></td></tr><tr><td><code>--gitlab-projects</code></td><td>string | list</td><td>restrict logins to members of any of these projects (may be given multiple times) formatted as <code>orgname/repo=accesslevel</code>. Access level should be a value matching <a href="https://docs.gitlab.com/ee/api/members.html#valid-access-levels" target="_blank" rel="noopener noreferrer">Gitlab access levels</a>, defaulted to 20 if absent</td><td></td></tr><tr><td><code>--google-admin-email</code></td><td>string</td><td>the google admin to impersonate for api calls</td><td></td></tr><tr><td><code>--google-group</code></td><td>string</td><td>restrict logins to members of this google group (may be given multiple times).</td><td></td></tr><tr><td><code>--google-service-account-json</code></td><td>string</td><td>the path to the service account json credentials</td><td></td></tr><tr><td><code>--htpasswd-file</code></td><td>string</td><td>additionally authenticate against a htpasswd file. Entries must be created with <code>htpasswd -B</code> for bcrypt encryption</td><td></td></tr><tr><td><code>--htpasswd-user-group</code></td><td>string | list</td><td>the groups to be set on sessions for htpasswd users</td><td></td></tr><tr><td><code>--http-address</code></td><td>string</td><td><code>[http://]&lt;addr&gt;:&lt;port&gt;</code> or <code>unix://&lt;path&gt;</code> to listen on for HTTP clients</td><td><code>&quot;127.0.0.1:4180&quot;</code></td></tr><tr><td><code>--https-address</code></td><td>string</td><td><code>&lt;addr&gt;:&lt;port&gt;</code> to listen on for HTTPS clients</td><td><code>&quot;:443&quot;</code></td></tr><tr><td><code>--logging-compress</code></td><td>bool</td><td>Should rotated log files be compressed using gzip</td><td>false</td></tr><tr><td><code>--logging-filename</code></td><td>string</td><td>File to log requests to, empty for <code>stdout</code></td><td><code>&quot;&quot;</code> (stdout)</td></tr><tr><td><code>--logging-local-time</code></td><td>bool</td><td>Use local time in log files and backup filenames instead of UTC</td><td>true (local time)</td></tr><tr><td><code>--logging-max-age</code></td><td>int</td><td>Maximum number of days to retain old log files</td><td>7</td></tr><tr><td><code>--logging-max-backups</code></td><td>int</td><td>Maximum number of old log files to retain; 0 to disable</td><td>0</td></tr><tr><td><code>--logging-max-size</code></td><td>int</td><td>Maximum size in megabytes of the log file before rotation</td><td>100</td></tr><tr><td><code>--jwt-key</code></td><td>string</td><td>private key in PEM format used to sign JWT, so that you can say something like <code>--jwt-key=&quot;${OAUTH2_PROXY_JWT_KEY}&quot;</code>: required by login.gov</td><td></td></tr><tr><td><code>--jwt-key-file</code></td><td>string</td><td>path to the private key file in PEM format used to sign the JWT so that you can say something like <code>--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem</code>: required by login.gov</td><td></td></tr><tr><td><code>--login-url</code></td><td>string</td><td>Authentication endpoint</td><td></td></tr><tr><td><code>--insecure-oidc-allow-unverified-email</code></td><td>bool</td><td>don&#x27;t fail if an email address in an id_token is not verified</td><td>false</td></tr><tr><td><code>--insecure-oidc-skip-issuer-verification</code></td><td>bool</td><td>allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)</td><td>false</td></tr><tr><td><code>--oidc-issuer-url</code></td><td>string</td><td>the OpenID Connect issuer URL, e.g. <code>&quot;https://accounts.google.com&quot;</code></td><td></td></tr><tr><td><code>--oidc-jwks-url</code></td><td>string</td><td>OIDC JWKS URI for token verification; required if OIDC discovery is disabled</td><td></td></tr><tr><td><code>--oidc-email-claim</code></td><td>string</td><td>which OIDC claim contains the user&#x27;s email</td><td><code>&quot;email&quot;</code></td></tr><tr><td><code>--oidc-groups-claim</code></td><td>string</td><td>which OIDC claim contains the user groups</td><td><code>&quot;groups&quot;</code></td></tr><tr><td><code>--pass-access-token</code></td><td>bool</td><td>pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with <code>--set-xauthrequest</code> this adds the X-Auth-Request-Access-Token header to the response</td><td>false</td></tr><tr><td><code>--pass-authorization-header</code></td><td>bool</td><td>pass OIDC IDToken to upstream via Authorization Bearer header</td><td>false</td></tr><tr><td><code>--pass-basic-auth</code></td><td>bool</td><td>pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream</td><td>true</td></tr><tr><td><code>--prefer-email-to-user</code></td><td>bool</td><td>Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with <code>--pass-basic-auth</code> and <code>--pass-user-headers</code></td><td>false</td></tr><tr><td><code>--pass-host-header</code></td><td>bool</td><td>pass the request Host Header to upstream</td><td>true</td></tr><tr><td><code>--pass-user-headers</code></td><td>bool</td><td>pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream</td><td>true</td></tr><tr><td><code>--profile-url</code></td><td>string</td><td>Profile access endpoint</td><td></td></tr><tr><td><code>--prompt</code></td><td>string</td><td><a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" target="_blank" rel="noopener noreferrer">OIDC prompt</a>; if present, <code>approval-prompt</code> is ignored</td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--provider</code></td><td>string</td><td>OAuth provider</td><td>google</td></tr><tr><td><code>--provider-ca-file</code></td><td>string | list</td><td>Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead.</td><td></td></tr><tr><td><code>--provider-display-name</code></td><td>string</td><td>Override the provider&#x27;s name with the given string; used for the sign-in page</td><td>(depends on provider)</td></tr><tr><td><code>--ping-path</code></td><td>string</td><td>the ping endpoint that can be used for basic health checks</td><td><code>&quot;/ping&quot;</code></td></tr><tr><td><code>--ping-user-agent</code></td><td>string</td><td>a User-Agent that can be used for basic health checks</td><td><code>&quot;&quot;</code> (don&#x27;t check user agent)</td></tr><tr><td><code>--metrics-address</code></td><td>string</td><td>the address prometheus metrics will be scraped from</td><td><code>&quot;&quot;</code></td></tr><tr><td><code>--proxy-prefix</code></td><td>string</td><td>the url root path that this proxy should be nested under (e.g. /<code>&lt;oauth2&gt;/sign_in</code>)</td><td><code>&quot;/oauth2&quot;</code></td></tr><tr><td><code>--proxy-websockets</code></td><td>bool</td><td>enables WebSocket proxying</td><td>true</td></tr><tr><td><code>--pubjwk-url</code></td><td>string</td><td>JWK pubkey access endpoint: required by login.gov</td><td></td></tr><tr><td><code>--real-client-ip-header</code></td><td>string</td><td>Header used to determine the real IP of the client, requires <code>--reverse-proxy</code> to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)</td><td>X-Real-IP</td></tr><tr><td><code>--redeem-url</code></td><td>string</td><td>Token redemption endpoint</td><td></td></tr><tr><td><code>--redirect-url</code></td><td>string</td><td>the OAuth Redirect URL, e.g. <code>&quot;https://internalapp.yourcompany.com/oauth2/callback&quot;</code></td><td></td></tr><tr><td><code>--redis-cluster-connection-urls</code></td><td>string | list</td><td>List of Redis cluster connection URLs (e.g. <code>redis://HOST[:PORT]</code>). Used in conjunction with <code>--redis-use-cluster</code></td><td></td></tr><tr><td><code>--redis-connection-url</code></td><td>string</td><td>URL of redis server for redis session storage (e.g. <code>redis://HOST[:PORT]</code>)</td><td></td></tr><tr><td><code>--redis-password</code></td><td>string</td><td>Redis password. Applicable for all Redis configurations. Will override any password set in <code>--redis-connection-url</code></td><td></td></tr><tr><td><code>--redis-sentinel-password</code></td><td>string</td><td>Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use <code>--redis-password</code></td><td></td></tr><tr><td><code>--redis-sentinel-master-name</code></td><td>string</td><td>Redis sentinel master name. Used in conjunction with <code>--redis-use-sentinel</code></td><td></td></tr><tr><td><code>--redis-sentinel-connection-urls</code></td><td>string | list</td><td>List of Redis sentinel connection URLs (e.g. <code>redis://HOST[:PORT]</code>). Used in conjunction with <code>--redis-use-sentinel</code></td><td></td></tr><tr><td><code>--redis-use-cluster</code></td><td>bool</td><td>Connect to redis cluster. Must set <code>--redis-cluster-connection-urls</code> to use this feature</td><td>false</td></tr><tr><td><code>--redis-use-sentinel</code></td><td>bool</td><td>Connect to redis via sentinels. Must set <code>--redis-sentinel-master-name</code> and <code>--redis-sentinel-connection-urls</code> to use this feature</td><td>false</td></tr><tr><td><code>--request-logging</code></td><td>bool</td><td>Log requests</td><td>true</td></tr><tr><td><code>--request-logging-format</code></td><td>string</td><td>Template for request log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--resource</code></td><td>string</td><td>The resource that is protected (Azure AD only)</td><td></td></tr><tr><td><code>--reverse-proxy</code></td><td>bool</td><td>are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection</td><td>false</td></tr><tr><td><code>--scope</code></td><td>string</td><td>OAuth scope specification</td><td></td></tr><tr><td><code>--session-cookie-minimal</code></td><td>bool</td><td>strip OAuth tokens from cookie session stores if they aren&#x27;t needed (cookie session store only)</td><td>false</td></tr><tr><td><code>--session-store-type</code></td><td>string</td><td><a href="/oauth2-proxy/docs/next/configuration/session_storage">Session data storage backend</a>; redis or cookie</td><td>cookie</td></tr><tr><td><code>--set-xauthrequest</code></td><td>bool</td><td>set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with <code>--pass-access-token</code>, X-Auth-Request-Access-Token is added to response headers.</td><td>false</td></tr><tr><td><code>--set-authorization-header</code></td><td>bool</td><td>set Authorization Bearer response header (useful in Nginx auth_request mode)</td><td>false</td></tr><tr><td><code>--set-basic-auth</code></td><td>bool</td><td>set HTTP Basic Auth information in response (useful in Nginx auth_request mode)</td><td>false</td></tr><tr><td><code>--show-debug-on-error</code></td><td>bool</td><td>show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)</td><td>false</td></tr><tr><td><code>--signature-key</code></td><td>string</td><td>GAP-Signature request signature key (algorithm:secretkey)</td><td></td></tr><tr><td><code>--silence-ping-logging</code></td><td>bool</td><td>disable logging of requests to ping endpoint</td><td>false</td></tr><tr><td><code>--skip-auth-preflight</code></td><td>bool</td><td>will skip authentication for OPTIONS requests</td><td>false</td></tr><tr><td><code>--skip-auth-regex</code></td><td>string | list</td><td>(DEPRECATED for <code>--skip-auth-route</code>) bypass authentication for requests paths that match (may be given multiple times)</td><td></td></tr><tr><td><code>--skip-auth-route</code></td><td>string | list</td><td>bypass authentication for requests that match the method &amp; path. Format: method=path_regex OR path_regex alone for all methods</td><td></td></tr><tr><td><code>--skip-auth-strip-headers</code></td><td>bool</td><td>strips <code>X-Forwarded-*</code> style authentication headers &amp; <code>Authorization</code> header if they would be set by oauth2-proxy</td><td>true</td></tr><tr><td><code>--skip-jwt-bearer-tokens</code></td><td>bool</td><td>will skip requests that have verified JWT bearer tokens (the token must have <a href="https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields" target="_blank" rel="noopener noreferrer"><code>aud</code></a> that matches this client id or one of the extras from <code>extra-jwt-issuers</code>)</td><td>false</td></tr><tr><td><code>--skip-oidc-discovery</code></td><td>bool</td><td>bypass OIDC endpoint discovery. <code>--login-url</code>, <code>--redeem-url</code> and <code>--oidc-jwks-url</code> must be configured in this case</td><td>false</td></tr><tr><td><code>--skip-provider-button</code></td><td>bool</td><td>will skip sign-in-page to directly reach the next step: oauth/start</td><td>false</td></tr><tr><td><code>--ssl-insecure-skip-verify</code></td><td>bool</td><td>skip validation of certificates presented when using HTTPS providers</td><td>false</td></tr><tr><td><code>--ssl-upstream-insecure-skip-verify</code></td><td>bool</td><td>skip validation of certificates presented when using HTTPS upstreams</td><td>false</td></tr><tr><td><code>--standard-logging</code></td><td>bool</td><td>Log standard runtime information</td><td>true</td></tr><tr><td><code>--standard-logging-format</code></td><td>string</td><td>Template for standard log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--tls-cert-file</code></td><td>string</td><td>path to certificate file</td><td></td></tr><tr><td><code>--tls-key-file</code></td><td>string</td><td>path to private key file</td><td></td></tr><tr><td><code>--upstream</code></td><td>string | list</td><td>the http url(s) of the upstream endpoint, file:// paths for static files or <code>static://&lt;status_code&gt;</code> for static response. Routing is based on the path</td><td></td></tr><tr><td><code>--allowed-group</code></td><td>string | list</td><td>restrict logins to members of this group (may be given multiple times)</td><td></td></tr><tr><td><code>--validate-url</code></td><td>string</td><td>Access token validation endpoint</td><td></td></tr><tr><td><code>--version</code></td><td>n/a</td><td>print version string</td><td></td></tr><tr><td><code>--whitelist-domain</code></td><td>string | list</td><td>allowed domains for redirection after authentication. Prefix domain with a <code>.</code> to allow subdomains (e.g. <code>.example.com</code>) [<a href="#footnote2">2</a>]</td><td></td></tr><tr><td><code>--trusted-ip</code></td><td>string | list</td><td>list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with <code>--reverse-proxy</code> and optionally <code>--real-client-ip-header</code> this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them.</td><td></td></tr></tbody></table><p>[<a name="footnote1">1</a>]: Only these providers support <code>--cookie-refresh</code>: GitLab, Google and OIDC</p><p>[<a name="footnote2">2</a>]: When using the <code>whitelist-domain</code> option, any domain prefixed with a <code>.</code> will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL&#x27;s protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: <code>example.com:8080</code>. To allow any port, use <code>*</code>: <code>example.com:*</code>.</p><p>See below for provider specific options</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="upstreams-configuration"></a>Upstreams Configuration<a aria-hidden="true" tabindex="-1" class="hash-link" href="#upstreams-configuration" title="Direct link to heading">#</a></h3><p><code>oauth2-proxy</code> supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as <code>http://127.0.0.1:8080/</code> for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide <code>http://127.0.0.1:8080/some/path/</code> then it will only be requests that start with <code>/some/path/</code> which are forwarded to the upstream.</p><p>Static file paths are configured as a file:// URL. <code>file:///var/www/static/</code> will serve the files from that directory at <code>http://[oauth2-proxy url]/var/www/static/</code>, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. <code>file:///var/www/static/#/static/</code> will make <code>/var/www/static/</code> available at <code>http://[oauth2-proxy url]/static/</code>.</p><p>Multiple upstreams can either be configured by supplying a comma separated list to the <code>--upstream</code> parameter, supplying the parameter multiple times or providing a list in the <a href="#config-file">config file</a>. When multiple upstreams are used routing to them will be based on the path they are set up with.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="environment-variables"></a>Environment variables<a aria-hidden="true" tabindex="-1" class="hash-link" href="#environment-variables" title="Direct link to heading">#</a></h3><p>Every command line argument can be specified as an environment variable by
 prefixing it with <code>OAUTH2_PROXY_</code>, capitalising it, and replacing hyphens (<code>-</code>)
 with underscores (<code>_</code>). If the argument can be specified multiple times, the
 environment variable should be plural (trailing <code>S</code>).</p><p>This is particularly useful for storing secrets outside of a configuration file
@@ -43,14 +43,14 @@ Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua modu
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">  </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block">
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">  </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">      </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">          </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span></div></div></div></div></div><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/0f425520.6e17044c.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/0f425520.f6f59f9b.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/configuration/session_storage/index.html b/docs/next/configuration/session_storage/index.html
index 1d5e3452..34876069 100644
--- a/docs/next/configuration/session_storage/index.html
+++ b/docs/next/configuration/session_storage/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/9f61b932.52eb58d3.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/9f61b932.18ede719.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/session_storage">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/session_storage">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/session_storage">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/session_storage">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/session_storage">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Session Storage</h1></header><div class="markdown"><p>Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/session_storage">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/session_storage">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/session_storage">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/session_storage">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/session_storage">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Session Storage</h1></header><div class="markdown"><p>Sessions allow a user&#x27;s authentication to be tracked between multiple HTTP
 requests to a service.</p><p>The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
 data in one of the available session storage backends.</p><p>At present the available backends are (as passed to <code>--session-store-type</code>):</p><ul><li><a href="#cookie-storage">cookie</a> (default)</li><li><a href="#redis-storage">redis</a></li></ul><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="cookie-storage"></a>Cookie Storage<a aria-hidden="true" tabindex="-1" class="hash-link" href="#cookie-storage" title="Direct link to heading">#</a></h3><p>The Cookie storage backend is the default backend implementation and has
 been used in the OAuth2 Proxy historically.</p><p>With the Cookie storage backend, all session information is stored in client
@@ -35,14 +35,14 @@ disclosure.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnc
 and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
 <code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/sessions.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/9f61b932.52eb58d3.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/9f61b932.18ede719.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/configuration/tls/index.html b/docs/next/configuration/tls/index.html
index fe68015e..b8e071d1 100644
--- a/docs/next/configuration/tls/index.html
+++ b/docs/next/configuration/tls/index.html
@@ -6,19 +6,19 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/585bdad0.2c674a88.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/585bdad0.ccaae809.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/tls">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/tls">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/tls">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/tls">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/tls">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">TLS Configuration</h1></header><div class="markdown"><p>There are two recommended configurations.</p><ol><li><p>Configure SSL Termination with OAuth2 Proxy by providing a <code>--tls-cert-file=/path/to/cert.pem</code> and <code>--tls-key-file=/path/to/cert.key</code>.</p><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-bash codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">&quot;yourcompany.com&quot;</span><span class="token plain">  </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --tls-cert-file</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">/path/to/cert.pem </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --tls-key-file</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">/path/to/cert.key </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span></div></div></div></div></div></li><li><p>Configure SSL Termination with <a href="http://nginx.org/" target="_blank" rel="noopener noreferrer">Nginx</a> (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....</p><p>Because <code>oauth2-proxy</code> listens on <code>127.0.0.1:4180</code> by default, to listen on all interfaces (needed when using an
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/tls">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/tls">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/tls">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/tls">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/configuration/tls">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">TLS Configuration</h1></header><div class="markdown"><p>There are two recommended configurations.</p><ol><li><p>Configure SSL Termination with OAuth2 Proxy by providing a <code>--tls-cert-file=/path/to/cert.pem</code> and <code>--tls-key-file=/path/to/cert.key</code>.</p><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-bash codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">&quot;yourcompany.com&quot;</span><span class="token plain">  </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --tls-cert-file</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">/path/to/cert.pem </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --tls-key-file</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">/path/to/cert.key </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span></div></div></div></div></div></li><li><p>Configure SSL Termination with <a href="http://nginx.org/" target="_blank" rel="noopener noreferrer">Nginx</a> (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....</p><p>Because <code>oauth2-proxy</code> listens on <code>127.0.0.1:4180</code> by default, to listen on all interfaces (needed when using an
 external load balancer like Amazon ELB or Google Platform Load Balancing) use <code>--http-address=&quot;0.0.0.0:4180&quot;</code> or
 <code>--http-address=&quot;http://:4180&quot;</code>.</p><p>Nginx will listen on port <code>443</code> and handle SSL connections while proxying to <code>oauth2-proxy</code> on port <code>4180</code>.
 <code>oauth2-proxy</code> will then authenticate requests for an upstream application. The external endpoint for this example
@@ -26,14 +26,14 @@ would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx
 via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    listen 443 default ssl;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    server_name internal.yourcompany.com;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    ssl_certificate /path/to/cert.pem;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    ssl_certificate_key /path/to/cert.key;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    add_header Strict-Transport-Security max-age=2592000;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block">
 </span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    location / {</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_pass http://127.0.0.1:4180;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header Host $host;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header X-Real-IP $remote_addr;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_set_header X-Scheme $scheme;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_connect_timeout 1;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_send_timeout 30;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">        proxy_read_timeout 30;</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">    }</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">}</span></div></div></div></div></div><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-bash codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">&quot;yourcompany.com&quot;</span><span class="token plain">  </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">   --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span></div></div></div></div></div></li></ol></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/tls.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/alpha-config"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Alpha Configuration »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/585bdad0.2c674a88.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/585bdad0.ccaae809.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/features/endpoints/index.html b/docs/next/features/endpoints/index.html
index b285f74f..508b7e86 100644
--- a/docs/next/features/endpoints/index.html
+++ b/docs/next/features/endpoints/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/efc9be4b.4d539956.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/efc9be4b.9410a42e.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Endpoints</h1></header><div class="markdown"><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by <code>--metrics-address</code>, disabled by default</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user&#x27;s email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/next/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="sign-out"></a>Sign out<a aria-hidden="true" tabindex="-1" class="hash-link" href="#sign-out" title="Direct link to heading">#</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy&#x27;s own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider&#x27;s sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span></div></div></div></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">...</span></div></div></div></div></div><p>(The &quot;sign_out_page&quot; should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/next/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/endpoints.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/features/request_signatures"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Request Signatures »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/features/endpoints">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Endpoints</h1></header><div class="markdown"><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by <code>--metrics-address</code>, disabled by default</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user&#x27;s email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/next/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="sign-out"></a>Sign out<a aria-hidden="true" tabindex="-1" class="hash-link" href="#sign-out" title="Direct link to heading">#</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy&#x27;s own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider&#x27;s sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span></div></div></div></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">...</span></div></div></div></div></div><p>(The &quot;sign_out_page&quot; should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/next/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/endpoints.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/efc9be4b.4d539956.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/efc9be4b.9410a42e.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/docs/next/features/request_signatures/index.html b/docs/next/features/request_signatures/index.html
deleted file mode 100644
index 08454fdc..00000000
--- a/docs/next/features/request_signatures/index.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="generator" content="Docusaurus v2.0.0-alpha.66">
-<title data-react-helmet="true">Request Signatures | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Request Signatures | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/request_signatures"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/request_signatures"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
-<link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/b5649f1e.3a95cf7b.js" as="script">
-</head>
-<body>
-<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/features/request_signatures">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/features/request_signatures">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/features/request_signatures">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/features/request_signatures">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Request Signatures</h1></header><div class="markdown"><p>If <code>signature_key</code> is defined, proxied requests will be signed with the
-<code>GAP-Signature</code> header, which is a <a href="https://en.wikipedia.org/wiki/Hash-based_message_authentication_code" target="_blank" rel="noopener noreferrer">Hash-based Message Authentication Code
-(HMAC)</a>
-of selected request information and the request body <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go" target="_blank" rel="noopener noreferrer">see <code>SIGNATURE_HEADERS</code>
-in <code>oauthproxy.go</code></a>.</p><p><code>signature_key</code> must be of the form <code>algorithm:secretkey</code>, (ie: <code>signature_key = &quot;sha1:secret0&quot;</code>)</p><p>For more information about HMAC request signature validation, read the
-following:</p><ul><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html" target="_blank" rel="noopener noreferrer">Amazon Web Services: Signing and Authenticating REST
-Requests</a></li><li><a href="http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/" target="_blank" rel="noopener noreferrer">rc3.org: Using HMAC to authenticate Web service
-requests</a></li></ul></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/request_signatures.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/b5649f1e.3a95cf7b.js"></script>
-</body>
-</html>
\ No newline at end of file
diff --git a/docs/next/index.html b/docs/next/index.html
index b8b43cfb..3fb071b9 100644
--- a/docs/next/index.html
+++ b/docs/next/index.html
@@ -6,28 +6,28 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1.  Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1.  Choose how to deploy:"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/39.6bb7dda7.js" as="script">
-<link rel="preload" href="/oauth2-proxy/41.2d80f77f.js" as="script">
-<link rel="preload" href="/oauth2-proxy/935f2afb.86ec86d4.js" as="script">
-<link rel="preload" href="/oauth2-proxy/17896441.2c25168c.js" as="script">
-<link rel="preload" href="/oauth2-proxy/3b8c55ea.1396475e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/38.f7098cec.js" as="script">
+<link rel="preload" href="/oauth2-proxy/40.6add7124.js" as="script">
+<link rel="preload" href="/oauth2-proxy/935f2afb.b9b6fa4f.js" as="script">
+<link rel="preload" href="/oauth2-proxy/17896441.8a8027b4.js" as="script">
+<link rel="preload" href="/oauth2-proxy/3b8c55ea.8319a862.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
-<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/request_signatures">Request Signatures</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Installation</h1></header><div class="markdown"><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.0.1</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt 2&gt;&amp;1 | grep OK</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span></div></div></div></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/next/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/next/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/next/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/installation.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
+<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">7.0.x</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Community</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for OAuth2 Proxy <strong>Next</strong> version.</div><div class="margin-top--md">For up-to-date documentation, see the <strong><a href="/oauth2-proxy/docs/">latest version</a></strong> (7.0.x).</div></div><div class="docItemContainer_3QWW"><article><div><span class="badge badge--secondary">Version: Next</span></div><header><h1 class="docTitle_1Lrw">Installation</h1></header><div class="markdown"><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.0.1</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt 2&gt;&amp;1 | grep OK</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span></div></div></div></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/next/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/next/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/next/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/installation.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/39.6bb7dda7.js"></script>
-<script src="/oauth2-proxy/41.2d80f77f.js"></script>
-<script src="/oauth2-proxy/935f2afb.86ec86d4.js"></script>
-<script src="/oauth2-proxy/17896441.2c25168c.js"></script>
-<script src="/oauth2-proxy/3b8c55ea.1396475e.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/38.f7098cec.js"></script>
+<script src="/oauth2-proxy/40.6add7124.js"></script>
+<script src="/oauth2-proxy/935f2afb.b9b6fa4f.js"></script>
+<script src="/oauth2-proxy/17896441.8a8027b4.js"></script>
+<script src="/oauth2-proxy/3b8c55ea.8319a862.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/ea7cbf6d.51c5dea8.js b/ea7cbf6d.ef6dfe15.js
similarity index 97%
rename from ea7cbf6d.51c5dea8.js
rename to ea7cbf6d.ef6dfe15.js
index add5bdcc..7acd7d59 100644
--- a/ea7cbf6d.51c5dea8.js
+++ b/ea7cbf6d.ef6dfe15.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[31],{88:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return l}));var r=n(2),i=n(6),o=(n(0),n(96)),a={id:"security",title:"Security"},s={unversionedId:"community/security",id:"version-6.1.x/community/security",isDocsHomePage:!1,title:"Security",description:"OAuth2 Proxy is a community project.",source:"@site/versioned_docs/version-6.1.x/community/security.md",slug:"/community/security",permalink:"/oauth2-proxy/docs/6.1.x/community/security",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/community/security.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/6.1.x/features/request_signatures"}},c=[{value:"Security Disclosures",id:"security-disclosures",children:[{value:"How will we respond to disclosures?",id:"how-will-we-respond-to-disclosures",children:[]}]}],u={rightToc:c};function l(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"OAuth2 Proxy is a community project.\nMaintainers do not work on this project full time, and as such,\nwhile we endeavour to respond to disclosures as quickly as possible,\nthis may take longer than in projects with corporate sponsorship."))),Object(o.b)("h2",{id:"security-disclosures"},"Security Disclosures"),Object(o.b)("div",{className:"admonition admonition-important alert alert--info"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"If you believe you have found a vulnerability within OAuth2 Proxy or any of its\ndependencies, please do NOT open an issue or PR on GitHub, please do NOT post any\ndetails publicly."))),Object(o.b)("p",null,"Security disclosures MUST be done in private.\nIf you have found an issue that you would like to bring to the attention of the\nmaintenance team for OAuth2 Proxy, please compose an email and send it to the\nlist of maintainers in our ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS"}),"MAINTAINERS")," file."),Object(o.b)("p",null,"Please include as much detail as possible.\nIdeally, your disclosure should include:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"A reproducible case that can be used to demonstrate the exploit"),Object(o.b)("li",{parentName:"ul"},"How you discovered this vulnerability"),Object(o.b)("li",{parentName:"ul"},"A potential fix for the issue (if you have thought of one)"),Object(o.b)("li",{parentName:"ul"},"Versions affected (if not present in master)"),Object(o.b)("li",{parentName:"ul"},"Your GitHub ID")),Object(o.b)("h3",{id:"how-will-we-respond-to-disclosures"},"How will we respond to disclosures?"),Object(o.b)("p",null,"We use ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories"}),"GitHub Security Advisories"),"\nto privately discuss fixes for disclosed vulnerabilities.\nIf you include a GitHub ID with your disclosure we will add you as a collaborator\nfor the advisory so that you can join the discussion and validate any fixes\nwe may propose."),Object(o.b)("p",null,"For minor issues and previously disclosed vulnerabilities (typically for\ndependencies), we may use regular PRs for fixes and forego the security advisory."),Object(o.b)("p",null,"Once a fix has been agreed upon, we will merge the fix and create a new release.\nIf we have multiple security issues in flight simultaneously, we may delay\nmerging fixes until all patches are ready.\nWe may also backport the fix to previous releases,\nbut this will be at the discretion of the maintainers."))}l.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return m}));var r=n(0),i=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=i.a.createContext({}),l=function(e){var t=i.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return i.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},b=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=r,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?i.a.createElement(m,s(s({ref:t},u),{},{components:n})):i.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var u=2;u<o;u++)a[u]=n[u];return i.a.createElement.apply(null,a)}return i.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[30],{87:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return l}));var r=n(2),i=n(6),o=(n(0),n(95)),a={id:"security",title:"Security"},s={unversionedId:"community/security",id:"version-6.1.x/community/security",isDocsHomePage:!1,title:"Security",description:"OAuth2 Proxy is a community project.",source:"@site/versioned_docs/version-6.1.x/community/security.md",slug:"/community/security",permalink:"/oauth2-proxy/docs/6.1.x/community/security",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/community/security.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/6.1.x/features/request_signatures"}},c=[{value:"Security Disclosures",id:"security-disclosures",children:[{value:"How will we respond to disclosures?",id:"how-will-we-respond-to-disclosures",children:[]}]}],u={rightToc:c};function l(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"OAuth2 Proxy is a community project.\nMaintainers do not work on this project full time, and as such,\nwhile we endeavour to respond to disclosures as quickly as possible,\nthis may take longer than in projects with corporate sponsorship."))),Object(o.b)("h2",{id:"security-disclosures"},"Security Disclosures"),Object(o.b)("div",{className:"admonition admonition-important alert alert--info"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"If you believe you have found a vulnerability within OAuth2 Proxy or any of its\ndependencies, please do NOT open an issue or PR on GitHub, please do NOT post any\ndetails publicly."))),Object(o.b)("p",null,"Security disclosures MUST be done in private.\nIf you have found an issue that you would like to bring to the attention of the\nmaintenance team for OAuth2 Proxy, please compose an email and send it to the\nlist of maintainers in our ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS"}),"MAINTAINERS")," file."),Object(o.b)("p",null,"Please include as much detail as possible.\nIdeally, your disclosure should include:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"A reproducible case that can be used to demonstrate the exploit"),Object(o.b)("li",{parentName:"ul"},"How you discovered this vulnerability"),Object(o.b)("li",{parentName:"ul"},"A potential fix for the issue (if you have thought of one)"),Object(o.b)("li",{parentName:"ul"},"Versions affected (if not present in master)"),Object(o.b)("li",{parentName:"ul"},"Your GitHub ID")),Object(o.b)("h3",{id:"how-will-we-respond-to-disclosures"},"How will we respond to disclosures?"),Object(o.b)("p",null,"We use ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories"}),"GitHub Security Advisories"),"\nto privately discuss fixes for disclosed vulnerabilities.\nIf you include a GitHub ID with your disclosure we will add you as a collaborator\nfor the advisory so that you can join the discussion and validate any fixes\nwe may propose."),Object(o.b)("p",null,"For minor issues and previously disclosed vulnerabilities (typically for\ndependencies), we may use regular PRs for fixes and forego the security advisory."),Object(o.b)("p",null,"Once a fix has been agreed upon, we will merge the fix and create a new release.\nIf we have multiple security issues in flight simultaneously, we may delay\nmerging fixes until all patches are ready.\nWe may also backport the fix to previous releases,\nbut this will be at the discretion of the maintainers."))}l.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return m}));var r=n(0),i=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=i.a.createContext({}),l=function(e){var t=i.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return i.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},b=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=r,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?i.a.createElement(m,s(s({ref:t},u),{},{components:n})):i.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var u=2;u<o;u++)a[u]=n[u];return i.a.createElement.apply(null,a)}return i.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/edfc6e1b.4df93a8a.js b/edfc6e1b.b4905114.js
similarity index 97%
rename from edfc6e1b.4df93a8a.js
rename to edfc6e1b.b4905114.js
index 038b0826..eb7dc886 100644
--- a/edfc6e1b.4df93a8a.js
+++ b/edfc6e1b.b4905114.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[32],{89:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return u}));var i=n(2),r=n(6),o=(n(0),n(96)),a={id:"session_storage",title:"Session Storage"},s={unversionedId:"configuration/session_storage",id:"version-7.0.x/configuration/session_storage",isDocsHomePage:!1,title:"Session Storage",description:"Sessions allow a user's authentication to be tracked between multiple HTTP",source:"@site/versioned_docs/version-7.0.x/configuration/sessions.md",slug:"/configuration/session_storage",permalink:"/oauth2-proxy/docs/configuration/session_storage",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/sessions.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"},next:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/configuration/tls"}},c=[{value:"Cookie Storage",id:"cookie-storage",children:[]},{value:"Redis Storage",id:"redis-storage",children:[]}],l={rightToc:c};function u(e){var t=e.components,n=Object(r.a)(e,["components"]);return Object(o.b)("wrapper",Object(i.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"Sessions allow a user's authentication to be tracked between multiple HTTP\nrequests to a service."),Object(o.b)("p",null,"The OAuth2 Proxy uses a Cookie to track user sessions and will store the session\ndata in one of the available session storage backends."),Object(o.b)("p",null,"At present the available backends are (as passed to ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type"),"):"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#cookie-storage"}),"cookie")," (default)"),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#redis-storage"}),"redis"))),Object(o.b)("h3",{id:"cookie-storage"},"Cookie Storage"),Object(o.b)("p",null,"The Cookie storage backend is the default backend implementation and has\nbeen used in the OAuth2 Proxy historically."),Object(o.b)("p",null,"With the Cookie storage backend, all session information is stored in client\nside cookies and transferred with each and every request."),Object(o.b)("p",null,"The following should be known when using this implementation:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless"),Object(o.b)("li",{parentName:"ul"},"Cookies are signed server side to prevent modification client-side"),Object(o.b)("li",{parentName:"ul"},"It is mandatory to set a ",Object(o.b)("inlineCode",{parentName:"li"},"cookie-secret")," which will ensure data is encrypted within the cookie data."),Object(o.b)("li",{parentName:"ul"},"Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation\ncannot lock sessions and while updating and refreshing sessions, there can be conflicts which force\nusers to re-authenticate")),Object(o.b)("h3",{id:"redis-storage"},"Redis Storage"),Object(o.b)("p",null,"The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information\nback the the client for storage, as in the ",Object(o.b)("a",Object(i.a)({parentName:"p"},{href:"#cookie-storage"}),"Cookie storage"),", a ticket is sent back\nto the user as the cookie value instead."),Object(o.b)("p",null,"A ticket is composed as the following:"),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"{CookieName}-{ticketID}.{secret}")),Object(o.b)("p",null,"Where:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"CookieName")," is the OAuth2 cookie name (_oauth2_proxy by default)"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"ticketID")," is a 128 bit random number, hex-encoded"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"secret")," is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session."),Object(o.b)("li",{parentName:"ul"},"The pair of ",Object(o.b)("inlineCode",{parentName:"li"},"{CookieName}-{ticketID}")," comprises a ticket handle, and thus, the redis key\nto which the session is stored. The encoded session is encrypted with the secret and stored\nin redis via the ",Object(o.b)("inlineCode",{parentName:"li"},"SETEX")," command.")),Object(o.b)("p",null,"Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from\ndisclosure."),Object(o.b)("h4",{id:"usage"},"Usage"),Object(o.b)("p",null,"When using the redis store, specify ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," as well as the Redis connection URL, via\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-connection-url=redis://host[:port][/db-number]"),"."),Object(o.b)("p",null,"You may also configure the store for Redis Sentinel. In this case, you will want to use the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," flag, as well as configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-master-name"),"\nand ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-connection-urls")," appropriately."),Object(o.b)("p",null,"Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," flag, and configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-cluster-connection-urls")," appropriately."),Object(o.b)("p",null,"Note that flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," and ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," are mutually exclusive."))}u.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return h}));var i=n(0),r=n.n(i);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,i,r=function(e,t){if(null==e)return{};var n,i,r={},o=Object.keys(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var l=r.a.createContext({}),u=function(e){var t=r.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return r.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},p=r.a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=i,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?r.a.createElement(h,s(s({ref:t},l),{},{components:n})):r.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l<o;l++)a[l]=n[l];return r.a.createElement.apply(null,a)}return r.a.createElement.apply(null,n)}p.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[31],{88:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return u}));var i=n(2),r=n(6),o=(n(0),n(95)),a={id:"session_storage",title:"Session Storage"},s={unversionedId:"configuration/session_storage",id:"version-7.0.x/configuration/session_storage",isDocsHomePage:!1,title:"Session Storage",description:"Sessions allow a user's authentication to be tracked between multiple HTTP",source:"@site/versioned_docs/version-7.0.x/configuration/sessions.md",slug:"/configuration/session_storage",permalink:"/oauth2-proxy/docs/configuration/session_storage",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/sessions.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"},next:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/configuration/tls"}},c=[{value:"Cookie Storage",id:"cookie-storage",children:[]},{value:"Redis Storage",id:"redis-storage",children:[]}],l={rightToc:c};function u(e){var t=e.components,n=Object(r.a)(e,["components"]);return Object(o.b)("wrapper",Object(i.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"Sessions allow a user's authentication to be tracked between multiple HTTP\nrequests to a service."),Object(o.b)("p",null,"The OAuth2 Proxy uses a Cookie to track user sessions and will store the session\ndata in one of the available session storage backends."),Object(o.b)("p",null,"At present the available backends are (as passed to ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type"),"):"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#cookie-storage"}),"cookie")," (default)"),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#redis-storage"}),"redis"))),Object(o.b)("h3",{id:"cookie-storage"},"Cookie Storage"),Object(o.b)("p",null,"The Cookie storage backend is the default backend implementation and has\nbeen used in the OAuth2 Proxy historically."),Object(o.b)("p",null,"With the Cookie storage backend, all session information is stored in client\nside cookies and transferred with each and every request."),Object(o.b)("p",null,"The following should be known when using this implementation:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless"),Object(o.b)("li",{parentName:"ul"},"Cookies are signed server side to prevent modification client-side"),Object(o.b)("li",{parentName:"ul"},"It is mandatory to set a ",Object(o.b)("inlineCode",{parentName:"li"},"cookie-secret")," which will ensure data is encrypted within the cookie data."),Object(o.b)("li",{parentName:"ul"},"Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation\ncannot lock sessions and while updating and refreshing sessions, there can be conflicts which force\nusers to re-authenticate")),Object(o.b)("h3",{id:"redis-storage"},"Redis Storage"),Object(o.b)("p",null,"The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information\nback the the client for storage, as in the ",Object(o.b)("a",Object(i.a)({parentName:"p"},{href:"#cookie-storage"}),"Cookie storage"),", a ticket is sent back\nto the user as the cookie value instead."),Object(o.b)("p",null,"A ticket is composed as the following:"),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"{CookieName}-{ticketID}.{secret}")),Object(o.b)("p",null,"Where:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"CookieName")," is the OAuth2 cookie name (_oauth2_proxy by default)"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"ticketID")," is a 128 bit random number, hex-encoded"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"secret")," is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session."),Object(o.b)("li",{parentName:"ul"},"The pair of ",Object(o.b)("inlineCode",{parentName:"li"},"{CookieName}-{ticketID}")," comprises a ticket handle, and thus, the redis key\nto which the session is stored. The encoded session is encrypted with the secret and stored\nin redis via the ",Object(o.b)("inlineCode",{parentName:"li"},"SETEX")," command.")),Object(o.b)("p",null,"Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from\ndisclosure."),Object(o.b)("h4",{id:"usage"},"Usage"),Object(o.b)("p",null,"When using the redis store, specify ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," as well as the Redis connection URL, via\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-connection-url=redis://host[:port][/db-number]"),"."),Object(o.b)("p",null,"You may also configure the store for Redis Sentinel. In this case, you will want to use the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," flag, as well as configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-master-name"),"\nand ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-connection-urls")," appropriately."),Object(o.b)("p",null,"Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," flag, and configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-cluster-connection-urls")," appropriately."),Object(o.b)("p",null,"Note that flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," and ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," are mutually exclusive."))}u.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return h}));var i=n(0),r=n.n(i);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,i,r=function(e,t){if(null==e)return{};var n,i,r={},o=Object.keys(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var l=r.a.createContext({}),u=function(e){var t=r.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return r.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},p=r.a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=i,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?r.a.createElement(h,s(s({ref:t},l),{},{components:n})):r.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l<o;l++)a[l]=n[l];return r.a.createElement.apply(null,a)}return r.a.createElement.apply(null,n)}p.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/efc9be4b.4d539956.js b/efc9be4b.4d539956.js
deleted file mode 100644
index 46d427ae..00000000
--- a/efc9be4b.4d539956.js
+++ /dev/null
@@ -1 +0,0 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[33],{90:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return s})),n.d(t,"default",(function(){return p}));var r=n(2),o=n(6),i=(n(0),n(96)),a={id:"endpoints",title:"Endpoints"},c={unversionedId:"features/endpoints",id:"features/endpoints",isDocsHomePage:!1,title:"Endpoints",description:"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.",source:"@site/docs/features/endpoints.md",slug:"/features/endpoints",permalink:"/oauth2-proxy/docs/next/features/endpoints",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/endpoints.md",version:"current",sidebar:"docs",previous:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/next/configuration/alpha-config"},next:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/next/features/request_signatures"}},s=[{value:"Sign out",id:"sign-out",children:[]}],u={rightToc:s};function p(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(i.b)("p",null,"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2")," prefix can be changed with the ",Object(i.b)("inlineCode",{parentName:"p"},"--proxy-prefix")," config variable."),Object(i.b)("ul",null,Object(i.b)("li",{parentName:"ul"},"/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"http://www.robotstxt.org/"}),"robotstxt.org")," for more info"),Object(i.b)("li",{parentName:"ul"},"/ping - returns a 200 OK response, which is intended for use with health checks"),Object(i.b)("li",{parentName:"ul"},"/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by ",Object(i.b)("inlineCode",{parentName:"li"},"--metrics-address"),", disabled by default"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_out - this URL is used to clear the session cookie"),Object(i.b)("li",{parentName:"ul"},"/oauth2/start - a URL that will redirect to start the OAuth cycle"),Object(i.b)("li",{parentName:"ul"},"/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url."),Object(i.b)("li",{parentName:"ul"},"/oauth2/userinfo - the URL is used to return user's email from the session in JSON format."),Object(i.b)("li",{parentName:"ul"},"/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive"}),"Nginx ",Object(i.b)("inlineCode",{parentName:"a"},"auth_request")," directive"))),Object(i.b)("h3",{id:"sign-out"},"Sign out"),Object(i.b)("p",null,"To sign the user out, redirect them to ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2/sign_out"),". This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the ",Object(i.b)("inlineCode",{parentName:"p"},"rd")," query parameter, i.e. redirect the user to something like (notice the url-encoding!):"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page\n")),Object(i.b)("p",null,"Alternatively, include the redirect URL in the ",Object(i.b)("inlineCode",{parentName:"p"},"X-Auth-Request-Redirect")," header:"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"GET /oauth2/sign_out HTTP/1.1\nX-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page\n...\n")),Object(i.b)("p",null,'(The "sign_out_page" should be the ',Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1"}),Object(i.b)("inlineCode",{parentName:"a"},"end_session_endpoint"))," from ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig"}),"the metadata")," if your OIDC provider supports Session Management and Discovery.)"),Object(i.b)("p",null,"BEWARE that the domain you want to redirect to (",Object(i.b)("inlineCode",{parentName:"p"},"my-oidc-provider.example.com")," in the example) must be added to the ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"../configuration/overview"}),Object(i.b)("inlineCode",{parentName:"a"},"--whitelist-domain"))," configuration option otherwise the redirect will be ignored."))}p.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u<i;u++)a[u]=n[u];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,n)}h.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/efc9be4b.9410a42e.js b/efc9be4b.9410a42e.js
new file mode 100644
index 00000000..62963356
--- /dev/null
+++ b/efc9be4b.9410a42e.js
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[32],{89:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return s})),n.d(t,"default",(function(){return u}));var r=n(2),o=n(6),i=(n(0),n(95)),a={id:"endpoints",title:"Endpoints"},c={unversionedId:"features/endpoints",id:"features/endpoints",isDocsHomePage:!1,title:"Endpoints",description:"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.",source:"@site/docs/features/endpoints.md",slug:"/features/endpoints",permalink:"/oauth2-proxy/docs/next/features/endpoints",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/endpoints.md",version:"current",sidebar:"docs",previous:{title:"Alpha Configuration",permalink:"/oauth2-proxy/docs/next/configuration/alpha-config"},next:{title:"Security",permalink:"/oauth2-proxy/docs/next/community/security"}},s=[{value:"Sign out",id:"sign-out",children:[]}],p={rightToc:s};function u(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(r.a)({},p,n,{components:t,mdxType:"MDXLayout"}),Object(i.b)("p",null,"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2")," prefix can be changed with the ",Object(i.b)("inlineCode",{parentName:"p"},"--proxy-prefix")," config variable."),Object(i.b)("ul",null,Object(i.b)("li",{parentName:"ul"},"/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"http://www.robotstxt.org/"}),"robotstxt.org")," for more info"),Object(i.b)("li",{parentName:"ul"},"/ping - returns a 200 OK response, which is intended for use with health checks"),Object(i.b)("li",{parentName:"ul"},"/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by ",Object(i.b)("inlineCode",{parentName:"li"},"--metrics-address"),", disabled by default"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_out - this URL is used to clear the session cookie"),Object(i.b)("li",{parentName:"ul"},"/oauth2/start - a URL that will redirect to start the OAuth cycle"),Object(i.b)("li",{parentName:"ul"},"/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url."),Object(i.b)("li",{parentName:"ul"},"/oauth2/userinfo - the URL is used to return user's email from the session in JSON format."),Object(i.b)("li",{parentName:"ul"},"/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/next/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive"}),"Nginx ",Object(i.b)("inlineCode",{parentName:"a"},"auth_request")," directive"))),Object(i.b)("h3",{id:"sign-out"},"Sign out"),Object(i.b)("p",null,"To sign the user out, redirect them to ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2/sign_out"),". This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the ",Object(i.b)("inlineCode",{parentName:"p"},"rd")," query parameter, i.e. redirect the user to something like (notice the url-encoding!):"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page\n")),Object(i.b)("p",null,"Alternatively, include the redirect URL in the ",Object(i.b)("inlineCode",{parentName:"p"},"X-Auth-Request-Redirect")," header:"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"GET /oauth2/sign_out HTTP/1.1\nX-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page\n...\n")),Object(i.b)("p",null,'(The "sign_out_page" should be the ',Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1"}),Object(i.b)("inlineCode",{parentName:"a"},"end_session_endpoint"))," from ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig"}),"the metadata")," if your OIDC provider supports Session Management and Discovery.)"),Object(i.b)("p",null,"BEWARE that the domain you want to redirect to (",Object(i.b)("inlineCode",{parentName:"p"},"my-oidc-provider.example.com")," in the example) must be added to the ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"../configuration/overview"}),Object(i.b)("inlineCode",{parentName:"a"},"--whitelist-domain"))," configuration option otherwise the redirect will be ignored."))}u.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var p=o.a.createContext({}),u=function(e){var t=o.a.useContext(p),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=u(e.components);return o.a.createElement(p.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,p=s(e,["components","mdxType","originalType","parentName"]),l=u(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},p),{},{components:n})):o.a.createElement(b,c({ref:t},p))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var p=2;p<i;p++)a[p]=n[p];return o.a.createElement.apply(null,a)}return o.a.createElement.apply(null,n)}h.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/f3976560.5b30cd66.js b/f3976560.c5ee70f7.js
similarity index 95%
rename from f3976560.5b30cd66.js
rename to f3976560.c5ee70f7.js
index a81e2672..bbe3759c 100644
--- a/f3976560.5b30cd66.js
+++ b/f3976560.c5ee70f7.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[34],{139:function(M,N,D){"use strict";D.r(N),N.default="data:image/svg+xml;base64,PHN2ZyBpZD0iTGF5ZXJfMSIgZGF0YS1uYW1lPSJMYXllciAxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA4NDAuNTU2NDUgNDEyLjQ1OTA0Ij48ZGVmcz48c3R5bGU+LmNscy0xe2ZpbGw6IzMzMzt9LmNscy0ye2ZpbGw6IzdjN2M4Mjt9LmNscy0ze2ZpbGw6IzA2ZWQ5NDt9LmNscy00e2ZpbGw6IzA1OWI2MTt9LmNscy01e2ZpbGw6IzE5NTdiYTt9LmNscy02e2ZpbGw6IzZjYThmZjt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPk9BdXRoMl9Qcm94eV9sb2dvX3YzPC90aXRsZT48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik00NzQuMjA5MzMsMTk2LjYzMTE2YTQxLjQ2Njc5LDQxLjQ2Njc5LDAsMCwxLTE2LjMzNTA2LTMuMTg5NjQsMzkuODA3NTcsMzkuODA3NTcsMCwwLDEtMjEuNjcwOTItMjEuODM1MTgsNDIuOTk0MDksNDIuOTk0MDksMCwwLDEsMC0zMi4yMywzOS44MDc2NSwzOS44MDc2NSwwLDAsMSwyMS42NzA5Mi0yMS44MzUxOCw0My40MTY2NSw0My40MTY2NSwwLDAsMSwzMi42NzAxMiwwLDM5LjgxMDEsMzkuODEwMSwwLDAsMSwyMS42Njk4OSwyMS44MzUxOCw0Mi45OTQsNDIuOTk0LDAsMCwxLDAsMzIuMjMsMzkuODEsMzkuODEsMCwwLDEtMjEuNjY5ODksMjEuODM1MThBNDEuNDg1LDQxLjQ4NSwwLDAsMSw0NzQuMjA5MzMsMTk2LjYzMTE2Wm0wLTE0LjA3OTg1YTI2LjYzNzE0LDI2LjYzNzE0LDAsMCwwLDEwLjI4NDMxLTEuOTc5OSwyNS44OTg4OSwyNS44OTg4OSwwLDAsMCw4LjM2MDcyLTUuNTAwMTIsMjUuMDQyMjksMjUuMDQyMjksMCwwLDAsNS42MDk2My04LjUyNSwzMS4wNDI5NCwzMS4wNDI5NCwwLDAsMCwwLTIyLjExLDI1LjA3OTYzLDI1LjA3OTYzLDAsMCwwLTUuNjA5NjMtOC41MjU0OSwyNS45MTQ1LDI1LjkxNDUsMCwwLDAtOC4zNjA3Mi01LjQ5OTYxLDI3LjY5NjIsMjcuNjk2MiwwLDAsMC0yMC41Njk2NSwwLDI1Ljg5MjMzLDI1Ljg5MjMzLDAsMCwwLTguMzYwNzIsNS40OTk2MSwyNS4wMzQzNCwyNS4wMzQzNCwwLDAsMC01LjYwOTYyLDguNTI1NDksMzEuMDQyNzksMzEuMDQyNzksMCwwLDAsMCwyMi4xMSwyNC45OTcxNCwyNC45OTcxNCwwLDAsMCw1LjYwOTYyLDguNTI1LDI1Ljg3Njc1LDI1Ljg3Njc1LDAsMCwwLDguMzYwNzIsNS41MDAxMkEyNi42MzExMiwyNi42MzExMiwwLDAsMCw0NzQuMjA5MzMsMTgyLjU1MTMxWiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTU0OC4xMjkzMSwxMTYuMTEwODNoMTYuOTQwNDRsMjkuNTkwNTEsNzguNzYwNDhINTc4LjI2OTQyTDU3MS43Nzk2MSwxNzYuMDYxSDU0MS40MTk0NWwtNi40ODk4MSwxOC44MTAzM0g1MTguNTM5ODNabTE4LjgxMDMyLDQ2LjMxMDQtNy4wMzk0MS0xOS42OS0yLjg2MDYtOS41Njk5NGgtLjg4MDE4bC0yLjg1OTU3LDkuNTY5OTQtNy4wNDA0NCwxOS42OVoiLz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik02MzYuNjc4NzMsMTg3LjgzMTM4aC0uODgwMTlhMTguMjY0NjksMTguMjY0NjksMCwwLDEtNi44MjAzOSw2LjQzNTA2LDE5Ljk0NTQxLDE5Ljk0NTQxLDAsMCwxLTkuNzg5NDcsMi4zNjQ3MnEtMTAuMjMwNTksMC0xNS4yMzQ4My02LjI2OTc3LTUuMDA2ODItNi4yNzA1Mi01LjAwNTI3LTE2LjcyMDRWMTQwLjk3MDg3SDYxMy4zNTl2MzAuOTEwMjdxMCw1LjgzMiwyLjU4NDc3LDguNjM1LDIuNTgzMjEsMi44MDQ4Miw3LjUzNDI1LDIuODA1MzNhMTAuNTAwMDYsMTAuNTAwMDYsMCwwLDAsNS4yMjUzMi0xLjI2NSwxMi4yMTQwNywxMi4yMTQwNywwLDAsMCwzLjg1MDI5LTMuNDEwMTksMTUuNDQyOTMsMTUuNDQyOTMsMCwwLDAsMi40MTk0Ny01LjA2LDIyLjY5NzQ2LDIyLjY5NzQ2LDAsMCwwLC44MjU0My02LjIxNVYxNDAuOTcwODdINjUwLjIwOXY1My45MDA0NEg2MzYuNjc4NzNaIi8+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNjY5LjAxNzIzLDE1My4yOTEzOGgtOS40NjFWMTQwLjk3MDg3aDkuNDYxVjEyNC40NzFoMTQuNDA5NHYxNi40OTk4NGgxMy4yMDA3djEyLjMyMDUxaC0xMy4yMDA3VjE3NC44MjlhMTUuNTQ1NjEsMTUuNTQ1NjEsMCwwLDAsLjM4NTM0LDMuNTcxMzUsNS43OTM2LDUuNzkzNiwwLDAsMCwxLjQ4NDU0LDIuNzc3NDQsNS40NDkxNCw1LjQ0OTE0LDAsMCwwLDQuMzk5ODgsMS44MTM1Nyw4LjAwNTQ3LDguMDA1NDcsMCwwLDAsNS4wNi0xLjQzMDNsNC4wNzAzNCwxMi42NTAwN2EyMy44MzkyNCwyMy44MzkyNCwwLDAsMS01LjQ0NDM0LDEuODE1MTIsMzEuODAyOSwzMS44MDI5LDAsMCwxLTYuNDM1MDUuNjA0ODcsMTkuNjY1MjgsMTkuNjY1MjgsMCwwLDEtNy4zMTUyNC0xLjI5MDg0LDE1LjU0MTUxLDE1LjU0MTUxLDAsMCwxLTUuNDQ1MzctMy41MzY3NXEtNS4xNzEwNy01LjA1MzMxLTUuMTY5NTMtMTQuMzcyNzJaIi8+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNzA3LjczNSwxMTYuMTEwODNoMTQuNDA5NHYyMi4xMTA1bC0uODc5MTUsOS43OWguODc5MTVhMTcuODU0NDcsMTcuODU0NDcsMCwwLDEsNi42NTUxMS02LjMyNSwxOS4zMTQ5MiwxOS4zMTQ5MiwwLDAsMSw5LjczNTc0LTIuNDc1MjZxMTAuNDQ5MDksMCwxNS40NTQ4OCw2LjE2MDI2LDUuMDAzNzEsNi4xNjEyOCw1LjAwNTI3LDE2LjgyOTl2MzIuNjcwMTNINzQ0LjU4NVYxNjMuOTYxcTAtNS42MDk2Mi0yLjY0MDU1LTguNTI1YTkuNDQwMTgsOS40NDAxOCwwLDAsMC03LjM3LTIuOTE0ODQsMTAuODI0ODIsMTAuODI0ODIsMCwwLDAtNS4yODAwNywxLjI2NSwxMS43NjA5MiwxMS43NjA5MiwwLDAsMC0zLjkwNCwzLjQ2NSwxNi4wOTQyOSwxNi4wOTQyOSwwLDAsMC0yLjQyMDUsNS4xMTQ3OCwyMi43NDgsMjIuNzQ4LDAsMCwwLS44MjU0NCw2LjIxNXYyNi4yOTAzNEg3MDcuNzM1WiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTc2OS43NzM1MywxOTQuODcxMzFWMTgxLjc4MTE1cTYuNDg5NzktNi4zNzgyNCwxMS45ODk5Mi0xMS44Nzk5MSwyLjMxMDQ4LTIuMzA5Nyw0LjczMDQ4LTQuNzMsMi40MTc0LTIuNDE4MTgsNC41MDkzOS00LjUwOTkxLDIuMDg4ODgtMi4wODg4OSwzLjc0MDc4LTMuNzk1LDEuNjQ4OC0xLjcwNDU4LDIuNTMtMi42OTUzMSwxLjc1NzI2LTIuMDg4MTEsMy4xMzQzNi0zLjczOTc1YTE4LjE2NDEzLDE4LjE2NDEzLDAsMCwwLDIuMjAwNDYtMy4yNDU0MiwxNi40NzQ3MiwxNi40NzQ3MiwwLDAsMCwxLjI2NDQ5LTMuMTg5NjMsMTMuMDI0NDUsMTMuMDI0NDUsMCwwLDAsLjQ0MDA5LTMuNDY1LDguNDI3Niw4LjQyNzYsMCwwLDAtMi44NTk1Ni02LjMyNSwxMC45MzMwOCwxMC45MzMwOCwwLDAsMC03LjgxMDA5LTIuNjk1M3EtNC45NTEsMC03LjcwMDU4LDIuODA1MzNhMTQuNTk3NzMsMTQuNTk3NzMsMCwwLDAtMy43Mzk3NSw2LjMyNWwtMTMuMDkwMTUtNS4zOTAxYTI0LjU1NTQ3LDI0LjU1NTQ3LDAsMCwxLDIuODYwNi02LjEwNSwyMi43NjYzNywyMi43NjYzNywwLDAsMSw1LjA2LTUuNjEwMTQsMjYuNDQ4NzUsMjYuNDQ4NzUsMCwwLDEsNy4zMTQyMS00LjA3MDM0LDI2Ljg2MTg0LDI2Ljg2MTg0LDAsMCwxLDkuNTE1Ny0xLjU5NDU2LDI5LjcxODc4LDI5LjcxODc4LDAsMCwxLDEwLjM0MDEsMS43MDQ1OCwyMy4wMDg4MywyMy4wMDg4MywwLDAsMSw3LjgxMDA4LDQuNjc1MjEsMjAuOTI5MjMsMjAuOTI5MjMsMCwwLDEsNC45NDk0OSw2Ljk4NTE3LDIxLjI4NTUxLDIxLjI4NTUxLDAsMCwxLDEuNzYwMzcsOC42MzUsMjUuMDA2MTIsMjUuMDA2MTIsMCwwLDEtMy40NjUsMTIuOTI0ODYsNTYuODc2NjQsNTYuODc2NjQsMCwwLDEtOC40MTU0NiwxMC45NDVsLTkuNDU5OTIsOS40NjA0M3EtMy43NDA3NywzLjc0MDc3LTguNDcwMjIsOC4zNTk2OGwuNDQwMDkuNjYwMTRoMzAuNDcwN3YxMi42NTAwN1oiLz48cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik00NDcuMDM2MjMsMjY1LjA1ODI0djMxLjloLTEwLjEyVjIxOC4xOTc3NGgyNi44NDA0NWEyNC4yNTY2NCwyNC4yNTY2NCwwLDAsMSwxNy4zODA1NCw2LjgyMDM5LDIyLjc1NzYxLDIyLjc1NzYxLDAsMCwxLDAsMzMuMzI5NzQsMjQuMjI0NjMsMjQuMjI0NjMsMCwwLDEtMTcuMzgwNTQsNi43MTAzN1ptMC0zNy4xODA1NXYyNy41MDA1OWgxNi45NDA0NWExMy4zNzgsMTMuMzc4LDAsMCwwLDEwLjAxMDU0LTQuMDcwMzMsMTMuODA1NzcsMTMuODA1NzcsMCwwLDAtMTAuMDEwNTQtMjMuNDMwMjZaIi8+PHBhdGggY2xhc3M9ImNscy0yIiBkPSJNNTA3LjMxNjQ1LDI5Ni45NTgyMWgtMTAuMTJWMjQzLjA1Nzc3aDkuNjh2OC44MDAyOWguNDQwMDlhMTQuNjA4MDUsMTQuNjA4MDUsMCwwLDEsNi4zMjQ1MS03LjMxNTIzLDE3LjU2MDM1LDE3LjU2MDM1LDAsMCwxLDkuNDA1MTYtMy4wMjQ4NiwxOC45NzcwNiwxOC45NzcwNiwwLDAsMSw3LjQ4MDU0LDEuMzE5NzZsLTMuMDgwNjUsOS43OTA1YTE2Ljc5MTgyLDE2Ljc5MTgyLDAsMCwwLTUuOTQwMjEtLjc3MDE3QTEzLjA5Njc0LDEzLjA5Njc0LDAsMCwwLDUxMS41NTEsMjU2LjQ3OGExNS40NTI3OCwxNS40NTI3OCwwLDAsMC00LjIzNDU5LDEwLjc4MDE5WiIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTUzMC43NDU2NywyNzAuMDA4MjVxMC0xMi40Mjk1MSw3LjgxMDA5LTIwLjU3MDE4YTI2LjYyMjIsMjYuNjIyMiwwLDAsMSwxOS45MTA1NS04LjE0MDE1cTExLjk4Nzg1LDAsMTkuOCw4LjE0MDE1LDcuOTIwMTEsOC4xNDE3Miw3LjkxOTU5LDIwLjU3MDE4LDAsMTIuNTM5NTItNy45MTk1OSwyMC41NzAxNy03LjgxMTY0LDguMTQxNy0xOS44LDguMTM5NjRhMjYuNjE2LDI2LjYxNiwwLDAsMS0xOS45MTA1NS04LjEzOTY0UTUzMC43NDQxMiwyODIuNDM5LDUzMC43NDU2NywyNzAuMDA4MjVabTEwLjEyLDBxMCw4LjY5MSw1LjA2LDE0LjA3OTg0YTE3LjI4MjIyLDE3LjI4MjIyLDAsMCwwLDI1LjA4MDA4LDBxNS4wNTk1Mi01LjM4OCw1LjA2LTE0LjA3OTg0LDAtOC41ODAyNS01LjA2LTEzLjk3MDM0YTE3LjA0NTQ0LDE3LjA0NTQ0LDAsMCwwLTI1LjA4MDA4LDBRNTQwLjg2NDY5LDI2MS40MjksNTQwLjg2NTcyLDI3MC4wMDgyNVoiLz48cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik02MTkuOTU2MjYsMjY5LjU2ODE2bDE5LjI1MDQxLDI3LjM5MDA1SDYyNy4zMjYyNWwtMTMuMzEwMi0xOS45MS0xMy4wOTAxNiwxOS45MUg1ODkuMDQ2NTFsMTkuMDMwMzYtMjcuMzkwMDVMNTg5LjQ4NjYsMjQzLjA1Nzc3aDExLjQzOTI5bDEzLjMxMDIxLDE5LjAzMDM3LDEyLjY1MDA2LTE5LjAzMDM3aDExLjg4MDQyWiIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTY5NC40MjQ4LDI0My4wNTc3N2wtMzMuNzcwMzUsNzcuNjYwNzZINjUwLjIwNDg0TDY2Mi43NDQzNywyOTMuNTQ4bC0yMi4yMTk0OS01MC40OTAyNGgxMS4wMDAyNGwxNi4wNjAyNiwzOC43MjAzNmguMjE5bDE1LjYyMDE3LTM4LjcyMDM2WiIvPjxwYXRoIGNsYXNzPSJjbHMtMyIgZD0iTTIxMS45MzEsMzkyLjYzNTM2Yy0xMDEuMzgwMjcsMC0xODMuODU5MzItODIuNDc4NTItMTgzLjg1OTMyLTE4My44NTg4UzExMC41NTA3MSwyNC45MTc3NiwyMTEuOTMxLDI0LjkxNzc2LDM5NS43OTAzLDEwNy4zOTYyOSwzOTUuNzkwMywyMDguNzc2NTYsMzEzLjMxMTI1LDM5Mi42MzUzNiwyMTEuOTMxLDM5Mi42MzUzNlptMC0zNTQuNzAzODljLTk0LjIwNDUsMC0xNzAuODQ0NTcsNzYuNjQxMTEtMTcwLjg0NDU3LDE3MC44NDUwOVMxMTcuNzI2NDgsMzc5LjYyMTY1LDIxMS45MzEsMzc5LjYyMTY1czE3MC44NDQ1Ny03Ni42NDExLDE3MC44NDQ1Ny0xNzAuODQ1MDlTMzA2LjEzNTQ4LDM3LjkzMTQ3LDIxMS45MzEsMzcuOTMxNDdaIi8+PHBvbHlnb24gY2xhc3M9ImNscy00IiBwb2ludHM9IjI0NC42MDIgMTEyLjAwNyAyMzkuMjk1IDEzMS44NDMgMjgxLjk1OSAxNjYuODU2IDMyMi4wNTUgMTYxLjkxMiAyNDQuNjAyIDExMi4wMDciLz48cG9seWdvbiBjbGFzcz0iY2xzLTMiIHBvaW50cz0iMzQ4LjQ0OSAxOTUuNTYyIDM0OC40NDkgMTU4LjczNCAyOTAuMjA5IDEwOS4xNzkgMjQ0LjYwMiAxMTIuMDA3IDMwMC4yMDkgMTU2LjY3IDc2LjY0MiAxNTYuNjcgNzYuNjQyIDE5OC4wNSAzNDguNDQ5IDE5NS41NjIiLz48cG9seWdvbiBjbGFzcz0iY2xzLTUiIHBvaW50cz0iMTgwLjQ4OSAyOTcuMTc1IDE4NS43OTYgMjc3LjM0IDE0MS44NyAyNDAuNTU4IDEwMy4wMzcgMjQ3LjI3MSAxODAuNDg5IDI5Ny4xNzUiLz48cG9seWdvbiBjbGFzcz0iY2xzLTYiIHBvaW50cz0iNzYuNjQyIDIxMy42MiA3Ni42NDIgMjUwLjQ0OCAxMzQuODgyIDMwMC4wMDQgMTgwLjQ4OSAyOTcuMTc1IDEyNC44ODIgMjUyLjUxMiAzNDguNDQ5IDI1Mi41MTIgMzQ4LjQ0OSAyMTEuMTMyIDc2LjY0MiAyMTMuNjIiLz48L3N2Zz4="},140:function(M,N,D){"use strict";D.r(N),N.default=D.p+"assets/images/sign-in-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png"},141:function(M,N,D){"use strict";D.r(N),N.default=D.p+"assets/images/architecture-08b382c30c02b227fa4c86cb158b600e.png"},91:function(M,N,D){"use strict";D.r(N),D.d(N,"frontMatter",(function(){return T})),D.d(N,"metadata",(function(){return t})),D.d(N,"rightToc",(function(){return c})),D.d(N,"default",(function(){return z}));var L=D(2),j=D(6),w=(D(0),D(96)),T={title:"Welcome to OAuth2 Proxy",hide_table_of_contents:!0},t={type:"mdx",permalink:"/oauth2-proxy/",source:"@site/src/pages/index.md"},c=[{value:"Architecture",id:"architecture",children:[]}],e={rightToc:c};function z(M){var N=M.components,T=Object(j.a)(M,["components"]);return Object(w.b)("wrapper",Object(L.a)({},e,T,{components:N,mdxType:"MDXLayout"}),Object(w.b)("p",null,Object(w.b)("img",{alt:"OAuth2 Proxy",src:D(139).default})),Object(w.b)("p",null,"A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)\nto validate accounts by email, domain or group."),Object(w.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(w.b)("div",Object(L.a)({parentName:"div"},{className:"admonition-heading"}),Object(w.b)("h5",{parentName:"div"},Object(w.b)("span",Object(L.a)({parentName:"h5"},{className:"admonition-icon"}),Object(w.b)("svg",Object(L.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(w.b)("path",Object(L.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(w.b)("div",Object(L.a)({parentName:"div"},{className:"admonition-content"}),Object(w.b)("p",{parentName:"div"},"This repository was forked from ",Object(w.b)("a",Object(L.a)({parentName:"p"},{href:"https://github.com/bitly/oauth2_proxy"}),"bitly/OAuth2_Proxy")," on 27/11/2018.\nVersions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.\nA list of changes can be seen in the ",Object(w.b)("a",Object(L.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md"}),"CHANGELOG"),"."))),Object(w.b)("p",null,Object(w.b)("img",{alt:"Sign In Page",src:D(140).default})),Object(w.b)("h2",{id:"architecture"},"Architecture"),Object(w.b)("p",null,Object(w.b)("img",{alt:"OAuth2 Proxy Architecture",src:D(141).default})))}z.isMDXComponent=!0},96:function(M,N,D){"use strict";D.d(N,"a",(function(){return u})),D.d(N,"b",(function(){return y}));var L=D(0),j=D.n(L);function w(M,N,D){return N in M?Object.defineProperty(M,N,{value:D,enumerable:!0,configurable:!0,writable:!0}):M[N]=D,M}function T(M,N){var D=Object.keys(M);if(Object.getOwnPropertySymbols){var L=Object.getOwnPropertySymbols(M);N&&(L=L.filter((function(N){return Object.getOwnPropertyDescriptor(M,N).enumerable}))),D.push.apply(D,L)}return D}function t(M){for(var N=1;N<arguments.length;N++){var D=null!=arguments[N]?arguments[N]:{};N%2?T(Object(D),!0).forEach((function(N){w(M,N,D[N])})):Object.getOwnPropertyDescriptors?Object.defineProperties(M,Object.getOwnPropertyDescriptors(D)):T(Object(D)).forEach((function(N){Object.defineProperty(M,N,Object.getOwnPropertyDescriptor(D,N))}))}return M}function c(M,N){if(null==M)return{};var D,L,j=function(M,N){if(null==M)return{};var D,L,j={},w=Object.keys(M);for(L=0;L<w.length;L++)D=w[L],N.indexOf(D)>=0||(j[D]=M[D]);return j}(M,N);if(Object.getOwnPropertySymbols){var w=Object.getOwnPropertySymbols(M);for(L=0;L<w.length;L++)D=w[L],N.indexOf(D)>=0||Object.prototype.propertyIsEnumerable.call(M,D)&&(j[D]=M[D])}return j}var e=j.a.createContext({}),z=function(M){var N=j.a.useContext(e),D=N;return M&&(D="function"==typeof M?M(N):t(t({},N),M)),D},u=function(M){var N=z(M.components);return j.a.createElement(e.Provider,{value:N},M.children)},s={inlineCode:"code",wrapper:function(M){var N=M.children;return j.a.createElement(j.a.Fragment,{},N)}},i=j.a.forwardRef((function(M,N){var D=M.components,L=M.mdxType,w=M.originalType,T=M.parentName,e=c(M,["components","mdxType","originalType","parentName"]),u=z(D),i=L,y=u["".concat(T,".").concat(i)]||u[i]||s[i]||w;return D?j.a.createElement(y,t(t({ref:N},e),{},{components:D})):j.a.createElement(y,t({ref:N},e))}));function y(M,N){var D=arguments,L=N&&N.mdxType;if("string"==typeof M||L){var w=D.length,T=new Array(w);T[0]=i;var t={};for(var c in N)hasOwnProperty.call(N,c)&&(t[c]=N[c]);t.originalType=M,t.mdxType="string"==typeof M?M:L,T[1]=t;for(var e=2;e<w;e++)T[e]=D[e];return j.a.createElement.apply(null,T)}return j.a.createElement.apply(null,D)}i.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[33],{138:function(M,N,D){"use strict";D.r(N),N.default="data:image/svg+xml;base64,PHN2ZyBpZD0iTGF5ZXJfMSIgZGF0YS1uYW1lPSJMYXllciAxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA4NDAuNTU2NDUgNDEyLjQ1OTA0Ij48ZGVmcz48c3R5bGU+LmNscy0xe2ZpbGw6IzMzMzt9LmNscy0ye2ZpbGw6IzdjN2M4Mjt9LmNscy0ze2ZpbGw6IzA2ZWQ5NDt9LmNscy00e2ZpbGw6IzA1OWI2MTt9LmNscy01e2ZpbGw6IzE5NTdiYTt9LmNscy02e2ZpbGw6IzZjYThmZjt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPk9BdXRoMl9Qcm94eV9sb2dvX3YzPC90aXRsZT48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik00NzQuMjA5MzMsMTk2LjYzMTE2YTQxLjQ2Njc5LDQxLjQ2Njc5LDAsMCwxLTE2LjMzNTA2LTMuMTg5NjQsMzkuODA3NTcsMzkuODA3NTcsMCwwLDEtMjEuNjcwOTItMjEuODM1MTgsNDIuOTk0MDksNDIuOTk0MDksMCwwLDEsMC0zMi4yMywzOS44MDc2NSwzOS44MDc2NSwwLDAsMSwyMS42NzA5Mi0yMS44MzUxOCw0My40MTY2NSw0My40MTY2NSwwLDAsMSwzMi42NzAxMiwwLDM5LjgxMDEsMzkuODEwMSwwLDAsMSwyMS42Njk4OSwyMS44MzUxOCw0Mi45OTQsNDIuOTk0LDAsMCwxLDAsMzIuMjMsMzkuODEsMzkuODEsMCwwLDEtMjEuNjY5ODksMjEuODM1MThBNDEuNDg1LDQxLjQ4NSwwLDAsMSw0NzQuMjA5MzMsMTk2LjYzMTE2Wm0wLTE0LjA3OTg1YTI2LjYzNzE0LDI2LjYzNzE0LDAsMCwwLDEwLjI4NDMxLTEuOTc5OSwyNS44OTg4OSwyNS44OTg4OSwwLDAsMCw4LjM2MDcyLTUuNTAwMTIsMjUuMDQyMjksMjUuMDQyMjksMCwwLDAsNS42MDk2My04LjUyNSwzMS4wNDI5NCwzMS4wNDI5NCwwLDAsMCwwLTIyLjExLDI1LjA3OTYzLDI1LjA3OTYzLDAsMCwwLTUuNjA5NjMtOC41MjU0OSwyNS45MTQ1LDI1LjkxNDUsMCwwLDAtOC4zNjA3Mi01LjQ5OTYxLDI3LjY5NjIsMjcuNjk2MiwwLDAsMC0yMC41Njk2NSwwLDI1Ljg5MjMzLDI1Ljg5MjMzLDAsMCwwLTguMzYwNzIsNS40OTk2MSwyNS4wMzQzNCwyNS4wMzQzNCwwLDAsMC01LjYwOTYyLDguNTI1NDksMzEuMDQyNzksMzEuMDQyNzksMCwwLDAsMCwyMi4xMSwyNC45OTcxNCwyNC45OTcxNCwwLDAsMCw1LjYwOTYyLDguNTI1LDI1Ljg3Njc1LDI1Ljg3Njc1LDAsMCwwLDguMzYwNzIsNS41MDAxMkEyNi42MzExMiwyNi42MzExMiwwLDAsMCw0NzQuMjA5MzMsMTgyLjU1MTMxWiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTU0OC4xMjkzMSwxMTYuMTEwODNoMTYuOTQwNDRsMjkuNTkwNTEsNzguNzYwNDhINTc4LjI2OTQyTDU3MS43Nzk2MSwxNzYuMDYxSDU0MS40MTk0NWwtNi40ODk4MSwxOC44MTAzM0g1MTguNTM5ODNabTE4LjgxMDMyLDQ2LjMxMDQtNy4wMzk0MS0xOS42OS0yLjg2MDYtOS41Njk5NGgtLjg4MDE4bC0yLjg1OTU3LDkuNTY5OTQtNy4wNDA0NCwxOS42OVoiLz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik02MzYuNjc4NzMsMTg3LjgzMTM4aC0uODgwMTlhMTguMjY0NjksMTguMjY0NjksMCwwLDEtNi44MjAzOSw2LjQzNTA2LDE5Ljk0NTQxLDE5Ljk0NTQxLDAsMCwxLTkuNzg5NDcsMi4zNjQ3MnEtMTAuMjMwNTksMC0xNS4yMzQ4My02LjI2OTc3LTUuMDA2ODItNi4yNzA1Mi01LjAwNTI3LTE2LjcyMDRWMTQwLjk3MDg3SDYxMy4zNTl2MzAuOTEwMjdxMCw1LjgzMiwyLjU4NDc3LDguNjM1LDIuNTgzMjEsMi44MDQ4Miw3LjUzNDI1LDIuODA1MzNhMTAuNTAwMDYsMTAuNTAwMDYsMCwwLDAsNS4yMjUzMi0xLjI2NSwxMi4yMTQwNywxMi4yMTQwNywwLDAsMCwzLjg1MDI5LTMuNDEwMTksMTUuNDQyOTMsMTUuNDQyOTMsMCwwLDAsMi40MTk0Ny01LjA2LDIyLjY5NzQ2LDIyLjY5NzQ2LDAsMCwwLC44MjU0My02LjIxNVYxNDAuOTcwODdINjUwLjIwOXY1My45MDA0NEg2MzYuNjc4NzNaIi8+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNjY5LjAxNzIzLDE1My4yOTEzOGgtOS40NjFWMTQwLjk3MDg3aDkuNDYxVjEyNC40NzFoMTQuNDA5NHYxNi40OTk4NGgxMy4yMDA3djEyLjMyMDUxaC0xMy4yMDA3VjE3NC44MjlhMTUuNTQ1NjEsMTUuNTQ1NjEsMCwwLDAsLjM4NTM0LDMuNTcxMzUsNS43OTM2LDUuNzkzNiwwLDAsMCwxLjQ4NDU0LDIuNzc3NDQsNS40NDkxNCw1LjQ0OTE0LDAsMCwwLDQuMzk5ODgsMS44MTM1Nyw4LjAwNTQ3LDguMDA1NDcsMCwwLDAsNS4wNi0xLjQzMDNsNC4wNzAzNCwxMi42NTAwN2EyMy44MzkyNCwyMy44MzkyNCwwLDAsMS01LjQ0NDM0LDEuODE1MTIsMzEuODAyOSwzMS44MDI5LDAsMCwxLTYuNDM1MDUuNjA0ODcsMTkuNjY1MjgsMTkuNjY1MjgsMCwwLDEtNy4zMTUyNC0xLjI5MDg0LDE1LjU0MTUxLDE1LjU0MTUxLDAsMCwxLTUuNDQ1MzctMy41MzY3NXEtNS4xNzEwNy01LjA1MzMxLTUuMTY5NTMtMTQuMzcyNzJaIi8+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNzA3LjczNSwxMTYuMTEwODNoMTQuNDA5NHYyMi4xMTA1bC0uODc5MTUsOS43OWguODc5MTVhMTcuODU0NDcsMTcuODU0NDcsMCwwLDEsNi42NTUxMS02LjMyNSwxOS4zMTQ5MiwxOS4zMTQ5MiwwLDAsMSw5LjczNTc0LTIuNDc1MjZxMTAuNDQ5MDksMCwxNS40NTQ4OCw2LjE2MDI2LDUuMDAzNzEsNi4xNjEyOCw1LjAwNTI3LDE2LjgyOTl2MzIuNjcwMTNINzQ0LjU4NVYxNjMuOTYxcTAtNS42MDk2Mi0yLjY0MDU1LTguNTI1YTkuNDQwMTgsOS40NDAxOCwwLDAsMC03LjM3LTIuOTE0ODQsMTAuODI0ODIsMTAuODI0ODIsMCwwLDAtNS4yODAwNywxLjI2NSwxMS43NjA5MiwxMS43NjA5MiwwLDAsMC0zLjkwNCwzLjQ2NSwxNi4wOTQyOSwxNi4wOTQyOSwwLDAsMC0yLjQyMDUsNS4xMTQ3OCwyMi43NDgsMjIuNzQ4LDAsMCwwLS44MjU0NCw2LjIxNXYyNi4yOTAzNEg3MDcuNzM1WiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTc2OS43NzM1MywxOTQuODcxMzFWMTgxLjc4MTE1cTYuNDg5NzktNi4zNzgyNCwxMS45ODk5Mi0xMS44Nzk5MSwyLjMxMDQ4LTIuMzA5Nyw0LjczMDQ4LTQuNzMsMi40MTc0LTIuNDE4MTgsNC41MDkzOS00LjUwOTkxLDIuMDg4ODgtMi4wODg4OSwzLjc0MDc4LTMuNzk1LDEuNjQ4OC0xLjcwNDU4LDIuNTMtMi42OTUzMSwxLjc1NzI2LTIuMDg4MTEsMy4xMzQzNi0zLjczOTc1YTE4LjE2NDEzLDE4LjE2NDEzLDAsMCwwLDIuMjAwNDYtMy4yNDU0MiwxNi40NzQ3MiwxNi40NzQ3MiwwLDAsMCwxLjI2NDQ5LTMuMTg5NjMsMTMuMDI0NDUsMTMuMDI0NDUsMCwwLDAsLjQ0MDA5LTMuNDY1LDguNDI3Niw4LjQyNzYsMCwwLDAtMi44NTk1Ni02LjMyNSwxMC45MzMwOCwxMC45MzMwOCwwLDAsMC03LjgxMDA5LTIuNjk1M3EtNC45NTEsMC03LjcwMDU4LDIuODA1MzNhMTQuNTk3NzMsMTQuNTk3NzMsMCwwLDAtMy43Mzk3NSw2LjMyNWwtMTMuMDkwMTUtNS4zOTAxYTI0LjU1NTQ3LDI0LjU1NTQ3LDAsMCwxLDIuODYwNi02LjEwNSwyMi43NjYzNywyMi43NjYzNywwLDAsMSw1LjA2LTUuNjEwMTQsMjYuNDQ4NzUsMjYuNDQ4NzUsMCwwLDEsNy4zMTQyMS00LjA3MDM0LDI2Ljg2MTg0LDI2Ljg2MTg0LDAsMCwxLDkuNTE1Ny0xLjU5NDU2LDI5LjcxODc4LDI5LjcxODc4LDAsMCwxLDEwLjM0MDEsMS43MDQ1OCwyMy4wMDg4MywyMy4wMDg4MywwLDAsMSw3LjgxMDA4LDQuNjc1MjEsMjAuOTI5MjMsMjAuOTI5MjMsMCwwLDEsNC45NDk0OSw2Ljk4NTE3LDIxLjI4NTUxLDIxLjI4NTUxLDAsMCwxLDEuNzYwMzcsOC42MzUsMjUuMDA2MTIsMjUuMDA2MTIsMCwwLDEtMy40NjUsMTIuOTI0ODYsNTYuODc2NjQsNTYuODc2NjQsMCwwLDEtOC40MTU0NiwxMC45NDVsLTkuNDU5OTIsOS40NjA0M3EtMy43NDA3NywzLjc0MDc3LTguNDcwMjIsOC4zNTk2OGwuNDQwMDkuNjYwMTRoMzAuNDcwN3YxMi42NTAwN1oiLz48cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik00NDcuMDM2MjMsMjY1LjA1ODI0djMxLjloLTEwLjEyVjIxOC4xOTc3NGgyNi44NDA0NWEyNC4yNTY2NCwyNC4yNTY2NCwwLDAsMSwxNy4zODA1NCw2LjgyMDM5LDIyLjc1NzYxLDIyLjc1NzYxLDAsMCwxLDAsMzMuMzI5NzQsMjQuMjI0NjMsMjQuMjI0NjMsMCwwLDEtMTcuMzgwNTQsNi43MTAzN1ptMC0zNy4xODA1NXYyNy41MDA1OWgxNi45NDA0NWExMy4zNzgsMTMuMzc4LDAsMCwwLDEwLjAxMDU0LTQuMDcwMzMsMTMuODA1NzcsMTMuODA1NzcsMCwwLDAtMTAuMDEwNTQtMjMuNDMwMjZaIi8+PHBhdGggY2xhc3M9ImNscy0yIiBkPSJNNTA3LjMxNjQ1LDI5Ni45NTgyMWgtMTAuMTJWMjQzLjA1Nzc3aDkuNjh2OC44MDAyOWguNDQwMDlhMTQuNjA4MDUsMTQuNjA4MDUsMCwwLDEsNi4zMjQ1MS03LjMxNTIzLDE3LjU2MDM1LDE3LjU2MDM1LDAsMCwxLDkuNDA1MTYtMy4wMjQ4NiwxOC45NzcwNiwxOC45NzcwNiwwLDAsMSw3LjQ4MDU0LDEuMzE5NzZsLTMuMDgwNjUsOS43OTA1YTE2Ljc5MTgyLDE2Ljc5MTgyLDAsMCwwLTUuOTQwMjEtLjc3MDE3QTEzLjA5Njc0LDEzLjA5Njc0LDAsMCwwLDUxMS41NTEsMjU2LjQ3OGExNS40NTI3OCwxNS40NTI3OCwwLDAsMC00LjIzNDU5LDEwLjc4MDE5WiIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTUzMC43NDU2NywyNzAuMDA4MjVxMC0xMi40Mjk1MSw3LjgxMDA5LTIwLjU3MDE4YTI2LjYyMjIsMjYuNjIyMiwwLDAsMSwxOS45MTA1NS04LjE0MDE1cTExLjk4Nzg1LDAsMTkuOCw4LjE0MDE1LDcuOTIwMTEsOC4xNDE3Miw3LjkxOTU5LDIwLjU3MDE4LDAsMTIuNTM5NTItNy45MTk1OSwyMC41NzAxNy03LjgxMTY0LDguMTQxNy0xOS44LDguMTM5NjRhMjYuNjE2LDI2LjYxNiwwLDAsMS0xOS45MTA1NS04LjEzOTY0UTUzMC43NDQxMiwyODIuNDM5LDUzMC43NDU2NywyNzAuMDA4MjVabTEwLjEyLDBxMCw4LjY5MSw1LjA2LDE0LjA3OTg0YTE3LjI4MjIyLDE3LjI4MjIyLDAsMCwwLDI1LjA4MDA4LDBxNS4wNTk1Mi01LjM4OCw1LjA2LTE0LjA3OTg0LDAtOC41ODAyNS01LjA2LTEzLjk3MDM0YTE3LjA0NTQ0LDE3LjA0NTQ0LDAsMCwwLTI1LjA4MDA4LDBRNTQwLjg2NDY5LDI2MS40MjksNTQwLjg2NTcyLDI3MC4wMDgyNVoiLz48cGF0aCBjbGFzcz0iY2xzLTIiIGQ9Ik02MTkuOTU2MjYsMjY5LjU2ODE2bDE5LjI1MDQxLDI3LjM5MDA1SDYyNy4zMjYyNWwtMTMuMzEwMi0xOS45MS0xMy4wOTAxNiwxOS45MUg1ODkuMDQ2NTFsMTkuMDMwMzYtMjcuMzkwMDVMNTg5LjQ4NjYsMjQzLjA1Nzc3aDExLjQzOTI5bDEzLjMxMDIxLDE5LjAzMDM3LDEyLjY1MDA2LTE5LjAzMDM3aDExLjg4MDQyWiIvPjxwYXRoIGNsYXNzPSJjbHMtMiIgZD0iTTY5NC40MjQ4LDI0My4wNTc3N2wtMzMuNzcwMzUsNzcuNjYwNzZINjUwLjIwNDg0TDY2Mi43NDQzNywyOTMuNTQ4bC0yMi4yMTk0OS01MC40OTAyNGgxMS4wMDAyNGwxNi4wNjAyNiwzOC43MjAzNmguMjE5bDE1LjYyMDE3LTM4LjcyMDM2WiIvPjxwYXRoIGNsYXNzPSJjbHMtMyIgZD0iTTIxMS45MzEsMzkyLjYzNTM2Yy0xMDEuMzgwMjcsMC0xODMuODU5MzItODIuNDc4NTItMTgzLjg1OTMyLTE4My44NTg4UzExMC41NTA3MSwyNC45MTc3NiwyMTEuOTMxLDI0LjkxNzc2LDM5NS43OTAzLDEwNy4zOTYyOSwzOTUuNzkwMywyMDguNzc2NTYsMzEzLjMxMTI1LDM5Mi42MzUzNiwyMTEuOTMxLDM5Mi42MzUzNlptMC0zNTQuNzAzODljLTk0LjIwNDUsMC0xNzAuODQ0NTcsNzYuNjQxMTEtMTcwLjg0NDU3LDE3MC44NDUwOVMxMTcuNzI2NDgsMzc5LjYyMTY1LDIxMS45MzEsMzc5LjYyMTY1czE3MC44NDQ1Ny03Ni42NDExLDE3MC44NDQ1Ny0xNzAuODQ1MDlTMzA2LjEzNTQ4LDM3LjkzMTQ3LDIxMS45MzEsMzcuOTMxNDdaIi8+PHBvbHlnb24gY2xhc3M9ImNscy00IiBwb2ludHM9IjI0NC42MDIgMTEyLjAwNyAyMzkuMjk1IDEzMS44NDMgMjgxLjk1OSAxNjYuODU2IDMyMi4wNTUgMTYxLjkxMiAyNDQuNjAyIDExMi4wMDciLz48cG9seWdvbiBjbGFzcz0iY2xzLTMiIHBvaW50cz0iMzQ4LjQ0OSAxOTUuNTYyIDM0OC40NDkgMTU4LjczNCAyOTAuMjA5IDEwOS4xNzkgMjQ0LjYwMiAxMTIuMDA3IDMwMC4yMDkgMTU2LjY3IDc2LjY0MiAxNTYuNjcgNzYuNjQyIDE5OC4wNSAzNDguNDQ5IDE5NS41NjIiLz48cG9seWdvbiBjbGFzcz0iY2xzLTUiIHBvaW50cz0iMTgwLjQ4OSAyOTcuMTc1IDE4NS43OTYgMjc3LjM0IDE0MS44NyAyNDAuNTU4IDEwMy4wMzcgMjQ3LjI3MSAxODAuNDg5IDI5Ny4xNzUiLz48cG9seWdvbiBjbGFzcz0iY2xzLTYiIHBvaW50cz0iNzYuNjQyIDIxMy42MiA3Ni42NDIgMjUwLjQ0OCAxMzQuODgyIDMwMC4wMDQgMTgwLjQ4OSAyOTcuMTc1IDEyNC44ODIgMjUyLjUxMiAzNDguNDQ5IDI1Mi41MTIgMzQ4LjQ0OSAyMTEuMTMyIDc2LjY0MiAyMTMuNjIiLz48L3N2Zz4="},139:function(M,N,D){"use strict";D.r(N),N.default=D.p+"assets/images/sign-in-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png"},140:function(M,N,D){"use strict";D.r(N),N.default=D.p+"assets/images/architecture-08b382c30c02b227fa4c86cb158b600e.png"},90:function(M,N,D){"use strict";D.r(N),D.d(N,"frontMatter",(function(){return T})),D.d(N,"metadata",(function(){return t})),D.d(N,"rightToc",(function(){return c})),D.d(N,"default",(function(){return z}));var L=D(2),j=D(6),w=(D(0),D(95)),T={title:"Welcome to OAuth2 Proxy",hide_table_of_contents:!0},t={type:"mdx",permalink:"/oauth2-proxy/",source:"@site/src/pages/index.md"},c=[{value:"Architecture",id:"architecture",children:[]}],e={rightToc:c};function z(M){var N=M.components,T=Object(j.a)(M,["components"]);return Object(w.b)("wrapper",Object(L.a)({},e,T,{components:N,mdxType:"MDXLayout"}),Object(w.b)("p",null,Object(w.b)("img",{alt:"OAuth2 Proxy",src:D(138).default})),Object(w.b)("p",null,"A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)\nto validate accounts by email, domain or group."),Object(w.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(w.b)("div",Object(L.a)({parentName:"div"},{className:"admonition-heading"}),Object(w.b)("h5",{parentName:"div"},Object(w.b)("span",Object(L.a)({parentName:"h5"},{className:"admonition-icon"}),Object(w.b)("svg",Object(L.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(w.b)("path",Object(L.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(w.b)("div",Object(L.a)({parentName:"div"},{className:"admonition-content"}),Object(w.b)("p",{parentName:"div"},"This repository was forked from ",Object(w.b)("a",Object(L.a)({parentName:"p"},{href:"https://github.com/bitly/oauth2_proxy"}),"bitly/OAuth2_Proxy")," on 27/11/2018.\nVersions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.\nA list of changes can be seen in the ",Object(w.b)("a",Object(L.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md"}),"CHANGELOG"),"."))),Object(w.b)("p",null,Object(w.b)("img",{alt:"Sign In Page",src:D(139).default})),Object(w.b)("h2",{id:"architecture"},"Architecture"),Object(w.b)("p",null,Object(w.b)("img",{alt:"OAuth2 Proxy Architecture",src:D(140).default})))}z.isMDXComponent=!0},95:function(M,N,D){"use strict";D.d(N,"a",(function(){return u})),D.d(N,"b",(function(){return y}));var L=D(0),j=D.n(L);function w(M,N,D){return N in M?Object.defineProperty(M,N,{value:D,enumerable:!0,configurable:!0,writable:!0}):M[N]=D,M}function T(M,N){var D=Object.keys(M);if(Object.getOwnPropertySymbols){var L=Object.getOwnPropertySymbols(M);N&&(L=L.filter((function(N){return Object.getOwnPropertyDescriptor(M,N).enumerable}))),D.push.apply(D,L)}return D}function t(M){for(var N=1;N<arguments.length;N++){var D=null!=arguments[N]?arguments[N]:{};N%2?T(Object(D),!0).forEach((function(N){w(M,N,D[N])})):Object.getOwnPropertyDescriptors?Object.defineProperties(M,Object.getOwnPropertyDescriptors(D)):T(Object(D)).forEach((function(N){Object.defineProperty(M,N,Object.getOwnPropertyDescriptor(D,N))}))}return M}function c(M,N){if(null==M)return{};var D,L,j=function(M,N){if(null==M)return{};var D,L,j={},w=Object.keys(M);for(L=0;L<w.length;L++)D=w[L],N.indexOf(D)>=0||(j[D]=M[D]);return j}(M,N);if(Object.getOwnPropertySymbols){var w=Object.getOwnPropertySymbols(M);for(L=0;L<w.length;L++)D=w[L],N.indexOf(D)>=0||Object.prototype.propertyIsEnumerable.call(M,D)&&(j[D]=M[D])}return j}var e=j.a.createContext({}),z=function(M){var N=j.a.useContext(e),D=N;return M&&(D="function"==typeof M?M(N):t(t({},N),M)),D},u=function(M){var N=z(M.components);return j.a.createElement(e.Provider,{value:N},M.children)},s={inlineCode:"code",wrapper:function(M){var N=M.children;return j.a.createElement(j.a.Fragment,{},N)}},i=j.a.forwardRef((function(M,N){var D=M.components,L=M.mdxType,w=M.originalType,T=M.parentName,e=c(M,["components","mdxType","originalType","parentName"]),u=z(D),i=L,y=u["".concat(T,".").concat(i)]||u[i]||s[i]||w;return D?j.a.createElement(y,t(t({ref:N},e),{},{components:D})):j.a.createElement(y,t({ref:N},e))}));function y(M,N){var D=arguments,L=N&&N.mdxType;if("string"==typeof M||L){var w=D.length,T=new Array(w);T[0]=i;var t={};for(var c in N)hasOwnProperty.call(N,c)&&(t[c]=N[c]);t.originalType=M,t.mdxType="string"==typeof M?M:L,T[1]=t;for(var e=2;e<w;e++)T[e]=D[e];return j.a.createElement.apply(null,T)}return j.a.createElement.apply(null,D)}i.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/f4c9d322.ee82cb40.js b/f4c9d322.8594a982.js
similarity index 97%
rename from f4c9d322.ee82cb40.js
rename to f4c9d322.8594a982.js
index ada21344..e93df62c 100644
--- a/f4c9d322.ee82cb40.js
+++ b/f4c9d322.8594a982.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[35],{92:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return l}));var r=n(2),i=n(6),o=(n(0),n(96)),a={id:"security",title:"Security"},s={unversionedId:"community/security",id:"version-7.0.x/community/security",isDocsHomePage:!1,title:"Security",description:"OAuth2 Proxy is a community project.",source:"@site/versioned_docs/version-7.0.x/community/security.md",slug:"/community/security",permalink:"/oauth2-proxy/docs/community/security",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/community/security.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/features/request_signatures"}},c=[{value:"Security Disclosures",id:"security-disclosures",children:[{value:"How will we respond to disclosures?",id:"how-will-we-respond-to-disclosures",children:[]}]}],u={rightToc:c};function l(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"OAuth2 Proxy is a community project.\nMaintainers do not work on this project full time, and as such,\nwhile we endeavour to respond to disclosures as quickly as possible,\nthis may take longer than in projects with corporate sponsorship."))),Object(o.b)("h2",{id:"security-disclosures"},"Security Disclosures"),Object(o.b)("div",{className:"admonition admonition-important alert alert--info"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"If you believe you have found a vulnerability within OAuth2 Proxy or any of its\ndependencies, please do NOT open an issue or PR on GitHub, please do NOT post\nany details publicly."))),Object(o.b)("p",null,"Security disclosures MUST be done in private.\nIf you have found an issue that you would like to bring to the attention of the\nmaintenance team for OAuth2 Proxy, please compose an email and send it to the\nlist of maintainers in our ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS"}),"MAINTAINERS")," file."),Object(o.b)("p",null,"Please include as much detail as possible.\nIdeally, your disclosure should include:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"A reproducible case that can be used to demonstrate the exploit"),Object(o.b)("li",{parentName:"ul"},"How you discovered this vulnerability"),Object(o.b)("li",{parentName:"ul"},"A potential fix for the issue (if you have thought of one)"),Object(o.b)("li",{parentName:"ul"},"Versions affected (if not present in master)"),Object(o.b)("li",{parentName:"ul"},"Your GitHub ID")),Object(o.b)("h3",{id:"how-will-we-respond-to-disclosures"},"How will we respond to disclosures?"),Object(o.b)("p",null,"We use ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories"}),"GitHub Security Advisories"),"\nto privately discuss fixes for disclosed vulnerabilities.\nIf you include a GitHub ID with your disclosure we will add you as a collaborator\nfor the advisory so that you can join the discussion and validate any fixes\nwe may propose."),Object(o.b)("p",null,"For minor issues and previously disclosed vulnerabilities (typically for\ndependencies), we may use regular PRs for fixes and forego the security advisory."),Object(o.b)("p",null,"Once a fix has been agreed upon, we will merge the fix and create a new release.\nIf we have multiple security issues in flight simultaneously, we may delay\nmerging fixes until all patches are ready.\nWe may also backport the fix to previous releases,\nbut this will be at the discretion of the maintainers."))}l.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return m}));var r=n(0),i=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=i.a.createContext({}),l=function(e){var t=i.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return i.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},b=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=r,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?i.a.createElement(m,s(s({ref:t},u),{},{components:n})):i.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var u=2;u<o;u++)a[u]=n[u];return i.a.createElement.apply(null,a)}return i.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[34],{91:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return l}));var r=n(2),i=n(6),o=(n(0),n(95)),a={id:"security",title:"Security"},s={unversionedId:"community/security",id:"version-7.0.x/community/security",isDocsHomePage:!1,title:"Security",description:"OAuth2 Proxy is a community project.",source:"@site/versioned_docs/version-7.0.x/community/security.md",slug:"/community/security",permalink:"/oauth2-proxy/docs/community/security",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/community/security.md",version:"7.0.x",sidebar:"version-7.0.x/docs",previous:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/features/request_signatures"}},c=[{value:"Security Disclosures",id:"security-disclosures",children:[{value:"How will we respond to disclosures?",id:"how-will-we-respond-to-disclosures",children:[]}]}],u={rightToc:c};function l(e){var t=e.components,n=Object(i.a)(e,["components"]);return Object(o.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"OAuth2 Proxy is a community project.\nMaintainers do not work on this project full time, and as such,\nwhile we endeavour to respond to disclosures as quickly as possible,\nthis may take longer than in projects with corporate sponsorship."))),Object(o.b)("h2",{id:"security-disclosures"},"Security Disclosures"),Object(o.b)("div",{className:"admonition admonition-important alert alert--info"},Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-heading"}),Object(o.b)("h5",{parentName:"div"},Object(o.b)("span",Object(r.a)({parentName:"h5"},{className:"admonition-icon"}),Object(o.b)("svg",Object(r.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(o.b)("path",Object(r.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(o.b)("div",Object(r.a)({parentName:"div"},{className:"admonition-content"}),Object(o.b)("p",{parentName:"div"},"If you believe you have found a vulnerability within OAuth2 Proxy or any of its\ndependencies, please do NOT open an issue or PR on GitHub, please do NOT post\nany details publicly."))),Object(o.b)("p",null,"Security disclosures MUST be done in private.\nIf you have found an issue that you would like to bring to the attention of the\nmaintenance team for OAuth2 Proxy, please compose an email and send it to the\nlist of maintainers in our ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS"}),"MAINTAINERS")," file."),Object(o.b)("p",null,"Please include as much detail as possible.\nIdeally, your disclosure should include:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"A reproducible case that can be used to demonstrate the exploit"),Object(o.b)("li",{parentName:"ul"},"How you discovered this vulnerability"),Object(o.b)("li",{parentName:"ul"},"A potential fix for the issue (if you have thought of one)"),Object(o.b)("li",{parentName:"ul"},"Versions affected (if not present in master)"),Object(o.b)("li",{parentName:"ul"},"Your GitHub ID")),Object(o.b)("h3",{id:"how-will-we-respond-to-disclosures"},"How will we respond to disclosures?"),Object(o.b)("p",null,"We use ",Object(o.b)("a",Object(r.a)({parentName:"p"},{href:"https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories"}),"GitHub Security Advisories"),"\nto privately discuss fixes for disclosed vulnerabilities.\nIf you include a GitHub ID with your disclosure we will add you as a collaborator\nfor the advisory so that you can join the discussion and validate any fixes\nwe may propose."),Object(o.b)("p",null,"For minor issues and previously disclosed vulnerabilities (typically for\ndependencies), we may use regular PRs for fixes and forego the security advisory."),Object(o.b)("p",null,"Once a fix has been agreed upon, we will merge the fix and create a new release.\nIf we have multiple security issues in flight simultaneously, we may delay\nmerging fixes until all patches are ready.\nWe may also backport the fix to previous releases,\nbut this will be at the discretion of the maintainers."))}l.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return m}));var r=n(0),i=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,r,i=function(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=i.a.createContext({}),l=function(e){var t=i.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return i.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},b=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=r,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?i.a.createElement(m,s(s({ref:t},u),{},{components:n})):i.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var u=2;u<o;u++)a[u]=n[u];return i.a.createElement.apply(null,a)}return i.a.createElement.apply(null,n)}b.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/f5839aac.d42acf97.js b/f5839aac.a11a203a.js
similarity index 97%
rename from f5839aac.d42acf97.js
rename to f5839aac.a11a203a.js
index a570b93e..019b8940 100644
--- a/f5839aac.d42acf97.js
+++ b/f5839aac.a11a203a.js
@@ -1 +1 @@
-(window.webpackJsonp=window.webpackJsonp||[]).push([[36],{93:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return u}));var i=n(2),r=n(6),o=(n(0),n(96)),a={id:"session_storage",title:"Session Storage"},s={unversionedId:"configuration/session_storage",id:"version-6.1.x/configuration/session_storage",isDocsHomePage:!1,title:"Session Storage",description:"Sessions allow a user's authentication to be tracked between multiple HTTP",source:"@site/versioned_docs/version-6.1.x/configuration/sessions.md",slug:"/configuration/session_storage",permalink:"/oauth2-proxy/docs/6.1.x/configuration/session_storage",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/sessions.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"},next:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/tls"}},c=[{value:"Cookie Storage",id:"cookie-storage",children:[]},{value:"Redis Storage",id:"redis-storage",children:[]}],l={rightToc:c};function u(e){var t=e.components,n=Object(r.a)(e,["components"]);return Object(o.b)("wrapper",Object(i.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"Sessions allow a user's authentication to be tracked between multiple HTTP\nrequests to a service."),Object(o.b)("p",null,"The OAuth2 Proxy uses a Cookie to track user sessions and will store the session\ndata in one of the available session storage backends."),Object(o.b)("p",null,"At present the available backends are (as passed to ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type"),"):"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#cookie-storage"}),"cookie")," (default)"),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#redis-storage"}),"redis"))),Object(o.b)("h3",{id:"cookie-storage"},"Cookie Storage"),Object(o.b)("p",null,"The Cookie storage backend is the default backend implementation and has\nbeen used in the OAuth2 Proxy historically."),Object(o.b)("p",null,"With the Cookie storage backend, all session information is stored in client\nside cookies and transferred with each and every request."),Object(o.b)("p",null,"The following should be known when using this implementation:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless"),Object(o.b)("li",{parentName:"ul"},"Cookies are signed server side to prevent modification client-side"),Object(o.b)("li",{parentName:"ul"},"It is mandatory to set a ",Object(o.b)("inlineCode",{parentName:"li"},"cookie-secret")," which will ensure data is encrypted within the cookie data."),Object(o.b)("li",{parentName:"ul"},"Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation\ncannot lock sessions and while updating and refreshing sessions, there can be conflicts which force\nusers to re-authenticate")),Object(o.b)("h3",{id:"redis-storage"},"Redis Storage"),Object(o.b)("p",null,"The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information\nback the the client for storage, as in the ",Object(o.b)("a",Object(i.a)({parentName:"p"},{href:"#cookie-storage"}),"Cookie storage"),", a ticket is sent back\nto the user as the cookie value instead."),Object(o.b)("p",null,"A ticket is composed as the following:"),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"{CookieName}-{ticketID}.{secret}")),Object(o.b)("p",null,"Where:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"CookieName")," is the OAuth2 cookie name (_oauth2_proxy by default)"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"ticketID")," is a 128 bit random number, hex-encoded"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"secret")," is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session."),Object(o.b)("li",{parentName:"ul"},"The pair of ",Object(o.b)("inlineCode",{parentName:"li"},"{CookieName}-{ticketID}")," comprises a ticket handle, and thus, the redis key\nto which the session is stored. The encoded session is encrypted with the secret and stored\nin redis via the ",Object(o.b)("inlineCode",{parentName:"li"},"SETEX")," command.")),Object(o.b)("p",null,"Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from\ndisclosure."),Object(o.b)("h4",{id:"usage"},"Usage"),Object(o.b)("p",null,"When using the redis store, specify ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," as well as the Redis connection URL, via\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-connection-url=redis://host[:port][/db-number]"),"."),Object(o.b)("p",null,"You may also configure the store for Redis Sentinel. In this case, you will want to use the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," flag, as well as configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-master-name"),"\nand ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-connection-urls")," appropriately."),Object(o.b)("p",null,"Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," flag, and configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-cluster-connection-urls")," appropriately."),Object(o.b)("p",null,"Note that flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," and ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," are mutually exclusive."))}u.isMDXComponent=!0},96:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return h}));var i=n(0),r=n.n(i);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,i,r=function(e,t){if(null==e)return{};var n,i,r={},o=Object.keys(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var l=r.a.createContext({}),u=function(e){var t=r.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return r.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},p=r.a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=i,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?r.a.createElement(h,s(s({ref:t},l),{},{components:n})):r.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l<o;l++)a[l]=n[l];return r.a.createElement.apply(null,a)}return r.a.createElement.apply(null,n)}p.displayName="MDXCreateElement"}}]);
\ No newline at end of file
+(window.webpackJsonp=window.webpackJsonp||[]).push([[35],{92:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return s})),n.d(t,"rightToc",(function(){return c})),n.d(t,"default",(function(){return u}));var i=n(2),r=n(6),o=(n(0),n(95)),a={id:"session_storage",title:"Session Storage"},s={unversionedId:"configuration/session_storage",id:"version-6.1.x/configuration/session_storage",isDocsHomePage:!1,title:"Session Storage",description:"Sessions allow a user's authentication to be tracked between multiple HTTP",source:"@site/versioned_docs/version-6.1.x/configuration/sessions.md",slug:"/configuration/session_storage",permalink:"/oauth2-proxy/docs/6.1.x/configuration/session_storage",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/sessions.md",version:"6.1.x",sidebar:"version-6.1.x/docs",previous:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"},next:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/tls"}},c=[{value:"Cookie Storage",id:"cookie-storage",children:[]},{value:"Redis Storage",id:"redis-storage",children:[]}],l={rightToc:c};function u(e){var t=e.components,n=Object(r.a)(e,["components"]);return Object(o.b)("wrapper",Object(i.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"Sessions allow a user's authentication to be tracked between multiple HTTP\nrequests to a service."),Object(o.b)("p",null,"The OAuth2 Proxy uses a Cookie to track user sessions and will store the session\ndata in one of the available session storage backends."),Object(o.b)("p",null,"At present the available backends are (as passed to ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type"),"):"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#cookie-storage"}),"cookie")," (default)"),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(i.a)({parentName:"li"},{href:"#redis-storage"}),"redis"))),Object(o.b)("h3",{id:"cookie-storage"},"Cookie Storage"),Object(o.b)("p",null,"The Cookie storage backend is the default backend implementation and has\nbeen used in the OAuth2 Proxy historically."),Object(o.b)("p",null,"With the Cookie storage backend, all session information is stored in client\nside cookies and transferred with each and every request."),Object(o.b)("p",null,"The following should be known when using this implementation:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless"),Object(o.b)("li",{parentName:"ul"},"Cookies are signed server side to prevent modification client-side"),Object(o.b)("li",{parentName:"ul"},"It is mandatory to set a ",Object(o.b)("inlineCode",{parentName:"li"},"cookie-secret")," which will ensure data is encrypted within the cookie data."),Object(o.b)("li",{parentName:"ul"},"Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation\ncannot lock sessions and while updating and refreshing sessions, there can be conflicts which force\nusers to re-authenticate")),Object(o.b)("h3",{id:"redis-storage"},"Redis Storage"),Object(o.b)("p",null,"The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information\nback the the client for storage, as in the ",Object(o.b)("a",Object(i.a)({parentName:"p"},{href:"#cookie-storage"}),"Cookie storage"),", a ticket is sent back\nto the user as the cookie value instead."),Object(o.b)("p",null,"A ticket is composed as the following:"),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"{CookieName}-{ticketID}.{secret}")),Object(o.b)("p",null,"Where:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"CookieName")," is the OAuth2 cookie name (_oauth2_proxy by default)"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"ticketID")," is a 128 bit random number, hex-encoded"),Object(o.b)("li",{parentName:"ul"},"The ",Object(o.b)("inlineCode",{parentName:"li"},"secret")," is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session."),Object(o.b)("li",{parentName:"ul"},"The pair of ",Object(o.b)("inlineCode",{parentName:"li"},"{CookieName}-{ticketID}")," comprises a ticket handle, and thus, the redis key\nto which the session is stored. The encoded session is encrypted with the secret and stored\nin redis via the ",Object(o.b)("inlineCode",{parentName:"li"},"SETEX")," command.")),Object(o.b)("p",null,"Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from\ndisclosure."),Object(o.b)("h4",{id:"usage"},"Usage"),Object(o.b)("p",null,"When using the redis store, specify ",Object(o.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," as well as the Redis connection URL, via\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-connection-url=redis://host[:port][/db-number]"),"."),Object(o.b)("p",null,"You may also configure the store for Redis Sentinel. In this case, you will want to use the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," flag, as well as configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-master-name"),"\nand ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-sentinel-connection-urls")," appropriately."),Object(o.b)("p",null,"Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the\n",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," flag, and configure the flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-cluster-connection-urls")," appropriately."),Object(o.b)("p",null,"Note that flags ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-sentinel=true")," and ",Object(o.b)("inlineCode",{parentName:"p"},"--redis-use-cluster=true")," are mutually exclusive."))}u.isMDXComponent=!0},95:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return h}));var i=n(0),r=n.n(i);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function c(e,t){if(null==e)return{};var n,i,r=function(e,t){if(null==e)return{};var n,i,r={},o=Object.keys(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)n=o[i],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var l=r.a.createContext({}),u=function(e){var t=r.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return r.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},p=r.a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=i,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?r.a.createElement(h,s(s({ref:t},l),{},{components:n})):r.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l<o;l++)a[l]=n[l];return r.a.createElement.apply(null,a)}return r.a.createElement.apply(null,n)}p.displayName="MDXCreateElement"}}]);
\ No newline at end of file
diff --git a/index.html b/index.html
index 2a993c80..e294dd24 100644
--- a/index.html
+++ b/index.html
@@ -6,12 +6,12 @@
 <meta name="generator" content="Docusaurus v2.0.0-alpha.66">
 <title data-react-helmet="true">Welcome to OAuth2 Proxy | OAuth2 Proxy</title><meta data-react-helmet="true" property="og:title" content="Welcome to OAuth2 Proxy | OAuth2 Proxy"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/"><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_tag" content="default"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
 <link rel="preload" href="/oauth2-proxy/styles.2e624daf.js" as="script">
-<link rel="preload" href="/oauth2-proxy/runtime~main.4b63b5ec.js" as="script">
-<link rel="preload" href="/oauth2-proxy/main.02092c2d.js" as="script">
-<link rel="preload" href="/oauth2-proxy/1.6bed8819.js" as="script">
-<link rel="preload" href="/oauth2-proxy/2.f73f779a.js" as="script">
-<link rel="preload" href="/oauth2-proxy/40.24f08f88.js" as="script">
-<link rel="preload" href="/oauth2-proxy/f3976560.5b30cd66.js" as="script">
+<link rel="preload" href="/oauth2-proxy/runtime~main.b90e804b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/main.ff464f14.js" as="script">
+<link rel="preload" href="/oauth2-proxy/1.07b9992e.js" as="script">
+<link rel="preload" href="/oauth2-proxy/2.cd1a0941.js" as="script">
+<link rel="preload" href="/oauth2-proxy/39.a8bc1f06.js" as="script">
+<link rel="preload" href="/oauth2-proxy/f3976560.c5ee70f7.js" as="script">
 </head>
 <body>
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
@@ -20,11 +20,11 @@ to validate accounts by email, domain or group.</p><div class="admonition admoni
 Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.
 A list of changes can be seen in the <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md" target="_blank" rel="noopener noreferrer">CHANGELOG</a>.</p></div></div><p><img alt="Sign In Page" src="/oauth2-proxy/assets/images/sign-in-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png"></p><h2><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="architecture"></a>Architecture<a aria-hidden="true" tabindex="-1" class="hash-link" href="#architecture" title="Direct link to heading">#</a></h2><p><img alt="OAuth2 Proxy Architecture" src="/oauth2-proxy/assets/images/architecture-08b382c30c02b227fa4c86cb158b600e.png"></p></div></div></div></div></div></main></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2021 OAuth2 Proxy.</div></div></div></footer></div>
 <script src="/oauth2-proxy/styles.2e624daf.js"></script>
-<script src="/oauth2-proxy/runtime~main.4b63b5ec.js"></script>
-<script src="/oauth2-proxy/main.02092c2d.js"></script>
-<script src="/oauth2-proxy/1.6bed8819.js"></script>
-<script src="/oauth2-proxy/2.f73f779a.js"></script>
-<script src="/oauth2-proxy/40.24f08f88.js"></script>
-<script src="/oauth2-proxy/f3976560.5b30cd66.js"></script>
+<script src="/oauth2-proxy/runtime~main.b90e804b.js"></script>
+<script src="/oauth2-proxy/main.ff464f14.js"></script>
+<script src="/oauth2-proxy/1.07b9992e.js"></script>
+<script src="/oauth2-proxy/2.cd1a0941.js"></script>
+<script src="/oauth2-proxy/39.a8bc1f06.js"></script>
+<script src="/oauth2-proxy/f3976560.c5ee70f7.js"></script>
 </body>
 </html>
\ No newline at end of file
diff --git a/main.02092c2d.js b/main.02092c2d.js
deleted file mode 100644
index 1529e47b..00000000
--- a/main.02092c2d.js
+++ /dev/null
@@ -1,2 +0,0 @@
-/*! For license information please see main.02092c2d.js.LICENSE.txt */
-(window.webpackJsonp=window.webpackJsonp||[]).push([[37],[function(e,t,n){"use strict";e.exports=n(31)},function(e,t,n){"use strict";n.d(t,"a",(function(){return y})),n.d(t,"b",(function(){return w})),n.d(t,"c",(function(){return S})),n.d(t,"d",(function(){return O})),n.d(t,"e",(function(){return v})),n.d(t,"f",(function(){return L})),n.d(t,"g",(function(){return D})),n.d(t,"h",(function(){return g})),n.d(t,"i",(function(){return E})),n.d(t,"j",(function(){return C})),n.d(t,"k",(function(){return M})),n.d(t,"l",(function(){return z})),n.d(t,"m",(function(){return U})),n.d(t,"n",(function(){return $})),n.d(t,"o",(function(){return j}));var r=n(3),o=n(0),a=n.n(o),i=(n(7),n(5)),l=n(18),u=n(4),s=n(2),c=n(19),d=n.n(c),f=(n(23),n(6)),p=n(28),m=n.n(p),h=function(e){var t=Object(l.a)();return t.displayName=e,t}("Router-History"),g=function(e){var t=Object(l.a)();return t.displayName=e,t}("Router"),v=function(e){function t(t){var n;return(n=e.call(this,t)||this).state={location:t.history.location},n._isMounted=!1,n._pendingLocation=null,t.staticContext||(n.unlisten=t.history.listen((function(e){n._isMounted?n.setState({location:e}):n._pendingLocation=e}))),n}Object(r.a)(t,e),t.computeRootMatch=function(e){return{path:"/",url:"/",params:{},isExact:"/"===e}};var n=t.prototype;return n.componentDidMount=function(){this._isMounted=!0,this._pendingLocation&&this.setState({location:this._pendingLocation})},n.componentWillUnmount=function(){this.unlisten&&this.unlisten()},n.render=function(){return a.a.createElement(g.Provider,{value:{history:this.props.history,location:this.state.location,match:t.computeRootMatch(this.state.location.pathname),staticContext:this.props.staticContext}},a.a.createElement(h.Provider,{children:this.props.children||null,value:this.props.history}))},t}(a.a.Component);var y=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).history=Object(i.d)(t.props),t}return Object(r.a)(t,e),t.prototype.render=function(){return a.a.createElement(v,{history:this.history,children:this.props.children})},t}(a.a.Component);var b=function(e){function t(){return e.apply(this,arguments)||this}Object(r.a)(t,e);var n=t.prototype;return n.componentDidMount=function(){this.props.onMount&&this.props.onMount.call(this,this)},n.componentDidUpdate=function(e){this.props.onUpdate&&this.props.onUpdate.call(this,this,e)},n.componentWillUnmount=function(){this.props.onUnmount&&this.props.onUnmount.call(this,this)},n.render=function(){return null},t}(a.a.Component);function w(e){var t=e.message,n=e.when,r=void 0===n||n;return a.a.createElement(g.Consumer,null,(function(e){if(e||Object(u.a)(!1),!r||e.staticContext)return null;var n=e.history.block;return a.a.createElement(b,{onMount:function(e){e.release=n(t)},onUpdate:function(e,r){r.message!==t&&(e.release(),e.release=n(t))},onUnmount:function(e){e.release()},message:t})}))}var x={},k=0;function E(e,t){return void 0===e&&(e="/"),void 0===t&&(t={}),"/"===e?e:function(e){if(x[e])return x[e];var t=d.a.compile(e);return k<1e4&&(x[e]=t,k++),t}(e)(t,{pretty:!0})}function S(e){var t=e.computedMatch,n=e.to,r=e.push,o=void 0!==r&&r;return a.a.createElement(g.Consumer,null,(function(e){e||Object(u.a)(!1);var r=e.history,l=e.staticContext,c=o?r.push:r.replace,d=Object(i.c)(t?"string"==typeof n?E(n,t.params):Object(s.a)({},n,{pathname:E(n.pathname,t.params)}):n);return l?(c(d),null):a.a.createElement(b,{onMount:function(){c(d)},onUpdate:function(e,t){var n=Object(i.c)(t.to);Object(i.f)(n,Object(s.a)({},d,{key:n.key}))||c(d)},to:n})}))}var T={},_=0;function C(e,t){void 0===t&&(t={}),("string"==typeof t||Array.isArray(t))&&(t={path:t});var n=t,r=n.path,o=n.exact,a=void 0!==o&&o,i=n.strict,l=void 0!==i&&i,u=n.sensitive,s=void 0!==u&&u;return[].concat(r).reduce((function(t,n){if(!n&&""!==n)return null;if(t)return t;var r=function(e,t){var n=""+t.end+t.strict+t.sensitive,r=T[n]||(T[n]={});if(r[e])return r[e];var o=[],a={regexp:d()(e,o,t),keys:o};return _<1e4&&(r[e]=a,_++),a}(n,{end:a,strict:l,sensitive:s}),o=r.regexp,i=r.keys,u=o.exec(e);if(!u)return null;var c=u[0],f=u.slice(1),p=e===c;return a&&!p?null:{path:n,url:"/"===n&&""===c?"/":c,isExact:p,params:i.reduce((function(e,t,n){return e[t.name]=f[n],e}),{})}}),null)}var O=function(e){function t(){return e.apply(this,arguments)||this}return Object(r.a)(t,e),t.prototype.render=function(){var e=this;return a.a.createElement(g.Consumer,null,(function(t){t||Object(u.a)(!1);var n=e.props.location||t.location,r=e.props.computedMatch?e.props.computedMatch:e.props.path?C(n.pathname,e.props):t.match,o=Object(s.a)({},t,{location:n,match:r}),i=e.props,l=i.children,c=i.component,d=i.render;return Array.isArray(l)&&0===l.length&&(l=null),a.a.createElement(g.Provider,{value:o},o.match?l?"function"==typeof l?l(o):l:c?a.a.createElement(c,o):d?d(o):null:"function"==typeof l?l(o):null)}))},t}(a.a.Component);function P(e){return"/"===e.charAt(0)?e:"/"+e}function R(e,t){if(!e)return t;var n=P(e);return 0!==t.pathname.indexOf(n)?t:Object(s.a)({},t,{pathname:t.pathname.substr(n.length)})}function A(e){return"string"==typeof e?e:Object(i.e)(e)}function N(e){return function(){Object(u.a)(!1)}}function I(){}var L=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).handlePush=function(e){return t.navigateTo(e,"PUSH")},t.handleReplace=function(e){return t.navigateTo(e,"REPLACE")},t.handleListen=function(){return I},t.handleBlock=function(){return I},t}Object(r.a)(t,e);var n=t.prototype;return n.navigateTo=function(e,t){var n=this.props,r=n.basename,o=void 0===r?"":r,a=n.context,l=void 0===a?{}:a;l.action=t,l.location=function(e,t){return e?Object(s.a)({},t,{pathname:P(e)+t.pathname}):t}(o,Object(i.c)(e)),l.url=A(l.location)},n.render=function(){var e=this.props,t=e.basename,n=void 0===t?"":t,r=e.context,o=void 0===r?{}:r,l=e.location,u=void 0===l?"/":l,c=Object(f.a)(e,["basename","context","location"]),d={createHref:function(e){return P(n+A(e))},action:"POP",location:R(n,Object(i.c)(u)),push:this.handlePush,replace:this.handleReplace,go:N(),goBack:N(),goForward:N(),listen:this.handleListen,block:this.handleBlock};return a.a.createElement(v,Object(s.a)({},c,{history:d,staticContext:o}))},t}(a.a.Component);var D=function(e){function t(){return e.apply(this,arguments)||this}return Object(r.a)(t,e),t.prototype.render=function(){var e=this;return a.a.createElement(g.Consumer,null,(function(t){t||Object(u.a)(!1);var n,r,o=e.props.location||t.location;return a.a.Children.forEach(e.props.children,(function(e){if(null==r&&a.a.isValidElement(e)){n=e;var i=e.props.path||e.props.from;r=i?C(o.pathname,Object(s.a)({},e.props,{path:i})):t.match}})),r?a.a.cloneElement(n,{location:o,computedMatch:r}):null}))},t}(a.a.Component);function j(e){var t="withRouter("+(e.displayName||e.name)+")",n=function(t){var n=t.wrappedComponentRef,r=Object(f.a)(t,["wrappedComponentRef"]);return a.a.createElement(g.Consumer,null,(function(t){return t||Object(u.a)(!1),a.a.createElement(e,Object(s.a)({},r,t,{ref:n}))}))};return n.displayName=t,n.WrappedComponent=e,m()(n,e)}var F=a.a.useContext;function M(){return F(h)}function z(){return F(g).location}function U(){var e=F(g).match;return e?e.params:{}}function $(e){var t=z(),n=F(g).match;return e?C(t.pathname,e):n}},function(e,t,n){"use strict";function r(){return(r=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e}).apply(this,arguments)}n.d(t,"a",(function(){return r}))},function(e,t,n){"use strict";function r(e,t){e.prototype=Object.create(t.prototype),e.prototype.constructor=e,e.__proto__=t}n.d(t,"a",(function(){return r}))},function(e,t,n){"use strict";var r="Invariant failed";t.a=function(e,t){if(!e)throw new Error(r)}},function(e,t,n){"use strict";n.d(t,"a",(function(){return E})),n.d(t,"b",(function(){return P})),n.d(t,"d",(function(){return A})),n.d(t,"c",(function(){return h})),n.d(t,"f",(function(){return g})),n.d(t,"e",(function(){return m}));var r=n(2);function o(e){return"/"===e.charAt(0)}function a(e,t){for(var n=t,r=n+1,o=e.length;r<o;n+=1,r+=1)e[n]=e[r];e.pop()}var i=function(e,t){void 0===t&&(t="");var n,r=e&&e.split("/")||[],i=t&&t.split("/")||[],l=e&&o(e),u=t&&o(t),s=l||u;if(e&&o(e)?i=r:r.length&&(i.pop(),i=i.concat(r)),!i.length)return"/";if(i.length){var c=i[i.length-1];n="."===c||".."===c||""===c}else n=!1;for(var d=0,f=i.length;f>=0;f--){var p=i[f];"."===p?a(i,f):".."===p?(a(i,f),d++):d&&(a(i,f),d--)}if(!s)for(;d--;d)i.unshift("..");!s||""===i[0]||i[0]&&o(i[0])||i.unshift("");var m=i.join("/");return n&&"/"!==m.substr(-1)&&(m+="/"),m};function l(e){return e.valueOf?e.valueOf():Object.prototype.valueOf.call(e)}var u=function e(t,n){if(t===n)return!0;if(null==t||null==n)return!1;if(Array.isArray(t))return Array.isArray(n)&&t.length===n.length&&t.every((function(t,r){return e(t,n[r])}));if("object"==typeof t||"object"==typeof n){var r=l(t),o=l(n);return r!==t||o!==n?e(r,o):Object.keys(Object.assign({},t,n)).every((function(r){return e(t[r],n[r])}))}return!1},s=n(4);function c(e){return"/"===e.charAt(0)?e:"/"+e}function d(e){return"/"===e.charAt(0)?e.substr(1):e}function f(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function p(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function m(e){var t=e.pathname,n=e.search,r=e.hash,o=t||"/";return n&&"?"!==n&&(o+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(o+="#"===r.charAt(0)?r:"#"+r),o}function h(e,t,n,o){var a;"string"==typeof e?(a=function(e){var t=e||"/",n="",r="",o=t.indexOf("#");-1!==o&&(r=t.substr(o),t=t.substr(0,o));var a=t.indexOf("?");return-1!==a&&(n=t.substr(a),t=t.substr(0,a)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e)).state=t:(void 0===(a=Object(r.a)({},e)).pathname&&(a.pathname=""),a.search?"?"!==a.search.charAt(0)&&(a.search="?"+a.search):a.search="",a.hash?"#"!==a.hash.charAt(0)&&(a.hash="#"+a.hash):a.hash="",void 0!==t&&void 0===a.state&&(a.state=t));try{a.pathname=decodeURI(a.pathname)}catch(l){throw l instanceof URIError?new URIError('Pathname "'+a.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):l}return n&&(a.key=n),o?a.pathname?"/"!==a.pathname.charAt(0)&&(a.pathname=i(a.pathname,o.pathname)):a.pathname=o.pathname:a.pathname||(a.pathname="/"),a}function g(e,t){return e.pathname===t.pathname&&e.search===t.search&&e.hash===t.hash&&e.key===t.key&&u(e.state,t.state)}function v(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,o){if(null!=e){var a="function"==typeof e?e(t,n):e;"string"==typeof a?"function"==typeof r?r(a,o):o(!0):o(!1!==a)}else o(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;r<e;r++)n[r]=arguments[r];t.forEach((function(e){return e.apply(void 0,n)}))}}}var y=!("undefined"==typeof window||!window.document||!window.document.createElement);function b(e,t){t(window.confirm(e))}var w="popstate",x="hashchange";function k(){try{return window.history.state||{}}catch(e){return{}}}function E(e){void 0===e&&(e={}),y||Object(s.a)(!1);var t,n=window.history,o=(-1===(t=window.navigator.userAgent).indexOf("Android 2.")&&-1===t.indexOf("Android 4.0")||-1===t.indexOf("Mobile Safari")||-1!==t.indexOf("Chrome")||-1!==t.indexOf("Windows Phone"))&&window.history&&"pushState"in window.history,a=!(-1===window.navigator.userAgent.indexOf("Trident")),i=e,l=i.forceRefresh,u=void 0!==l&&l,d=i.getUserConfirmation,g=void 0===d?b:d,E=i.keyLength,S=void 0===E?6:E,T=e.basename?p(c(e.basename)):"";function _(e){var t=e||{},n=t.key,r=t.state,o=window.location,a=o.pathname+o.search+o.hash;return T&&(a=f(a,T)),h(a,r,n)}function C(){return Math.random().toString(36).substr(2,S)}var O=v();function P(e){Object(r.a)($,e),$.length=n.length,O.notifyListeners($.location,$.action)}function R(e){(function(e){return void 0===e.state&&-1===navigator.userAgent.indexOf("CriOS")})(e)||I(_(e.state))}function A(){I(_(k()))}var N=!1;function I(e){if(N)N=!1,P();else{O.confirmTransitionTo(e,"POP",g,(function(t){t?P({action:"POP",location:e}):function(e){var t=$.location,n=D.indexOf(t.key);-1===n&&(n=0);var r=D.indexOf(e.key);-1===r&&(r=0);var o=n-r;o&&(N=!0,F(o))}(e)}))}}var L=_(k()),D=[L.key];function j(e){return T+m(e)}function F(e){n.go(e)}var M=0;function z(e){1===(M+=e)&&1===e?(window.addEventListener(w,R),a&&window.addEventListener(x,A)):0===M&&(window.removeEventListener(w,R),a&&window.removeEventListener(x,A))}var U=!1;var $={length:n.length,action:"POP",location:L,createHref:j,push:function(e,t){var r="PUSH",a=h(e,t,C(),$.location);O.confirmTransitionTo(a,r,g,(function(e){if(e){var t=j(a),i=a.key,l=a.state;if(o)if(n.pushState({key:i,state:l},null,t),u)window.location.href=t;else{var s=D.indexOf($.location.key),c=D.slice(0,s+1);c.push(a.key),D=c,P({action:r,location:a})}else window.location.href=t}}))},replace:function(e,t){var r="REPLACE",a=h(e,t,C(),$.location);O.confirmTransitionTo(a,r,g,(function(e){if(e){var t=j(a),i=a.key,l=a.state;if(o)if(n.replaceState({key:i,state:l},null,t),u)window.location.replace(t);else{var s=D.indexOf($.location.key);-1!==s&&(D[s]=a.key),P({action:r,location:a})}else window.location.replace(t)}}))},go:F,goBack:function(){F(-1)},goForward:function(){F(1)},block:function(e){void 0===e&&(e=!1);var t=O.setPrompt(e);return U||(z(1),U=!0),function(){return U&&(U=!1,z(-1)),t()}},listen:function(e){var t=O.appendListener(e);return z(1),function(){z(-1),t()}}};return $}var S="hashchange",T={hashbang:{encodePath:function(e){return"!"===e.charAt(0)?e:"!/"+d(e)},decodePath:function(e){return"!"===e.charAt(0)?e.substr(1):e}},noslash:{encodePath:d,decodePath:c},slash:{encodePath:c,decodePath:c}};function _(e){var t=e.indexOf("#");return-1===t?e:e.slice(0,t)}function C(){var e=window.location.href,t=e.indexOf("#");return-1===t?"":e.substring(t+1)}function O(e){window.location.replace(_(window.location.href)+"#"+e)}function P(e){void 0===e&&(e={}),y||Object(s.a)(!1);var t=window.history,n=(window.navigator.userAgent.indexOf("Firefox"),e),o=n.getUserConfirmation,a=void 0===o?b:o,i=n.hashType,l=void 0===i?"slash":i,u=e.basename?p(c(e.basename)):"",d=T[l],g=d.encodePath,w=d.decodePath;function x(){var e=w(C());return u&&(e=f(e,u)),h(e)}var k=v();function E(e){Object(r.a)(U,e),U.length=t.length,k.notifyListeners(U.location,U.action)}var P=!1,R=null;function A(){var e,t,n=C(),r=g(n);if(n!==r)O(r);else{var o=x(),i=U.location;if(!P&&(t=o,(e=i).pathname===t.pathname&&e.search===t.search&&e.hash===t.hash))return;if(R===m(o))return;R=null,function(e){if(P)P=!1,E();else{var t="POP";k.confirmTransitionTo(e,t,a,(function(n){n?E({action:t,location:e}):function(e){var t=U.location,n=D.lastIndexOf(m(t));-1===n&&(n=0);var r=D.lastIndexOf(m(e));-1===r&&(r=0);var o=n-r;o&&(P=!0,j(o))}(e)}))}}(o)}}var N=C(),I=g(N);N!==I&&O(I);var L=x(),D=[m(L)];function j(e){t.go(e)}var F=0;function M(e){1===(F+=e)&&1===e?window.addEventListener(S,A):0===F&&window.removeEventListener(S,A)}var z=!1;var U={length:t.length,action:"POP",location:L,createHref:function(e){var t=document.querySelector("base"),n="";return t&&t.getAttribute("href")&&(n=_(window.location.href)),n+"#"+g(u+m(e))},push:function(e,t){var n="PUSH",r=h(e,void 0,void 0,U.location);k.confirmTransitionTo(r,n,a,(function(e){if(e){var t=m(r),o=g(u+t);if(C()!==o){R=t,function(e){window.location.hash=e}(o);var a=D.lastIndexOf(m(U.location)),i=D.slice(0,a+1);i.push(t),D=i,E({action:n,location:r})}else E()}}))},replace:function(e,t){var n="REPLACE",r=h(e,void 0,void 0,U.location);k.confirmTransitionTo(r,n,a,(function(e){if(e){var t=m(r),o=g(u+t);C()!==o&&(R=t,O(o));var a=D.indexOf(m(U.location));-1!==a&&(D[a]=t),E({action:n,location:r})}}))},go:j,goBack:function(){j(-1)},goForward:function(){j(1)},block:function(e){void 0===e&&(e=!1);var t=k.setPrompt(e);return z||(M(1),z=!0),function(){return z&&(z=!1,M(-1)),t()}},listen:function(e){var t=k.appendListener(e);return M(1),function(){M(-1),t()}}};return U}function R(e,t,n){return Math.min(Math.max(e,t),n)}function A(e){void 0===e&&(e={});var t=e,n=t.getUserConfirmation,o=t.initialEntries,a=void 0===o?["/"]:o,i=t.initialIndex,l=void 0===i?0:i,u=t.keyLength,s=void 0===u?6:u,c=v();function d(e){Object(r.a)(w,e),w.length=w.entries.length,c.notifyListeners(w.location,w.action)}function f(){return Math.random().toString(36).substr(2,s)}var p=R(l,0,a.length-1),g=a.map((function(e){return h(e,void 0,"string"==typeof e?f():e.key||f())})),y=m;function b(e){var t=R(w.index+e,0,w.entries.length-1),r=w.entries[t];c.confirmTransitionTo(r,"POP",n,(function(e){e?d({action:"POP",location:r,index:t}):d()}))}var w={length:g.length,action:"POP",location:g[p],index:p,entries:g,createHref:y,push:function(e,t){var r="PUSH",o=h(e,t,f(),w.location);c.confirmTransitionTo(o,r,n,(function(e){if(e){var t=w.index+1,n=w.entries.slice(0);n.length>t?n.splice(t,n.length-t,o):n.push(o),d({action:r,location:o,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",o=h(e,t,f(),w.location);c.confirmTransitionTo(o,r,n,(function(e){e&&(w.entries[w.index]=o,d({action:r,location:o}))}))},go:b,goBack:function(){b(-1)},goForward:function(){b(1)},canGo:function(e){var t=w.index+e;return t>=0&&t<w.entries.length},block:function(e){return void 0===e&&(e=!1),c.setPrompt(e)},listen:function(e){return c.appendListener(e)}};return w}},function(e,t,n){"use strict";function r(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}n.d(t,"a",(function(){return r}))},function(e,t,n){e.exports=n(35)()},function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return u}));var r=n(1),o=n(2),a=n(0),i=n.n(a);function l(e,t,n){return void 0===n&&(n=[]),e.some((function(e){var o=e.path?Object(r.j)(t,e):n.length?n[n.length-1].match:r.e.computeRootMatch(t);return o&&(n.push({route:e,match:o}),e.routes&&l(e.routes,t,n)),o})),n}function u(e,t,n){return void 0===t&&(t={}),void 0===n&&(n={}),e?i.a.createElement(r.g,n,e.map((function(e,n){return i.a.createElement(r.d,{key:e.key||n,path:e.path,exact:e.exact,strict:e.strict,render:function(n){return e.render?e.render(Object(o.a)({},n,{},t,{route:e})):i.a.createElement(e.component,Object(o.a)({},n,t,{route:e}))}})}))):null}},function(e,t,n){"use strict";var r=!("undefined"==typeof window||!window.document||!window.document.createElement),o={canUseDOM:r,canUseEventListeners:r&&!(!window.addEventListener&&!window.attachEvent),canUseIntersectionObserver:r&&"IntersectionObserver"in window,canUseViewport:r&&!!window.screen};t.a=o},function(e){e.exports=JSON.parse('{"/oauth2-proxy/-4c3":{"component":"1f391b9e","content":"f3976560"},"/oauth2-proxy/docs/6.1.x-b03":{"component":"1be78505","versionMetadata":"be200c4b"},"/oauth2-proxy/docs/6.1.x/-574":{"component":"17896441","content":"7b04b1d5"},"/oauth2-proxy/docs/6.1.x/behaviour-bbe":{"component":"17896441","content":"42326c77"},"/oauth2-proxy/docs/6.1.x/community/security-9f3":{"component":"17896441","content":"ea7cbf6d"},"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider-a82":{"component":"17896441","content":"3def9002"},"/oauth2-proxy/docs/6.1.x/configuration/overview-e4e":{"component":"17896441","content":"ade45c9a"},"/oauth2-proxy/docs/6.1.x/configuration/session_storage-2f9":{"component":"17896441","content":"f5839aac"},"/oauth2-proxy/docs/6.1.x/configuration/tls-ece":{"component":"17896441","content":"a37c03cb"},"/oauth2-proxy/docs/6.1.x/features/endpoints-c39":{"component":"17896441","content":"a991188b"},"/oauth2-proxy/docs/6.1.x/features/request_signatures-d6c":{"component":"17896441","content":"6f497b56"},"/oauth2-proxy/docs/next-8fe":{"component":"1be78505","versionMetadata":"935f2afb"},"/oauth2-proxy/docs/next/-9e9":{"component":"17896441","content":"3b8c55ea"},"/oauth2-proxy/docs/next/behaviour-8be":{"component":"17896441","content":"94285305"},"/oauth2-proxy/docs/next/community/security-166":{"component":"17896441","content":"35234f08"},"/oauth2-proxy/docs/next/configuration/alpha-config-85d":{"component":"17896441","content":"cd4a49c1"},"/oauth2-proxy/docs/next/configuration/oauth_provider-2fc":{"component":"17896441","content":"357fe94d"},"/oauth2-proxy/docs/next/configuration/overview-613":{"component":"17896441","content":"0f425520"},"/oauth2-proxy/docs/next/configuration/session_storage-683":{"component":"17896441","content":"9f61b932"},"/oauth2-proxy/docs/next/configuration/tls-2d0":{"component":"17896441","content":"585bdad0"},"/oauth2-proxy/docs/next/features/endpoints-e4a":{"component":"17896441","content":"efc9be4b"},"/oauth2-proxy/docs/next/features/request_signatures-488":{"component":"17896441","content":"b5649f1e"},"/oauth2-proxy/docs-5d5":{"component":"1be78505","versionMetadata":"230aeb34"},"/oauth2-proxy/docs/-e44":{"component":"17896441","content":"0721a2c0"},"/oauth2-proxy/docs/behaviour-64e":{"component":"17896441","content":"5a047177"},"/oauth2-proxy/docs/community/security-8ab":{"component":"17896441","content":"f4c9d322"},"/oauth2-proxy/docs/configuration/alpha-config-0f1":{"component":"17896441","content":"3fa022c7"},"/oauth2-proxy/docs/configuration/oauth_provider-eca":{"component":"17896441","content":"7dcecc8d"},"/oauth2-proxy/docs/configuration/overview-f23":{"component":"17896441","content":"8c826f25"},"/oauth2-proxy/docs/configuration/session_storage-0fa":{"component":"17896441","content":"edfc6e1b"},"/oauth2-proxy/docs/configuration/tls-44d":{"component":"17896441","content":"00691219"},"/oauth2-proxy/docs/features/endpoints-8f1":{"component":"17896441","content":"001ca130"},"/oauth2-proxy/docs/features/request_signatures-7a6":{"component":"17896441","content":"b89e1cb0"}}')},function(e,t,n){"use strict";t.a={title:"OAuth2 Proxy",tagline:"A lightweight authentication proxy written in Go",url:"https://oauth2-proxy.github.io",baseUrl:"/oauth2-proxy/",onBrokenLinks:"throw",favicon:"img/logos/OAuth2_Proxy_icon.svg",organizationName:"oauth2-proxy",projectName:"oauth2-proxy",themeConfig:{navbar:{title:"OAuth2 Proxy",logo:{alt:"OAuth2 Proxy",src:"img/logos/OAuth2_Proxy_icon.svg"},items:[{to:"docs/",activeBasePath:"docs",label:"Docs",position:"left"},{type:"docsVersionDropdown",position:"right",dropdownActiveClassDisabled:!0,dropdownItemsBefore:[],dropdownItemsAfter:[]},{href:"https://github.com/oauth2-proxy/oauth2-proxy",label:"GitHub",position:"right"}],hideOnScroll:!1},footer:{style:"dark",copyright:"Copyright \xa9 2021 OAuth2 Proxy.",links:[]},colorMode:{defaultMode:"light",disableSwitch:!1,respectPrefersColorScheme:!1,switchConfig:{darkIcon:"\ud83c\udf1c",darkIconStyle:{},lightIcon:"\ud83c\udf1e",lightIconStyle:{}}},docs:{versionPersistence:"localStorage"},metadatas:[],prism:{additionalLanguages:[]}},presets:[["@docusaurus/preset-classic",{docs:{sidebarPath:"/home/runner/work/oauth2-proxy/oauth2-proxy/docs/sidebars.js",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/"},theme:{customCss:"/home/runner/work/oauth2-proxy/oauth2-proxy/docs/src/css/custom.css"}}]],onDuplicateRoutes:"warn",customFields:{},plugins:[],themes:[],titleDelimiter:"|",noIndex:!1}},function(e,t,n){var r,o;void 0===(o="function"==typeof(r=function(){var e,t,n={version:"0.2.0"},r=n.settings={minimum:.08,easing:"ease",positionUsing:"",speed:200,trickle:!0,trickleRate:.02,trickleSpeed:800,showSpinner:!0,barSelector:'[role="bar"]',spinnerSelector:'[role="spinner"]',parent:"body",template:'<div class="bar" role="bar"><div class="peg"></div></div><div class="spinner" role="spinner"><div class="spinner-icon"></div></div>'};function o(e,t,n){return e<t?t:e>n?n:e}function a(e){return 100*(-1+e)}function i(e,t,n){var o;return(o="translate3d"===r.positionUsing?{transform:"translate3d("+a(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+a(e)+"%,0)"}:{"margin-left":a(e)+"%"}).transition="all "+t+"ms "+n,o}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=o(e,r.minimum,1),n.status=1===e?null:e;var a=n.render(!t),s=a.querySelector(r.barSelector),c=r.speed,d=r.easing;return a.offsetWidth,l((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),u(s,i(e,c,d)),1===e?(u(a,{transition:"none",opacity:1}),a.offsetWidth,setTimeout((function(){u(a,{transition:"all "+c+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),c)}),c)):setTimeout(t,c)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*o(Math.random()*t,.1,.95)),t=o(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");c(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var o,i=t.querySelector(r.barSelector),l=e?"-100":a(n.status||0),s=document.querySelector(r.parent);return u(i,{transition:"all 0 linear",transform:"translate3d("+l+"%,0,0)"}),r.showSpinner||(o=t.querySelector(r.spinnerSelector))&&p(o),s!=document.body&&c(s,"nprogress-custom-parent"),s.appendChild(t),t},n.remove=function(){d(document.documentElement,"nprogress-busy"),d(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&p(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var l=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),u=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,o=e.length,a=t.charAt(0).toUpperCase()+t.slice(1);o--;)if((r=e[o]+a)in n)return r;return t}function o(e){return e=n(e),t[e]||(t[e]=r(e))}function a(e,t,n){t=o(t),e.style[t]=n}return function(e,t){var n,r,o=arguments;if(2==o.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&a(e,n,r);else a(e,o[1],o[2])}}();function s(e,t){return("string"==typeof e?e:f(e)).indexOf(" "+t+" ")>=0}function c(e,t){var n=f(e),r=n+t;s(n,t)||(e.className=r.substring(1))}function d(e,t){var n,r=f(e);s(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function f(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function p(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n})?r.call(t,n,t,e):r)||(e.exports=o)},function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return f})),n.d(t,"c",(function(){return y})),n.d(t,"e",(function(){return x}));var r=n(1);n.d(t,"d",(function(){return r.a})),n.d(t,"f",(function(){return r.b})),n.d(t,"g",(function(){return r.c})),n.d(t,"h",(function(){return r.d})),n.d(t,"i",(function(){return r.e})),n.d(t,"j",(function(){return r.f})),n.d(t,"k",(function(){return r.g})),n.d(t,"l",(function(){return r.i})),n.d(t,"m",(function(){return r.j})),n.d(t,"n",(function(){return r.k})),n.d(t,"o",(function(){return r.l})),n.d(t,"p",(function(){return r.m})),n.d(t,"q",(function(){return r.n})),n.d(t,"r",(function(){return r.o}));var o=n(3),a=n(0),i=n.n(a),l=n(5),u=(n(7),n(2)),s=n(6),c=n(4),d=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).history=Object(l.a)(t.props),t}return Object(o.a)(t,e),t.prototype.render=function(){return i.a.createElement(r.e,{history:this.history,children:this.props.children})},t}(i.a.Component);var f=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).history=Object(l.b)(t.props),t}return Object(o.a)(t,e),t.prototype.render=function(){return i.a.createElement(r.e,{history:this.history,children:this.props.children})},t}(i.a.Component);var p=function(e,t){return"function"==typeof e?e(t):e},m=function(e,t){return"string"==typeof e?Object(l.c)(e,null,null,t):e},h=function(e){return e},g=i.a.forwardRef;void 0===g&&(g=h);var v=g((function(e,t){var n=e.innerRef,r=e.navigate,o=e.onClick,a=Object(s.a)(e,["innerRef","navigate","onClick"]),l=a.target,c=Object(u.a)({},a,{onClick:function(e){try{o&&o(e)}catch(t){throw e.preventDefault(),t}e.defaultPrevented||0!==e.button||l&&"_self"!==l||function(e){return!!(e.metaKey||e.altKey||e.ctrlKey||e.shiftKey)}(e)||(e.preventDefault(),r())}});return c.ref=h!==g&&t||n,i.a.createElement("a",c)}));var y=g((function(e,t){var n=e.component,o=void 0===n?v:n,a=e.replace,l=e.to,d=e.innerRef,f=Object(s.a)(e,["component","replace","to","innerRef"]);return i.a.createElement(r.h.Consumer,null,(function(e){e||Object(c.a)(!1);var n=e.history,r=m(p(l,e.location),e.location),s=r?n.createHref(r):"",v=Object(u.a)({},f,{href:s,navigate:function(){var t=p(l,e.location);(a?n.replace:n.push)(t)}});return h!==g?v.ref=t||d:v.innerRef=d,i.a.createElement(o,v)}))})),b=function(e){return e},w=i.a.forwardRef;void 0===w&&(w=b);var x=w((function(e,t){var n=e["aria-current"],o=void 0===n?"page":n,a=e.activeClassName,l=void 0===a?"active":a,d=e.activeStyle,f=e.className,h=e.exact,g=e.isActive,v=e.location,x=e.sensitive,k=e.strict,E=e.style,S=e.to,T=e.innerRef,_=Object(s.a)(e,["aria-current","activeClassName","activeStyle","className","exact","isActive","location","sensitive","strict","style","to","innerRef"]);return i.a.createElement(r.h.Consumer,null,(function(e){e||Object(c.a)(!1);var n=v||e.location,a=m(p(S,n),n),s=a.pathname,C=s&&s.replace(/([.+*?=^!:${}()[\]|/\\])/g,"\\$1"),O=C?Object(r.j)(n.pathname,{path:C,exact:h,sensitive:x,strict:k}):null,P=!!(g?g(O,n):O),R=P?function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return t.filter((function(e){return e})).join(" ")}(f,l):f,A=P?Object(u.a)({},E,{},d):E,N=Object(u.a)({"aria-current":P&&o||null,className:R,style:A,to:a},_);return b!==w?N.ref=t||T:N.innerRef=T,i.a.createElement(y,N)}))}))},,,function(e,t,n){var r={"./":40};function o(e){var t=a(e);return n(t)}function a(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=a,e.exports=o,o.id=16},function(e,t,n){"use strict";var r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e};function o(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function a(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t}function i(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}var l=n(0),u=n(7),s=[],c=[];function d(e){var t=e(),n={loading:!0,loaded:null,error:null};return n.promise=t.then((function(e){return n.loading=!1,n.loaded=e,e})).catch((function(e){throw n.loading=!1,n.error=e,e})),n}function f(e){var t={loading:!1,loaded:{},error:null},n=[];try{Object.keys(e).forEach((function(r){var o=d(e[r]);o.loading?t.loading=!0:(t.loaded[r]=o.loaded,t.error=o.error),n.push(o.promise),o.promise.then((function(e){t.loaded[r]=e})).catch((function(e){t.error=e}))}))}catch(r){t.error=r}return t.promise=Promise.all(n).then((function(e){return t.loading=!1,e})).catch((function(e){throw t.loading=!1,e})),t}function p(e,t){return l.createElement((n=e)&&n.__esModule?n.default:n,t);var n}function m(e,t){var d,f;if(!t.loading)throw new Error("react-loadable requires a `loading` component");var m=Object.assign({loader:null,loading:null,delay:200,timeout:null,render:p,webpack:null,modules:null},t),h=null;function g(){return h||(h=e(m.loader)),h.promise}return s.push(g),"function"==typeof m.webpack&&c.push((function(){if(e=m.webpack,"object"===r(n.m)&&e().every((function(e){return void 0!==e&&void 0!==n.m[e]})))return g();var e})),f=d=function(t){function n(r){o(this,n);var i=a(this,t.call(this,r));return i.retry=function(){i.setState({error:null,loading:!0,timedOut:!1}),h=e(m.loader),i._loadModule()},g(),i.state={error:h.error,pastDelay:!1,timedOut:!1,loading:h.loading,loaded:h.loaded},i}return i(n,t),n.preload=function(){return g()},n.prototype.componentWillMount=function(){this._mounted=!0,this._loadModule()},n.prototype._loadModule=function(){var e=this;if(this.context.loadable&&Array.isArray(m.modules)&&m.modules.forEach((function(t){e.context.loadable.report(t)})),h.loading){"number"==typeof m.delay&&(0===m.delay?this.setState({pastDelay:!0}):this._delay=setTimeout((function(){e.setState({pastDelay:!0})}),m.delay)),"number"==typeof m.timeout&&(this._timeout=setTimeout((function(){e.setState({timedOut:!0})}),m.timeout));var t=function(){e._mounted&&(e.setState({error:h.error,loaded:h.loaded,loading:h.loading}),e._clearTimeouts())};h.promise.then((function(){t()})).catch((function(e){t()}))}},n.prototype.componentWillUnmount=function(){this._mounted=!1,this._clearTimeouts()},n.prototype._clearTimeouts=function(){clearTimeout(this._delay),clearTimeout(this._timeout)},n.prototype.render=function(){return this.state.loading||this.state.error?l.createElement(m.loading,{isLoading:this.state.loading,pastDelay:this.state.pastDelay,timedOut:this.state.timedOut,error:this.state.error,retry:this.retry}):this.state.loaded?m.render(this.state.loaded,this.props):null},n}(l.Component),d.contextTypes={loadable:u.shape({report:u.func.isRequired})},f}function h(e){return m(d,e)}h.Map=function(e){if("function"!=typeof e.render)throw new Error("LoadableMap requires a `render(loaded, props)` function");return m(f,e)};var g=function(e){function t(){return o(this,t),a(this,e.apply(this,arguments))}return i(t,e),t.prototype.getChildContext=function(){return{loadable:{report:this.props.report}}},t.prototype.render=function(){return l.Children.only(this.props.children)},t}(l.Component);function v(e){for(var t=[];e.length;){var n=e.pop();t.push(n())}return Promise.all(t).then((function(){if(e.length)return v(e)}))}g.propTypes={report:u.func.isRequired},g.childContextTypes={loadable:u.shape({report:u.func.isRequired}).isRequired},h.Capture=g,h.preloadAll=function(){return new Promise((function(e,t){v(s).then(e,t)}))},h.preloadReady=function(){return new Promise((function(e,t){v(c).then(e,e)}))},e.exports=h},function(e,t,n){"use strict";(function(e){var r=n(0),o=n.n(r),a=n(3),i=n(7),l=n.n(i),u=1073741823,s="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:void 0!==e?e:{};function c(e){var t=[];return{on:function(e){t.push(e)},off:function(e){t=t.filter((function(t){return t!==e}))},get:function(){return e},set:function(n,r){e=n,t.forEach((function(t){return t(e,r)}))}}}var d=o.a.createContext||function(e,t){var n,o,i,d="__create-react-context-"+((s[i="__global_unique_id__"]=(s[i]||0)+1)+"__"),f=function(e){function n(){var t;return(t=e.apply(this,arguments)||this).emitter=c(t.props.value),t}Object(a.a)(n,e);var r=n.prototype;return r.getChildContext=function(){var e;return(e={})[d]=this.emitter,e},r.componentWillReceiveProps=function(e){if(this.props.value!==e.value){var n,r=this.props.value,o=e.value;((a=r)===(i=o)?0!==a||1/a==1/i:a!=a&&i!=i)?n=0:(n="function"==typeof t?t(r,o):u,0!==(n|=0)&&this.emitter.set(e.value,n))}var a,i},r.render=function(){return this.props.children},n}(r.Component);f.childContextTypes=((n={})[d]=l.a.object.isRequired,n);var p=function(t){function n(){var e;return(e=t.apply(this,arguments)||this).state={value:e.getValue()},e.onUpdate=function(t,n){0!=((0|e.observedBits)&n)&&e.setState({value:e.getValue()})},e}Object(a.a)(n,t);var r=n.prototype;return r.componentWillReceiveProps=function(e){var t=e.observedBits;this.observedBits=null==t?u:t},r.componentDidMount=function(){this.context[d]&&this.context[d].on(this.onUpdate);var e=this.props.observedBits;this.observedBits=null==e?u:e},r.componentWillUnmount=function(){this.context[d]&&this.context[d].off(this.onUpdate)},r.getValue=function(){return this.context[d]?this.context[d].get():e},r.render=function(){return(e=this.props.children,Array.isArray(e)?e[0]:e)(this.state.value);var e},n}(r.Component);return p.contextTypes=((o={})[d]=l.a.object,o),{Provider:f,Consumer:p}};t.a=d}).call(this,n(29))},function(e,t,n){var r=n(37);e.exports=p,e.exports.parse=a,e.exports.compile=function(e,t){return l(a(e,t),t)},e.exports.tokensToFunction=l,e.exports.tokensToRegExp=f;var o=new RegExp(["(\\\\.)","([\\/.])?(?:(?:\\:(\\w+)(?:\\(((?:\\\\.|[^\\\\()])+)\\))?|\\(((?:\\\\.|[^\\\\()])+)\\))([+*?])?|(\\*))"].join("|"),"g");function a(e,t){for(var n,r=[],a=0,i=0,l="",c=t&&t.delimiter||"/";null!=(n=o.exec(e));){var d=n[0],f=n[1],p=n.index;if(l+=e.slice(i,p),i=p+d.length,f)l+=f[1];else{var m=e[i],h=n[2],g=n[3],v=n[4],y=n[5],b=n[6],w=n[7];l&&(r.push(l),l="");var x=null!=h&&null!=m&&m!==h,k="+"===b||"*"===b,E="?"===b||"*"===b,S=n[2]||c,T=v||y;r.push({name:g||a++,prefix:h||"",delimiter:S,optional:E,repeat:k,partial:x,asterisk:!!w,pattern:T?s(T):w?".*":"[^"+u(S)+"]+?"})}}return i<e.length&&(l+=e.substr(i)),l&&r.push(l),r}function i(e){return encodeURI(e).replace(/[\/?#]/g,(function(e){return"%"+e.charCodeAt(0).toString(16).toUpperCase()}))}function l(e,t){for(var n=new Array(e.length),o=0;o<e.length;o++)"object"==typeof e[o]&&(n[o]=new RegExp("^(?:"+e[o].pattern+")$",d(t)));return function(t,o){for(var a="",l=t||{},u=(o||{}).pretty?i:encodeURIComponent,s=0;s<e.length;s++){var c=e[s];if("string"!=typeof c){var d,f=l[c.name];if(null==f){if(c.optional){c.partial&&(a+=c.prefix);continue}throw new TypeError('Expected "'+c.name+'" to be defined')}if(r(f)){if(!c.repeat)throw new TypeError('Expected "'+c.name+'" to not repeat, but received `'+JSON.stringify(f)+"`");if(0===f.length){if(c.optional)continue;throw new TypeError('Expected "'+c.name+'" to not be empty')}for(var p=0;p<f.length;p++){if(d=u(f[p]),!n[s].test(d))throw new TypeError('Expected all "'+c.name+'" to match "'+c.pattern+'", but received `'+JSON.stringify(d)+"`");a+=(0===p?c.prefix:c.delimiter)+d}}else{if(d=c.asterisk?encodeURI(f).replace(/[?#]/g,(function(e){return"%"+e.charCodeAt(0).toString(16).toUpperCase()})):u(f),!n[s].test(d))throw new TypeError('Expected "'+c.name+'" to match "'+c.pattern+'", but received "'+d+'"');a+=c.prefix+d}}else a+=c}return a}}function u(e){return e.replace(/([.+*?=^!:${}()[\]|\/\\])/g,"\\$1")}function s(e){return e.replace(/([=!:$\/()])/g,"\\$1")}function c(e,t){return e.keys=t,e}function d(e){return e&&e.sensitive?"":"i"}function f(e,t,n){r(t)||(n=t||n,t=[]);for(var o=(n=n||{}).strict,a=!1!==n.end,i="",l=0;l<e.length;l++){var s=e[l];if("string"==typeof s)i+=u(s);else{var f=u(s.prefix),p="(?:"+s.pattern+")";t.push(s),s.repeat&&(p+="(?:"+f+p+")*"),i+=p=s.optional?s.partial?f+"("+p+")?":"(?:"+f+"("+p+"))?":f+"("+p+")"}}var m=u(n.delimiter||"/"),h=i.slice(-m.length)===m;return o||(i=(h?i.slice(0,-m.length):i)+"(?:"+m+"(?=$))?"),i+=a?"$":o&&h?"":"(?="+m+"|$)",c(new RegExp("^"+i,d(n)),t)}function p(e,t,n){return r(t)||(n=t||n,t=[]),n=n||{},e instanceof RegExp?function(e,t){var n=e.source.match(/\((?!\?)/g);if(n)for(var r=0;r<n.length;r++)t.push({name:r,prefix:null,delimiter:null,optional:!1,repeat:!1,partial:!1,asterisk:!1,pattern:null});return c(e,t)}(e,t):r(e)?function(e,t,n){for(var r=[],o=0;o<e.length;o++)r.push(p(e[o],t,n).source);return c(new RegExp("(?:"+r.join("|")+")",d(n)),t)}(e,t,n):function(e,t,n){return f(a(e,n),t,n)}(e,t,n)}},function(e,t,n){"use strict";var r,o,a,i=(r=0,o={util:{encode:function(e){return e instanceof a?new a(e.type,o.util.encode(e.content),e.alias):"Array"===o.util.type(e)?e.map(o.util.encode):e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/\u00a0/g," ")},type:function(e){return Object.prototype.toString.call(e).match(/\[object (\w+)\]/)[1]},objId:function(e){return e.__id||Object.defineProperty(e,"__id",{value:++r}),e.__id},clone:function(e,t){var n=o.util.type(e);switch(t=t||{},n){case"Object":if(t[o.util.objId(e)])return t[o.util.objId(e)];var r={};for(var a in t[o.util.objId(e)]=r,e)e.hasOwnProperty(a)&&(r[a]=o.util.clone(e[a],t));return r;case"Array":return t[o.util.objId(e)]?t[o.util.objId(e)]:(r=[],t[o.util.objId(e)]=r,e.forEach((function(e,n){r[n]=o.util.clone(e,t)})),r)}return e}},languages:{extend:function(e,t){var n=o.util.clone(o.languages[e]);for(var r in t)n[r]=t[r];return n},insertBefore:function(e,t,n,r){var a=(r=r||o.languages)[e];if(2==arguments.length){for(var i in n=arguments[1])n.hasOwnProperty(i)&&(a[i]=n[i]);return a}var l={};for(var u in a)if(a.hasOwnProperty(u)){if(u==t)for(var i in n)n.hasOwnProperty(i)&&(l[i]=n[i]);l[u]=a[u]}return o.languages.DFS(o.languages,(function(t,n){n===r[e]&&t!=e&&(this[t]=l)})),r[e]=l},DFS:function(e,t,n,r){for(var a in r=r||{},e)e.hasOwnProperty(a)&&(t.call(e,a,e[a],n||a),"Object"!==o.util.type(e[a])||r[o.util.objId(e[a])]?"Array"!==o.util.type(e[a])||r[o.util.objId(e[a])]||(r[o.util.objId(e[a])]=!0,o.languages.DFS(e[a],t,a,r)):(r[o.util.objId(e[a])]=!0,o.languages.DFS(e[a],t,null,r)))}},plugins:{},highlight:function(e,t,n){var r={code:e,grammar:t,language:n};return r.tokens=o.tokenize(r.code,r.grammar),a.stringify(o.util.encode(r.tokens),r.language)},matchGrammar:function(e,t,n,r,a,i,l){var u=o.Token;for(var s in n)if(n.hasOwnProperty(s)&&n[s]){if(s==l)return;var c=n[s];c="Array"===o.util.type(c)?c:[c];for(var d=0;d<c.length;++d){var f=c[d],p=f.inside,m=!!f.lookbehind,h=!!f.greedy,g=0,v=f.alias;if(h&&!f.pattern.global){var y=f.pattern.toString().match(/[imuy]*$/)[0];f.pattern=RegExp(f.pattern.source,y+"g")}f=f.pattern||f;for(var b=r,w=a;b<t.length;w+=t[b].length,++b){var x=t[b];if(t.length>e.length)return;if(!(x instanceof u)){if(h&&b!=t.length-1){if(f.lastIndex=w,!(C=f.exec(e)))break;for(var k=C.index+(m?C[1].length:0),E=C.index+C[0].length,S=b,T=w,_=t.length;S<_&&(T<E||!t[S].type&&!t[S-1].greedy);++S)k>=(T+=t[S].length)&&(++b,w=T);if(t[b]instanceof u)continue;O=S-b,x=e.slice(w,T),C.index-=w}else{f.lastIndex=0;var C=f.exec(x),O=1}if(C){m&&(g=C[1]?C[1].length:0),E=(k=C.index+g)+(C=C[0].slice(g)).length;var P=x.slice(0,k),R=x.slice(E),A=[b,O];P&&(++b,w+=P.length,A.push(P));var N=new u(s,p?o.tokenize(C,p):C,v,C,h);if(A.push(N),R&&A.push(R),Array.prototype.splice.apply(t,A),1!=O&&o.matchGrammar(e,t,n,b,w,!0,s),i)break}else if(i)break}}}}},hooks:{add:function(){}},tokenize:function(e,t,n){var r=[e],a=t.rest;if(a){for(var i in a)t[i]=a[i];delete t.rest}return o.matchGrammar(e,r,t,0,0,!1),r}},(a=o.Token=function(e,t,n,r,o){this.type=e,this.content=t,this.alias=n,this.length=0|(r||"").length,this.greedy=!!o}).stringify=function(e,t,n){if("string"==typeof e)return e;if("Array"===o.util.type(e))return e.map((function(n){return a.stringify(n,t,e)})).join("");var r={type:e.type,content:a.stringify(e.content,t,n),tag:"span",classes:["token",e.type],attributes:{},language:t,parent:n};if(e.alias){var i="Array"===o.util.type(e.alias)?e.alias:[e.alias];Array.prototype.push.apply(r.classes,i)}var l=Object.keys(r.attributes).map((function(e){return e+'="'+(r.attributes[e]||"").replace(/"/g,"&quot;")+'"'})).join(" ");return"<"+r.tag+' class="'+r.classes.join(" ")+'"'+(l?" "+l:"")+">"+r.content+"</"+r.tag+">"},o);i.languages.markup={comment:/<!--[\s\S]*?-->/,prolog:/<\?[\s\S]+?\?>/,doctype:/<!DOCTYPE[\s\S]+?>/i,cdata:/<!\[CDATA\[[\s\S]*?]]>/i,tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s(?:\s*[^\s>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))|(?=[\s/>])))+)?\s*\/?>/i,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/i,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+)/i,inside:{punctuation:[/^=/,{pattern:/^(\s*)["']|["']$/,lookbehind:!0}]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:/&#?[\da-z]{1,8};/i},i.languages.markup.tag.inside["attr-value"].inside.entity=i.languages.markup.entity,i.hooks.add("wrap",(function(e){"entity"===e.type&&(e.attributes.title=e.content.replace(/&amp;/,"&"))})),Object.defineProperty(i.languages.markup.tag,"addInlined",{value:function(e,t){var n={};n["language-"+t]={pattern:/(^<!\[CDATA\[)[\s\S]+?(?=\]\]>$)/i,lookbehind:!0,inside:i.languages[t]},n.cdata=/^<!\[CDATA\[|\]\]>$/i;var r={"included-cdata":{pattern:/<!\[CDATA\[[\s\S]*?\]\]>/i,inside:n}};r["language-"+t]={pattern:/[\s\S]+/,inside:i.languages[t]};var o={};o[e]={pattern:RegExp(/(<__[\s\S]*?>)(?:<!\[CDATA\[[\s\S]*?\]\]>\s*|[\s\S])*?(?=<\/__>)/.source.replace(/__/g,e),"i"),lookbehind:!0,greedy:!0,inside:r},i.languages.insertBefore("markup","cdata",o)}}),i.languages.xml=i.languages.extend("markup",{}),i.languages.html=i.languages.markup,i.languages.mathml=i.languages.markup,i.languages.svg=i.languages.markup,function(e){var t="\\b(?:BASH|BASHOPTS|BASH_ALIASES|BASH_ARGC|BASH_ARGV|BASH_CMDS|BASH_COMPLETION_COMPAT_DIR|BASH_LINENO|BASH_REMATCH|BASH_SOURCE|BASH_VERSINFO|BASH_VERSION|COLORTERM|COLUMNS|COMP_WORDBREAKS|DBUS_SESSION_BUS_ADDRESS|DEFAULTS_PATH|DESKTOP_SESSION|DIRSTACK|DISPLAY|EUID|GDMSESSION|GDM_LANG|GNOME_KEYRING_CONTROL|GNOME_KEYRING_PID|GPG_AGENT_INFO|GROUPS|HISTCONTROL|HISTFILE|HISTFILESIZE|HISTSIZE|HOME|HOSTNAME|HOSTTYPE|IFS|INSTANCE|JOB|LANG|LANGUAGE|LC_ADDRESS|LC_ALL|LC_IDENTIFICATION|LC_MEASUREMENT|LC_MONETARY|LC_NAME|LC_NUMERIC|LC_PAPER|LC_TELEPHONE|LC_TIME|LESSCLOSE|LESSOPEN|LINES|LOGNAME|LS_COLORS|MACHTYPE|MAILCHECK|MANDATORY_PATH|NO_AT_BRIDGE|OLDPWD|OPTERR|OPTIND|ORBIT_SOCKETDIR|OSTYPE|PAPERSIZE|PATH|PIPESTATUS|PPID|PS1|PS2|PS3|PS4|PWD|RANDOM|REPLY|SECONDS|SELINUX_INIT|SESSION|SESSIONTYPE|SESSION_MANAGER|SHELL|SHELLOPTS|SHLVL|SSH_AUTH_SOCK|TERM|UID|UPSTART_EVENTS|UPSTART_INSTANCE|UPSTART_JOB|UPSTART_SESSION|USER|WINDOWID|XAUTHORITY|XDG_CONFIG_DIRS|XDG_CURRENT_DESKTOP|XDG_DATA_DIRS|XDG_GREETER_DATA_DIR|XDG_MENU_PREFIX|XDG_RUNTIME_DIR|XDG_SEAT|XDG_SEAT_PATH|XDG_SESSION_DESKTOP|XDG_SESSION_ID|XDG_SESSION_PATH|XDG_SESSION_TYPE|XDG_VTNR|XMODIFIERS)\\b",n={environment:{pattern:RegExp("\\$"+t),alias:"constant"},variable:[{pattern:/\$?\(\([\s\S]+?\)\)/,greedy:!0,inside:{variable:[{pattern:/(^\$\(\([\s\S]+)\)\)/,lookbehind:!0},/^\$\(\(/],number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/--?|-=|\+\+?|\+=|!=?|~|\*\*?|\*=|\/=?|%=?|<<=?|>>=?|<=?|>=?|==?|&&?|&=|\^=?|\|\|?|\|=|\?|:/,punctuation:/\(\(?|\)\)?|,|;/}},{pattern:/\$\((?:\([^)]+\)|[^()])+\)|`[^`]+`/,greedy:!0,inside:{variable:/^\$\(|^`|\)$|`$/}},{pattern:/\$\{[^}]+\}/,greedy:!0,inside:{operator:/:[-=?+]?|[!\/]|##?|%%?|\^\^?|,,?/,punctuation:/[\[\]]/,environment:{pattern:RegExp("(\\{)"+t),lookbehind:!0,alias:"constant"}}},/\$(?:\w+|[#?*!@$])/],entity:/\\(?:[abceEfnrtv\\"]|O?[0-7]{1,3}|x[0-9a-fA-F]{1,2}|u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8})/};e.languages.bash={shebang:{pattern:/^#!\s*\/.*/,alias:"important"},comment:{pattern:/(^|[^"{\\$])#.*/,lookbehind:!0},"function-name":[{pattern:/(\bfunction\s+)\w+(?=(?:\s*\(?:\s*\))?\s*\{)/,lookbehind:!0,alias:"function"},{pattern:/\b\w+(?=\s*\(\s*\)\s*\{)/,alias:"function"}],"for-or-select":{pattern:/(\b(?:for|select)\s+)\w+(?=\s+in\s)/,alias:"variable",lookbehind:!0},"assign-left":{pattern:/(^|[\s;|&]|[<>]\()\w+(?=\+?=)/,inside:{environment:{pattern:RegExp("(^|[\\s;|&]|[<>]\\()"+t),lookbehind:!0,alias:"constant"}},alias:"variable",lookbehind:!0},string:[{pattern:/((?:^|[^<])<<-?\s*)(\w+?)\s*(?:\r?\n|\r)(?:[\s\S])*?(?:\r?\n|\r)\2/,lookbehind:!0,greedy:!0,inside:n},{pattern:/((?:^|[^<])<<-?\s*)(["'])(\w+)\2\s*(?:\r?\n|\r)(?:[\s\S])*?(?:\r?\n|\r)\3/,lookbehind:!0,greedy:!0},{pattern:/(["'])(?:\\[\s\S]|\$\([^)]+\)|`[^`]+`|(?!\1)[^\\])*\1/,greedy:!0,inside:n}],environment:{pattern:RegExp("\\$?"+t),alias:"constant"},variable:n.variable,function:{pattern:/(^|[\s;|&]|[<>]\()(?:add|apropos|apt|aptitude|apt-cache|apt-get|aspell|automysqlbackup|awk|basename|bash|bc|bconsole|bg|bzip2|cal|cat|cfdisk|chgrp|chkconfig|chmod|chown|chroot|cksum|clear|cmp|column|comm|cp|cron|crontab|csplit|curl|cut|date|dc|dd|ddrescue|debootstrap|df|diff|diff3|dig|dir|dircolors|dirname|dirs|dmesg|du|egrep|eject|env|ethtool|expand|expect|expr|fdformat|fdisk|fg|fgrep|file|find|fmt|fold|format|free|fsck|ftp|fuser|gawk|git|gparted|grep|groupadd|groupdel|groupmod|groups|grub-mkconfig|gzip|halt|head|hg|history|host|hostname|htop|iconv|id|ifconfig|ifdown|ifup|import|install|ip|jobs|join|kill|killall|less|link|ln|locate|logname|logrotate|look|lpc|lpr|lprint|lprintd|lprintq|lprm|ls|lsof|lynx|make|man|mc|mdadm|mkconfig|mkdir|mke2fs|mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh|shellcheck|shuf|shutdown|sleep|slocate|sort|split|ssh|stat|strace|su|sudo|sum|suspend|swapon|sync|tac|tail|tar|tee|time|timeout|top|touch|tr|traceroute|tsort|tty|umount|uname|unexpand|uniq|units|unrar|unshar|unzip|update-grub|uptime|useradd|userdel|usermod|users|uudecode|uuencode|v|vdir|vi|vim|virsh|vmstat|wait|watch|wc|wget|whereis|which|who|whoami|write|xargs|xdg-open|yarn|yes|zenity|zip|zsh|zypper)(?=$|[)\s;|&])/,lookbehind:!0},keyword:{pattern:/(^|[\s;|&]|[<>]\()(?:if|then|else|elif|fi|for|while|in|case|esac|function|select|do|done|until)(?=$|[)\s;|&])/,lookbehind:!0},builtin:{pattern:/(^|[\s;|&]|[<>]\()(?:\.|:|break|cd|continue|eval|exec|exit|export|getopts|hash|pwd|readonly|return|shift|test|times|trap|umask|unset|alias|bind|builtin|caller|command|declare|echo|enable|help|let|local|logout|mapfile|printf|read|readarray|source|type|typeset|ulimit|unalias|set|shopt)(?=$|[)\s;|&])/,lookbehind:!0,alias:"class-name"},boolean:{pattern:/(^|[\s;|&]|[<>]\()(?:true|false)(?=$|[)\s;|&])/,lookbehind:!0},"file-descriptor":{pattern:/\B&\d\b/,alias:"important"},operator:{pattern:/\d?<>|>\||\+=|==?|!=?|=~|<<[<-]?|[&\d]?>>|\d?[<>]&?|&[>&]?|\|[&|]?|<=?|>=?/,inside:{"file-descriptor":{pattern:/^\d/,alias:"important"}}},punctuation:/\$?\(\(?|\)\)?|\.\.|[{}[\];\\]/,number:{pattern:/(^|\s)(?:[1-9]\d*|0)(?:[.,]\d+)?\b/,lookbehind:!0}};for(var r=["comment","function-name","for-or-select","assign-left","string","environment","function","keyword","builtin","boolean","file-descriptor","operator","punctuation","number"],o=n.variable[1].inside,a=0;a<r.length;a++)o[r[a]]=e.languages.bash[r[a]];e.languages.shell=e.languages.bash}(i),i.languages.clike={comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},"class-name":{pattern:/((?:\b(?:class|interface|extends|implements|trait|instanceof|new)\s+)|(?:catch\s+\())[\w.\\]+/i,lookbehind:!0,inside:{punctuation:/[.\\]/}},keyword:/\b(?:if|else|while|do|for|return|in|instanceof|function|new|try|throw|catch|finally|null|break|continue)\b/,boolean:/\b(?:true|false)\b/,function:/\w+(?=\()/,number:/\b0x[\da-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:e[+-]?\d+)?/i,operator:/--?|\+\+?|!=?=?|<=?|>=?|==?=?|&&?|\|\|?|\?|\*|\/|~|\^|%/,punctuation:/[{}[\];(),.:]/},i.languages.c=i.languages.extend("clike",{"class-name":{pattern:/(\b(?:enum|struct)\s+)\w+/,lookbehind:!0},keyword:/\b(?:_Alignas|_Alignof|_Atomic|_Bool|_Complex|_Generic|_Imaginary|_Noreturn|_Static_assert|_Thread_local|asm|typeof|inline|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|union|unsigned|void|volatile|while)\b/,operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?/,number:/(?:\b0x(?:[\da-f]+\.?[\da-f]*|\.[\da-f]+)(?:p[+-]?\d+)?|(?:\b\d+\.?\d*|\B\.\d+)(?:e[+-]?\d+)?)[ful]*/i}),i.languages.insertBefore("c","string",{macro:{pattern:/(^\s*)#\s*[a-z]+(?:[^\r\n\\]|\\(?:\r\n|[\s\S]))*/im,lookbehind:!0,alias:"property",inside:{string:{pattern:/(#\s*include\s*)(?:<.+?>|("|')(?:\\?.)+?\2)/,lookbehind:!0},directive:{pattern:/(#\s*)\b(?:define|defined|elif|else|endif|error|ifdef|ifndef|if|import|include|line|pragma|undef|using)\b/,lookbehind:!0,alias:"keyword"}}},constant:/\b(?:__FILE__|__LINE__|__DATE__|__TIME__|__TIMESTAMP__|__func__|EOF|NULL|SEEK_CUR|SEEK_END|SEEK_SET|stdin|stdout|stderr)\b/}),delete i.languages.c.boolean,i.languages.cpp=i.languages.extend("c",{"class-name":{pattern:/(\b(?:class|enum|struct)\s+)\w+/,lookbehind:!0},keyword:/\b(?:alignas|alignof|asm|auto|bool|break|case|catch|char|char16_t|char32_t|class|compl|const|constexpr|const_cast|continue|decltype|default|delete|do|double|dynamic_cast|else|enum|explicit|export|extern|float|for|friend|goto|if|inline|int|int8_t|int16_t|int32_t|int64_t|uint8_t|uint16_t|uint32_t|uint64_t|long|mutable|namespace|new|noexcept|nullptr|operator|private|protected|public|register|reinterpret_cast|return|short|signed|sizeof|static|static_assert|static_cast|struct|switch|template|this|thread_local|throw|try|typedef|typeid|typename|union|unsigned|using|virtual|void|volatile|wchar_t|while)\b/,number:{pattern:/(?:\b0b[01']+|\b0x(?:[\da-f']+\.?[\da-f']*|\.[\da-f']+)(?:p[+-]?[\d']+)?|(?:\b[\d']+\.?[\d']*|\B\.[\d']+)(?:e[+-]?[\d']+)?)[ful]*/i,greedy:!0},operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?|\b(?:and|and_eq|bitand|bitor|not|not_eq|or|or_eq|xor|xor_eq)\b/,boolean:/\b(?:true|false)\b/}),i.languages.insertBefore("cpp","string",{"raw-string":{pattern:/R"([^()\\ ]{0,16})\([\s\S]*?\)\1"/,alias:"string",greedy:!0}}),function(e){var t=/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/;e.languages.css={comment:/\/\*[\s\S]*?\*\//,atrule:{pattern:/@[\w-]+[\s\S]*?(?:;|(?=\s*\{))/,inside:{rule:/@[\w-]+/}},url:{pattern:RegExp("url\\((?:"+t.source+"|[^\n\r()]*)\\)","i"),inside:{function:/^url/i,punctuation:/^\(|\)$/}},selector:RegExp("[^{}\\s](?:[^{};\"']|"+t.source+")*?(?=\\s*\\{)"),string:{pattern:t,greedy:!0},property:/[-_a-z\xA0-\uFFFF][-\w\xA0-\uFFFF]*(?=\s*:)/i,important:/!important\b/i,function:/[-a-z0-9]+(?=\()/i,punctuation:/[(){};:,]/},e.languages.css.atrule.inside.rest=e.languages.css;var n=e.languages.markup;n&&(n.tag.addInlined("style","css"),e.languages.insertBefore("inside","attr-value",{"style-attr":{pattern:/\s*style=("|')(?:\\[\s\S]|(?!\1)[^\\])*\1/i,inside:{"attr-name":{pattern:/^\s*style/i,inside:n.tag.inside},punctuation:/^\s*=\s*['"]|['"]\s*$/,"attr-value":{pattern:/.+/i,inside:e.languages.css}},alias:"language-css"}},n.tag))}(i),i.languages.css.selector={pattern:i.languages.css.selector,inside:{"pseudo-element":/:(?:after|before|first-letter|first-line|selection)|::[-\w]+/,"pseudo-class":/:[-\w]+/,class:/\.[-:.\w]+/,id:/#[-:.\w]+/,attribute:{pattern:/\[(?:[^[\]"']|("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1)*\]/,greedy:!0,inside:{punctuation:/^\[|\]$/,"case-sensitivity":{pattern:/(\s)[si]$/i,lookbehind:!0,alias:"keyword"},namespace:{pattern:/^(\s*)[-*\w\xA0-\uFFFF]*\|(?!=)/,lookbehind:!0,inside:{punctuation:/\|$/}},attribute:{pattern:/^(\s*)[-\w\xA0-\uFFFF]+/,lookbehind:!0},value:[/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,{pattern:/(=\s*)[-\w\xA0-\uFFFF]+(?=\s*$)/,lookbehind:!0}],operator:/[|~*^$]?=/}},"n-th":[{pattern:/(\(\s*)[+-]?\d*[\dn](?:\s*[+-]\s*\d+)?(?=\s*\))/,lookbehind:!0,inside:{number:/[\dn]+/,operator:/[+-]/}},{pattern:/(\(\s*)(?:even|odd)(?=\s*\))/i,lookbehind:!0}],punctuation:/[()]/}},i.languages.insertBefore("css","property",{variable:{pattern:/(^|[^-\w\xA0-\uFFFF])--[-_a-z\xA0-\uFFFF][-\w\xA0-\uFFFF]*/i,lookbehind:!0}}),i.languages.insertBefore("css","function",{operator:{pattern:/(\s)[+\-*\/](?=\s)/,lookbehind:!0},hexcode:/#[\da-f]{3,8}/i,entity:/\\[\da-f]{1,8}/i,unit:{pattern:/(\d)(?:%|[a-z]+)/,lookbehind:!0},number:/-?[\d.]+/}),i.languages.javascript=i.languages.extend("clike",{"class-name":[i.languages.clike["class-name"],{pattern:/(^|[^$\w\xA0-\uFFFF])[_$A-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\.(?:prototype|constructor))/,lookbehind:!0}],keyword:[{pattern:/((?:^|})\s*)(?:catch|finally)\b/,lookbehind:!0},{pattern:/(^|[^.])\b(?:as|async(?=\s*(?:function\b|\(|[$\w\xA0-\uFFFF]|$))|await|break|case|class|const|continue|debugger|default|delete|do|else|enum|export|extends|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)\b/,lookbehind:!0}],number:/\b(?:(?:0[xX](?:[\dA-Fa-f](?:_[\dA-Fa-f])?)+|0[bB](?:[01](?:_[01])?)+|0[oO](?:[0-7](?:_[0-7])?)+)n?|(?:\d(?:_\d)?)+n|NaN|Infinity)\b|(?:\b(?:\d(?:_\d)?)+\.?(?:\d(?:_\d)?)*|\B\.(?:\d(?:_\d)?)+)(?:[Ee][+-]?(?:\d(?:_\d)?)+)?/,function:/#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*(?:\.\s*(?:apply|bind|call)\s*)?\()/,operator:/-[-=]?|\+[+=]?|!=?=?|<<?=?|>>?>?=?|=(?:==?|>)?|&[&=]?|\|[|=]?|\*\*?=?|\/=?|~|\^=?|%=?|\?|\.{3}/}),i.languages.javascript["class-name"][0].pattern=/(\b(?:class|interface|extends|implements|instanceof|new)\s+)[\w.\\]+/,i.languages.insertBefore("javascript","keyword",{regex:{pattern:/((?:^|[^$\w\xA0-\uFFFF."'\])\s])\s*)\/(\[(?:[^\]\\\r\n]|\\.)*]|\\.|[^/\\\[\r\n])+\/[gimyus]{0,6}(?=\s*($|[\r\n,.;})\]]))/,lookbehind:!0,greedy:!0},"function-variable":{pattern:/#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*[=:]\s*(?:async\s*)?(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)\s*=>))/,alias:"function"},parameter:[{pattern:/(function(?:\s+[_$A-Za-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)?\s*\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\))/,lookbehind:!0,inside:i.languages.javascript},{pattern:/[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*=>)/i,inside:i.languages.javascript},{pattern:/(\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\)\s*=>)/,lookbehind:!0,inside:i.languages.javascript},{pattern:/((?:\b|\s|^)(?!(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)(?![$\w\xA0-\uFFFF]))(?:[_$A-Za-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*\s*)\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\)\s*\{)/,lookbehind:!0,inside:i.languages.javascript}],constant:/\b[A-Z](?:[A-Z_]|\dx?)*\b/}),i.languages.insertBefore("javascript","string",{"template-string":{pattern:/`(?:\\[\s\S]|\${(?:[^{}]|{(?:[^{}]|{[^}]*})*})+}|(?!\${)[^\\`])*`/,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\${(?:[^{}]|{(?:[^{}]|{[^}]*})*})+}/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\${|}$/,alias:"punctuation"},rest:i.languages.javascript}},string:/[\s\S]+/}}}),i.languages.markup&&i.languages.markup.tag.addInlined("script","javascript"),i.languages.js=i.languages.javascript,function(e){var t=e.util.clone(e.languages.javascript);e.languages.jsx=e.languages.extend("markup",t),e.languages.jsx.tag.pattern=/<\/?(?:[\w.:-]+\s*(?:\s+(?:[\w.:-]+(?:=(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s{'">=]+|\{(?:\{(?:\{[^}]*\}|[^{}])*\}|[^{}])+\}))?|\{\.{3}[a-z_$][\w$]*(?:\.[a-z_$][\w$]*)*\}))*\s*\/?)?>/i,e.languages.jsx.tag.inside.tag.pattern=/^<\/?[^\s>\/]*/i,e.languages.jsx.tag.inside["attr-value"].pattern=/=(?!\{)(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s'">]+)/i,e.languages.jsx.tag.inside.tag.inside["class-name"]=/^[A-Z]\w*(?:\.[A-Z]\w*)*$/,e.languages.insertBefore("inside","attr-name",{spread:{pattern:/\{\.{3}[a-z_$][\w$]*(?:\.[a-z_$][\w$]*)*\}/,inside:{punctuation:/\.{3}|[{}.]/,"attr-value":/\w+/}}},e.languages.jsx.tag),e.languages.insertBefore("inside","attr-value",{script:{pattern:/=(\{(?:\{(?:\{[^}]*\}|[^}])*\}|[^}])+\})/i,inside:{"script-punctuation":{pattern:/^=(?={)/,alias:"punctuation"},rest:e.languages.jsx},alias:"language-javascript"}},e.languages.jsx.tag);var n=function(e){return e?"string"==typeof e?e:"string"==typeof e.content?e.content:e.content.map(n).join(""):""},r=function(t){for(var o=[],a=0;a<t.length;a++){var i=t[a],l=!1;if("string"!=typeof i&&("tag"===i.type&&i.content[0]&&"tag"===i.content[0].type?"</"===i.content[0].content[0].content?o.length>0&&o[o.length-1].tagName===n(i.content[0].content[1])&&o.pop():"/>"===i.content[i.content.length-1].content||o.push({tagName:n(i.content[0].content[1]),openedBraces:0}):o.length>0&&"punctuation"===i.type&&"{"===i.content?o[o.length-1].openedBraces++:o.length>0&&o[o.length-1].openedBraces>0&&"punctuation"===i.type&&"}"===i.content?o[o.length-1].openedBraces--:l=!0),(l||"string"==typeof i)&&o.length>0&&0===o[o.length-1].openedBraces){var u=n(i);a<t.length-1&&("string"==typeof t[a+1]||"plain-text"===t[a+1].type)&&(u+=n(t[a+1]),t.splice(a+1,1)),a>0&&("string"==typeof t[a-1]||"plain-text"===t[a-1].type)&&(u=n(t[a-1])+u,t.splice(a-1,1),a--),t[a]=new e.Token("plain-text",u,null,u)}i.content&&"string"!=typeof i.content&&r(i.content)}};e.hooks.add("after-tokenize",(function(e){"jsx"!==e.language&&"tsx"!==e.language||r(e.tokens)}))}(i),function(e){var t=e.languages.javadoclike={parameter:{pattern:/(^\s*(?:\/{3}|\*|\/\*\*)\s*@(?:param|arg|arguments)\s+)\w+/m,lookbehind:!0},keyword:{pattern:/(^\s*(?:\/{3}|\*|\/\*\*)\s*|\{)@[a-z][a-zA-Z-]+\b/m,lookbehind:!0},punctuation:/[{}]/};Object.defineProperty(t,"addSupport",{value:function(t,n){"string"==typeof t&&(t=[t]),t.forEach((function(t){!function(t,n){var r="doc-comment",o=e.languages[t];if(o){var a=o[r];if(!a){var i={"doc-comment":{pattern:/(^|[^\\])\/\*\*[^/][\s\S]*?(?:\*\/|$)/,alias:"comment"}};a=(o=e.languages.insertBefore(t,"comment",i))[r]}if(a instanceof RegExp&&(a=o[r]={pattern:a}),Array.isArray(a))for(var l=0,u=a.length;l<u;l++)a[l]instanceof RegExp&&(a[l]={pattern:a[l]}),n(a[l]);else n(a)}}(t,(function(e){e.inside||(e.inside={}),e.inside.rest=n}))}))}}),t.addSupport(["java","javascript","php"],t)}(i),function(e){var t=/\b(?:abstract|continue|for|new|switch|assert|default|goto|package|synchronized|boolean|do|if|private|this|break|double|implements|protected|throw|byte|else|import|public|throws|case|enum|instanceof|return|transient|catch|extends|int|short|try|char|final|interface|static|void|class|finally|long|strictfp|volatile|const|float|native|super|while|var|null|exports|module|open|opens|provides|requires|to|transitive|uses|with)\b/,n=/\b[A-Z](?:\w*[a-z]\w*)?\b/;e.languages.java=e.languages.extend("clike",{"class-name":[n,/\b[A-Z]\w*(?=\s+\w+\s*[;,=())])/],keyword:t,function:[e.languages.clike.function,{pattern:/(\:\:)[a-z_]\w*/,lookbehind:!0}],number:/\b0b[01][01_]*L?\b|\b0x[\da-f_]*\.?[\da-f_p+-]+\b|(?:\b\d[\d_]*\.?[\d_]*|\B\.\d[\d_]*)(?:e[+-]?\d[\d_]*)?[dfl]?/i,operator:{pattern:/(^|[^.])(?:<<=?|>>>?=?|->|([-+&|])\2|[?:~]|[-+*/%&|^!=<>]=?)/m,lookbehind:!0}}),e.languages.insertBefore("java","class-name",{annotation:{alias:"punctuation",pattern:/(^|[^.])@\w+/,lookbehind:!0},namespace:{pattern:/(\b(?:exports|import(?:\s+static)?|module|open|opens|package|provides|requires|to|transitive|uses|with)\s+)[a-z]\w*(\.[a-z]\w*)+/,lookbehind:!0,inside:{punctuation:/\./}},generics:{pattern:/<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<[\w\s,.&?]*>)*>)*>)*>/,inside:{"class-name":n,keyword:t,punctuation:/[<>(),.:]/,operator:/[?&|]/}}})}(i),function(e){function t(e,t){return"___"+e.toUpperCase()+t+"___"}Object.defineProperties(e.languages["markup-templating"]={},{buildPlaceholders:{value:function(n,r,o,a){if(n.language===r){var i=n.tokenStack=[];n.code=n.code.replace(o,(function(e){if("function"==typeof a&&!a(e))return e;for(var o,l=i.length;-1!==n.code.indexOf(o=t(r,l));)++l;return i[l]=e,o})),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language===r&&n.tokenStack){n.grammar=e.languages[r];var o=0,a=Object.keys(n.tokenStack);!function i(l){for(var u=0;u<l.length&&!(o>=a.length);u++){var s=l[u];if("string"==typeof s||s.content&&"string"==typeof s.content){var c=a[o],d=n.tokenStack[c],f="string"==typeof s?s:s.content,p=t(r,c),m=f.indexOf(p);if(m>-1){++o;var h=f.substring(0,m),g=new e.Token(r,e.tokenize(d,n.grammar),"language-"+r,d),v=f.substring(m+p.length),y=[];h&&y.push.apply(y,i([h])),y.push(g),v&&y.push.apply(y,i([v])),"string"==typeof s?l.splice.apply(l,[u,1].concat(y)):s.content=y}}else s.content&&i(s.content)}return l}(n.tokens)}}}})}(i),function(e){e.languages.php=e.languages.extend("clike",{keyword:/\b(?:__halt_compiler|abstract|and|array|as|break|callable|case|catch|class|clone|const|continue|declare|default|die|do|echo|else|elseif|empty|enddeclare|endfor|endforeach|endif|endswitch|endwhile|eval|exit|extends|final|finally|for|foreach|function|global|goto|if|implements|include|include_once|instanceof|insteadof|interface|isset|list|namespace|new|or|parent|print|private|protected|public|require|require_once|return|static|switch|throw|trait|try|unset|use|var|while|xor|yield)\b/i,boolean:{pattern:/\b(?:false|true)\b/i,alias:"constant"},constant:[/\b[A-Z_][A-Z0-9_]*\b/,/\b(?:null)\b/i],comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0}}),e.languages.insertBefore("php","string",{"shell-comment":{pattern:/(^|[^\\])#.*/,lookbehind:!0,alias:"comment"}}),e.languages.insertBefore("php","comment",{delimiter:{pattern:/\?>$|^<\?(?:php(?=\s)|=)?/i,alias:"important"}}),e.languages.insertBefore("php","keyword",{variable:/\$+(?:\w+\b|(?={))/i,package:{pattern:/(\\|namespace\s+|use\s+)[\w\\]+/,lookbehind:!0,inside:{punctuation:/\\/}}}),e.languages.insertBefore("php","operator",{property:{pattern:/(->)[\w]+/,lookbehind:!0}});var t={pattern:/{\$(?:{(?:{[^{}]+}|[^{}]+)}|[^{}])+}|(^|[^\\{])\$+(?:\w+(?:\[.+?]|->\w+)*)/,lookbehind:!0,inside:{rest:e.languages.php}};e.languages.insertBefore("php","string",{"nowdoc-string":{pattern:/<<<'([^']+)'(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;/,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<'[^']+'|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<'?|[';]$/}}}},"heredoc-string":{pattern:/<<<(?:"([^"]+)"(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;|([a-z_]\w*)(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\2;)/i,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<(?:"[^"]+"|[a-z_]\w*)|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<"?|[";]$/}},interpolation:t}},"single-quoted-string":{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0,alias:"string"},"double-quoted-string":{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,alias:"string",inside:{interpolation:t}}}),delete e.languages.php.string,e.hooks.add("before-tokenize",(function(t){if(/<\?/.test(t.code)){e.languages["markup-templating"].buildPlaceholders(t,"php",/<\?(?:[^"'/#]|\/(?![*/])|("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|(?:\/\/|#)(?:[^?\n\r]|\?(?!>))*|\/\*[\s\S]*?(?:\*\/|$))*?(?:\?>|$)/gi)}})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"php")}))}(i),function(e){var t=e.languages.javascript,n=/{(?:[^{}]|{(?:[^{}]|{[^{}]*})*})+}/.source,r="(@(?:param|arg|argument|property)\\s+(?:"+n+"\\s+)?)";e.languages.jsdoc=e.languages.extend("javadoclike",{parameter:{pattern:RegExp(r+/[$\w\xA0-\uFFFF.]+(?=\s|$)/.source),lookbehind:!0,inside:{punctuation:/\./}}}),e.languages.insertBefore("jsdoc","keyword",{"optional-parameter":{pattern:RegExp(r+/\[[$\w\xA0-\uFFFF.]+(?:=[^[\]]+)?\](?=\s|$)/.source),lookbehind:!0,inside:{parameter:{pattern:/(^\[)[$\w\xA0-\uFFFF\.]+/,lookbehind:!0,inside:{punctuation:/\./}},code:{pattern:/(=)[\s\S]*(?=\]$)/,lookbehind:!0,inside:t,alias:"language-javascript"},punctuation:/[=[\]]/}},"class-name":[{pattern:RegExp("(@[a-z]+\\s+)"+n),lookbehind:!0,inside:{punctuation:/[.,:?=<>|{}()[\]]/}},{pattern:/(@(?:augments|extends|class|interface|memberof!?|this)\s+)[A-Z]\w*(?:\.[A-Z]\w*)*/,lookbehind:!0,inside:{punctuation:/\./}}],example:{pattern:/(@example\s+)[^@]+?(?=\s*(?:\*\s*)?(?:@\w|\*\/))/,lookbehind:!0,inside:{code:{pattern:/^(\s*(?:\*\s*)?).+$/m,lookbehind:!0,inside:t,alias:"language-javascript"}}}}),e.languages.javadoclike.addSupport("javascript",e.languages.jsdoc)}(i),i.languages.actionscript=i.languages.extend("javascript",{keyword:/\b(?:as|break|case|catch|class|const|default|delete|do|else|extends|finally|for|function|if|implements|import|in|instanceof|interface|internal|is|native|new|null|package|private|protected|public|return|super|switch|this|throw|try|typeof|use|var|void|while|with|dynamic|each|final|get|include|namespace|native|override|set|static)\b/,operator:/\+\+|--|(?:[+\-*\/%^]|&&?|\|\|?|<<?|>>?>?|[!=]=?)=?|[~?@]/}),i.languages.actionscript["class-name"].alias="function",i.languages.markup&&i.languages.insertBefore("actionscript","string",{xml:{pattern:/(^|[^.])<\/?\w+(?:\s+[^\s>\/=]+=("|')(?:\\[\s\S]|(?!\2)[^\\])*\2)*\s*\/?>/,lookbehind:!0,inside:{rest:i.languages.markup}}}),function(e){var t=/#(?!\{).+/,n={pattern:/#\{[^}]+\}/,alias:"variable"};e.languages.coffeescript=e.languages.extend("javascript",{comment:t,string:[{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0},{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,inside:{interpolation:n}}],keyword:/\b(?:and|break|by|catch|class|continue|debugger|delete|do|each|else|extend|extends|false|finally|for|if|in|instanceof|is|isnt|let|loop|namespace|new|no|not|null|of|off|on|or|own|return|super|switch|then|this|throw|true|try|typeof|undefined|unless|until|when|while|window|with|yes|yield)\b/,"class-member":{pattern:/@(?!\d)\w+/,alias:"variable"}}),e.languages.insertBefore("coffeescript","comment",{"multiline-comment":{pattern:/###[\s\S]+?###/,alias:"comment"},"block-regex":{pattern:/\/{3}[\s\S]*?\/{3}/,alias:"regex",inside:{comment:t,interpolation:n}}}),e.languages.insertBefore("coffeescript","string",{"inline-javascript":{pattern:/`(?:\\[\s\S]|[^\\`])*`/,inside:{delimiter:{pattern:/^`|`$/,alias:"punctuation"},rest:e.languages.javascript}},"multiline-string":[{pattern:/'''[\s\S]*?'''/,greedy:!0,alias:"string"},{pattern:/"""[\s\S]*?"""/,greedy:!0,alias:"string",inside:{interpolation:n}}]}),e.languages.insertBefore("coffeescript","keyword",{property:/(?!\d)\w+(?=\s*:(?!:))/}),delete e.languages.coffeescript["template-string"],e.languages.coffee=e.languages.coffeescript}(i),function(e){e.languages.insertBefore("javascript","function-variable",{"method-variable":{pattern:RegExp("(\\.\\s*)"+e.languages.javascript["function-variable"].pattern.source),lookbehind:!0,alias:["function-variable","method","function","property-access"]}}),e.languages.insertBefore("javascript","function",{method:{pattern:RegExp("(\\.\\s*)"+e.languages.javascript.function.source),lookbehind:!0,alias:["function","property-access"]}}),e.languages.insertBefore("javascript","constant",{"known-class-name":[{pattern:/\b(?:(?:(?:Uint|Int)(?:8|16|32)|Uint8Clamped|Float(?:32|64))?Array|ArrayBuffer|BigInt|Boolean|DataView|Date|Error|Function|Intl|JSON|Math|Number|Object|Promise|Proxy|Reflect|RegExp|String|Symbol|(?:Weak)?(?:Set|Map)|WebAssembly)\b/,alias:"class-name"},{pattern:/\b(?:[A-Z]\w*)Error\b/,alias:"class-name"}]}),e.languages.javascript.keyword.unshift({pattern:/\b(?:as|default|export|from|import)\b/,alias:"module"},{pattern:/\bnull\b/,alias:["null","nil"]},{pattern:/\bundefined\b/,alias:"nil"}),e.languages.insertBefore("javascript","operator",{spread:{pattern:/\.{3}/,alias:"operator"},arrow:{pattern:/=>/,alias:"operator"}}),e.languages.insertBefore("javascript","punctuation",{"property-access":{pattern:/(\.\s*)#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*/,lookbehind:!0},"maybe-class-name":{pattern:/(^|[^$\w\xA0-\uFFFF])[A-Z][$\w\xA0-\uFFFF]+/,lookbehind:!0},dom:{pattern:/\b(?:document|location|navigator|performance|(?:local|session)Storage|window)\b/,alias:"variable"},console:{pattern:/\bconsole(?=\s*\.)/,alias:"class-name"}});for(var t=["function","function-variable","method","method-variable","property-access"],n=0;n<t.length;n++){var r=t[n],o=e.languages.javascript[r];"RegExp"===e.util.type(o)&&(o=e.languages.javascript[r]={pattern:o});var a=o.inside||{};o.inside=a,a["maybe-class-name"]=/^[A-Z][\s\S]*/}}(i),function(e){e.languages.flow=e.languages.extend("javascript",{}),e.languages.insertBefore("flow","keyword",{type:[{pattern:/\b(?:[Nn]umber|[Ss]tring|[Bb]oolean|Function|any|mixed|null|void)\b/,alias:"tag"}]}),e.languages.flow["function-variable"].pattern=/[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*=\s*(?:function\b|(?:\([^()]*\)(?:\s*:\s*\w+)?|[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)\s*=>))/i,delete e.languages.flow.parameter,e.languages.insertBefore("flow","operator",{"flow-punctuation":{pattern:/\{\||\|\}/,alias:"punctuation"}}),Array.isArray(e.languages.flow.keyword)||(e.languages.flow.keyword=[e.languages.flow.keyword]),e.languages.flow.keyword.unshift({pattern:/(^|[^$]\b)(?:type|opaque|declare|Class)\b(?!\$)/,lookbehind:!0},{pattern:/(^|[^$]\B)\$(?:await|Diff|Exact|Keys|ObjMap|PropertyType|Shape|Record|Supertype|Subtype|Enum)\b(?!\$)/,lookbehind:!0})}(i),i.languages.n4js=i.languages.extend("javascript",{keyword:/\b(?:any|Array|boolean|break|case|catch|class|const|constructor|continue|debugger|declare|default|delete|do|else|enum|export|extends|false|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|module|new|null|number|package|private|protected|public|return|set|static|string|super|switch|this|throw|true|try|typeof|var|void|while|with|yield)\b/}),i.languages.insertBefore("n4js","constant",{annotation:{pattern:/@+\w+/,alias:"operator"}}),i.languages.n4jsd=i.languages.n4js,i.languages.typescript=i.languages.extend("javascript",{keyword:/\b(?:abstract|as|async|await|break|case|catch|class|const|constructor|continue|debugger|declare|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|is|keyof|let|module|namespace|new|null|of|package|private|protected|public|readonly|return|require|set|static|super|switch|this|throw|try|type|typeof|var|void|while|with|yield)\b/,builtin:/\b(?:string|Function|any|number|boolean|Array|symbol|console|Promise|unknown|never)\b/}),i.languages.ts=i.languages.typescript,function(e){var t=e.languages.javascript["template-string"],n=t.pattern.source,r=t.inside.interpolation,o=r.inside["interpolation-punctuation"],a=r.pattern.source;function i(t,r){if(e.languages[t])return{pattern:RegExp("((?:"+r+")\\s*)"+n),lookbehind:!0,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},"embedded-code":{pattern:/[\s\S]+/,alias:t}}}}function l(e,t){return"___"+t.toUpperCase()+"_"+e+"___"}function u(t,n,r){var o={code:t,grammar:n,language:r};return e.hooks.run("before-tokenize",o),o.tokens=e.tokenize(o.code,o.grammar),e.hooks.run("after-tokenize",o),o.tokens}function s(t){var n={};n["interpolation-punctuation"]=o;var a=e.tokenize(t,n);if(3===a.length){var i=[1,1];i.push.apply(i,u(a[1],e.languages.javascript,"javascript")),a.splice.apply(a,i)}return new e.Token("interpolation",a,r.alias,t)}function c(t,n,r){var o=e.tokenize(t,{interpolation:{pattern:RegExp(a),lookbehind:!0}}),i=0,c={},d=u(o.map((function(e){if("string"==typeof e)return e;for(var n,o=e.content;-1!==t.indexOf(n=l(i++,r)););return c[n]=o,n})).join(""),n,r),f=Object.keys(c);return i=0,function e(t){for(var n=0;n<t.length;n++){if(i>=f.length)return;var r=t[n];if("string"==typeof r||"string"==typeof r.content){var o=f[i],a="string"==typeof r?r:r.content,l=a.indexOf(o);if(-1!==l){++i;var u=a.substring(0,l),d=s(c[o]),p=a.substring(l+o.length),m=[];if(u&&m.push(u),m.push(d),p){var h=[p];e(h),m.push.apply(m,h)}"string"==typeof r?(t.splice.apply(t,[n,1].concat(m)),n+=m.length-1):r.content=m}}else{var g=r.content;Array.isArray(g)?e(g):e([g])}}}(d),new e.Token(r,d,"language-"+r,t)}e.languages.javascript["template-string"]=[i("css",/\b(?:styled(?:\([^)]*\))?(?:\s*\.\s*\w+(?:\([^)]*\))*)*|css(?:\s*\.\s*(?:global|resolve))?|createGlobalStyle|keyframes)/.source),i("html",/\bhtml|\.\s*(?:inner|outer)HTML\s*\+?=/.source),i("svg",/\bsvg/.source),i("markdown",/\b(?:md|markdown)/.source),i("graphql",/\b(?:gql|graphql(?:\s*\.\s*experimental)?)/.source),t].filter(Boolean);var d={javascript:!0,js:!0,typescript:!0,ts:!0,jsx:!0,tsx:!0};function f(e){return"string"==typeof e?e:Array.isArray(e)?e.map(f).join(""):f(e.content)}e.hooks.add("after-tokenize",(function(t){t.language in d&&function t(n){for(var r=0,o=n.length;r<o;r++){var a=n[r];if("string"!=typeof a){var i=a.content;if(Array.isArray(i))if("template-string"===a.type){var l=i[1];if(3===i.length&&"string"!=typeof l&&"embedded-code"===l.type){var u=f(l),s=l.alias,d=Array.isArray(s)?s[0]:s,p=e.languages[d];if(!p)continue;i[1]=c(u,p,d)}}else t(i);else"string"!=typeof i&&t([i])}}}(t.tokens)}))}(i),i.languages.graphql={comment:/#.*/,string:{pattern:/"(?:\\.|[^\\"\r\n])*"/,greedy:!0},number:/(?:\B-|\b)\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,boolean:/\b(?:true|false)\b/,variable:/\$[a-z_]\w*/i,directive:{pattern:/@[a-z_]\w*/i,alias:"function"},"attr-name":{pattern:/[a-z_]\w*(?=\s*(?:\((?:[^()"]|"(?:\\.|[^\\"\r\n])*")*\))?:)/i,greedy:!0},"class-name":{pattern:/(\b(?:enum|implements|interface|on|scalar|type|union)\s+)[a-zA-Z_]\w*/,lookbehind:!0},fragment:{pattern:/(\bfragment\s+|\.{3}\s*(?!on\b))[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},keyword:/\b(?:enum|fragment|implements|input|interface|mutation|on|query|scalar|schema|type|union)\b/,operator:/[!=|]|\.{3}/,punctuation:/[!(){}\[\]:=,]/,constant:/\b(?!ID\b)[A-Z][A-Z_\d]*\b/},function(e){var t=/(?:\\.|[^\\\n\r]|(?:\r?\n|\r)(?!\r?\n|\r))/.source;function n(e,n){return e=e.replace(/<inner>/g,t),n&&(e=e+"|"+e.replace(/_/g,"\\*")),RegExp(/((?:^|[^\\])(?:\\{2})*)/.source+"(?:"+e+")")}var r=/(?:\\.|``.+?``|`[^`\r\n]+`|[^\\|\r\n`])+/.source,o=/\|?__(?:\|__)+\|?(?:(?:\r?\n|\r)|$)/.source.replace(/__/g,r),a=/\|?[ \t]*:?-{3,}:?[ \t]*(?:\|[ \t]*:?-{3,}:?[ \t]*)+\|?(?:\r?\n|\r)/.source;e.languages.markdown=e.languages.extend("markup",{}),e.languages.insertBefore("markdown","prolog",{blockquote:{pattern:/^>(?:[\t ]*>)*/m,alias:"punctuation"},table:{pattern:RegExp("^"+o+a+"(?:"+o+")*","m"),inside:{"table-data-rows":{pattern:RegExp("^("+o+a+")(?:"+o+")*$"),lookbehind:!0,inside:{"table-data":{pattern:RegExp(r),inside:e.languages.markdown},punctuation:/\|/}},"table-line":{pattern:RegExp("^("+o+")"+a+"$"),lookbehind:!0,inside:{punctuation:/\||:?-{3,}:?/}},"table-header-row":{pattern:RegExp("^"+o+"$"),inside:{"table-header":{pattern:RegExp(r),alias:"important",inside:e.languages.markdown},punctuation:/\|/}}}},code:[{pattern:/(^[ \t]*(?:\r?\n|\r))(?: {4}|\t).+(?:(?:\r?\n|\r)(?: {4}|\t).+)*/m,lookbehind:!0,alias:"keyword"},{pattern:/``.+?``|`[^`\r\n]+`/,alias:"keyword"},{pattern:/^```[\s\S]*?^```$/m,greedy:!0,inside:{"code-block":{pattern:/^(```.*(?:\r?\n|\r))[\s\S]+?(?=(?:\r?\n|\r)^```$)/m,lookbehind:!0},"code-language":{pattern:/^(```).+/,lookbehind:!0},punctuation:/```/}}],title:[{pattern:/\S.*(?:\r?\n|\r)(?:==+|--+)(?=[ \t]*$)/m,alias:"important",inside:{punctuation:/==+$|--+$/}},{pattern:/(^\s*)#+.+/m,lookbehind:!0,alias:"important",inside:{punctuation:/^#+|#+$/}}],hr:{pattern:/(^\s*)([*-])(?:[\t ]*\2){2,}(?=\s*$)/m,lookbehind:!0,alias:"punctuation"},list:{pattern:/(^\s*)(?:[*+-]|\d+\.)(?=[\t ].)/m,lookbehind:!0,alias:"punctuation"},"url-reference":{pattern:/!?\[[^\]]+\]:[\t ]+(?:\S+|<(?:\\.|[^>\\])+>)(?:[\t ]+(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\)))?/,inside:{variable:{pattern:/^(!?\[)[^\]]+/,lookbehind:!0},string:/(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\))$/,punctuation:/^[\[\]!:]|[<>]/},alias:"url"},bold:{pattern:n(/__(?:(?!_)<inner>|_(?:(?!_)<inner>)+_)+__/.source,!0),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^..)[\s\S]+(?=..$)/,lookbehind:!0,inside:{}},punctuation:/\*\*|__/}},italic:{pattern:n(/_(?:(?!_)<inner>|__(?:(?!_)<inner>)+__)+_/.source,!0),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^.)[\s\S]+(?=.$)/,lookbehind:!0,inside:{}},punctuation:/[*_]/}},strike:{pattern:n(/(~~?)(?:(?!~)<inner>)+?\2/.source,!1),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^~~?)[\s\S]+(?=\1$)/,lookbehind:!0,inside:{}},punctuation:/~~?/}},url:{pattern:n(/!?\[(?:(?!\])<inner>)+\](?:\([^\s)]+(?:[\t ]+"(?:\\.|[^"\\])*")?\)| ?\[(?:(?!\])<inner>)+\])/.source,!1),lookbehind:!0,greedy:!0,inside:{variable:{pattern:/(\[)[^\]]+(?=\]$)/,lookbehind:!0},content:{pattern:/(^!?\[)[^\]]+(?=\])/,lookbehind:!0,inside:{}},string:{pattern:/"(?:\\.|[^"\\])*"(?=\)$)/}}}}),["url","bold","italic","strike"].forEach((function(t){["url","bold","italic","strike"].forEach((function(n){t!==n&&(e.languages.markdown[t].inside.content.inside[n]=e.languages.markdown[n])}))})),e.hooks.add("after-tokenize",(function(e){"markdown"!==e.language&&"md"!==e.language||function e(t){if(t&&"string"!=typeof t)for(var n=0,r=t.length;n<r;n++){var o=t[n];if("code"===o.type){var a=o.content[1],i=o.content[3];if(a&&i&&"code-language"===a.type&&"code-block"===i.type&&"string"==typeof a.content){var l="language-"+a.content.trim().split(/\s+/)[0].toLowerCase();i.alias?"string"==typeof i.alias?i.alias=[i.alias,l]:i.alias.push(l):i.alias=[l]}}else e(o.content)}}(e.tokens)})),e.hooks.add("wrap",(function(t){if("code-block"===t.type){for(var n="",r=0,o=t.classes.length;r<o;r++){var a=t.classes[r],i=/language-(.+)/.exec(a);if(i){n=i[1];break}}var l=e.languages[n];if(l){var u=t.content.replace(/&lt;/g,"<").replace(/&amp;/g,"&");t.content=e.highlight(u,l,n)}else if(n&&"none"!==n&&e.plugins.autoloader){var s="md-"+(new Date).valueOf()+"-"+Math.floor(1e16*Math.random());t.attributes.id=s,e.plugins.autoloader.loadLanguages(n,(function(){var t=document.getElementById(s);t&&(t.innerHTML=e.highlight(t.textContent,e.languages[n],n))}))}}})),e.languages.md=e.languages.markdown}(i),function(e){e.languages.diff={coord:[/^(?:\*{3}|-{3}|\+{3}).*$/m,/^@@.*@@$/m,/^\d+.*$/m]};var t={"deleted-sign":"-","deleted-arrow":"<","inserted-sign":"+","inserted-arrow":">",unchanged:" ",diff:"!"};Object.keys(t).forEach((function(n){var r=t[n],o=[];/^\w+$/.test(n)||o.push(/\w+/.exec(n)[0]),"diff"===n&&o.push("bold"),e.languages.diff[n]={pattern:RegExp("^(?:["+r+"].*(?:\r\n?|\n|(?![\\s\\S])))+","m"),alias:o}})),Object.defineProperty(e.languages.diff,"PREFIXES",{value:t})}(i),i.languages.git={comment:/^#.*/m,deleted:/^[-\u2013].*/m,inserted:/^\+.*/m,string:/("|')(?:\\.|(?!\1)[^\\\r\n])*\1/m,command:{pattern:/^.*\$ git .*$/m,inside:{parameter:/\s--?\w+/m}},coord:/^@@.*@@$/m,commit_sha1:/^commit \w{40}$/m},i.languages.go=i.languages.extend("clike",{keyword:/\b(?:break|case|chan|const|continue|default|defer|else|fallthrough|for|func|go(?:to)?|if|import|interface|map|package|range|return|select|struct|switch|type|var)\b/,builtin:/\b(?:bool|byte|complex(?:64|128)|error|float(?:32|64)|rune|string|u?int(?:8|16|32|64)?|uintptr|append|cap|close|complex|copy|delete|imag|len|make|new|panic|print(?:ln)?|real|recover)\b/,boolean:/\b(?:_|iota|nil|true|false)\b/,operator:/[*\/%^!=]=?|\+[=+]?|-[=-]?|\|[=|]?|&(?:=|&|\^=?)?|>(?:>=?|=)?|<(?:<=?|=|-)?|:=|\.\.\./,number:/(?:\b0x[a-f\d]+|(?:\b\d+\.?\d*|\B\.\d+)(?:e[-+]?\d+)?)i?/i,string:{pattern:/(["'`])(\\[\s\S]|(?!\1)[^\\])*\1/,greedy:!0}}),delete i.languages.go["class-name"],function(e){e.languages.handlebars={comment:/\{\{![\s\S]*?\}\}/,delimiter:{pattern:/^\{\{\{?|\}\}\}?$/i,alias:"punctuation"},string:/(["'])(?:\\.|(?!\1)[^\\\r\n])*\1/,number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:[Ee][+-]?\d+)?/,boolean:/\b(?:true|false)\b/,block:{pattern:/^(\s*~?\s*)[#\/]\S+?(?=\s*~?\s*$|\s)/i,lookbehind:!0,alias:"keyword"},brackets:{pattern:/\[[^\]]+\]/,inside:{punctuation:/\[|\]/,variable:/[\s\S]+/}},punctuation:/[!"#%&'()*+,.\/;<=>@\[\\\]^`{|}~]/,variable:/[^!"#%&'()*+,.\/;<=>@\[\\\]^`{|}~\s]+/},e.hooks.add("before-tokenize",(function(t){e.languages["markup-templating"].buildPlaceholders(t,"handlebars",/\{\{\{[\s\S]+?\}\}\}|\{\{[\s\S]+?\}\}/g)})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"handlebars")}))}(i),i.languages.json={property:{pattern:/"(?:\\.|[^\\"\r\n])*"(?=\s*:)/,greedy:!0},string:{pattern:/"(?:\\.|[^\\"\r\n])*"(?!\s*:)/,greedy:!0},comment:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,number:/-?\d+\.?\d*(e[+-]?\d+)?/i,punctuation:/[{}[\],]/,operator:/:/,boolean:/\b(?:true|false)\b/,null:{pattern:/\bnull\b/,alias:"keyword"}},i.languages.less=i.languages.extend("css",{comment:[/\/\*[\s\S]*?\*\//,{pattern:/(^|[^\\])\/\/.*/,lookbehind:!0}],atrule:{pattern:/@[\w-]+?(?:\([^{}]+\)|[^(){};])*?(?=\s*\{)/i,inside:{punctuation:/[:()]/}},selector:{pattern:/(?:@\{[\w-]+\}|[^{};\s@])(?:@\{[\w-]+\}|\([^{}]*\)|[^{};@])*?(?=\s*\{)/,inside:{variable:/@+[\w-]+/}},property:/(?:@\{[\w-]+\}|[\w-])+(?:\+_?)?(?=\s*:)/i,operator:/[+\-*\/]/}),i.languages.insertBefore("less","property",{variable:[{pattern:/@[\w-]+\s*:/,inside:{punctuation:/:/}},/@@?[\w-]+/],"mixin-usage":{pattern:/([{;]\s*)[.#](?!\d)[\w-]+.*?(?=[(;])/,lookbehind:!0,alias:"function"}}),i.languages.makefile={comment:{pattern:/(^|[^\\])#(?:\\(?:\r\n|[\s\S])|[^\\\r\n])*/,lookbehind:!0},string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},builtin:/\.[A-Z][^:#=\s]+(?=\s*:(?!=))/,symbol:{pattern:/^[^:=\r\n]+(?=\s*:(?!=))/m,inside:{variable:/\$+(?:[^(){}:#=\s]+|(?=[({]))/}},variable:/\$+(?:[^(){}:#=\s]+|\([@*%<^+?][DF]\)|(?=[({]))/,keyword:[/-include\b|\b(?:define|else|endef|endif|export|ifn?def|ifn?eq|include|override|private|sinclude|undefine|unexport|vpath)\b/,{pattern:/(\()(?:addsuffix|abspath|and|basename|call|dir|error|eval|file|filter(?:-out)?|findstring|firstword|flavor|foreach|guile|if|info|join|lastword|load|notdir|or|origin|patsubst|realpath|shell|sort|strip|subst|suffix|value|warning|wildcard|word(?:s|list)?)(?=[ \t])/,lookbehind:!0}],operator:/(?:::|[?:+!])?=|[|@]/,punctuation:/[:;(){}]/},i.languages.objectivec=i.languages.extend("c",{keyword:/\b(?:asm|typeof|inline|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|union|unsigned|void|volatile|while|in|self|super)\b|(?:@interface|@end|@implementation|@protocol|@class|@public|@protected|@private|@property|@try|@catch|@finally|@throw|@synthesize|@dynamic|@selector)\b/,string:/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1|@"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,operator:/-[->]?|\+\+?|!=?|<<?=?|>>?=?|==?|&&?|\|\|?|[~^%?*\/@]/}),delete i.languages.objectivec["class-name"],i.languages.ocaml={comment:/\(\*[\s\S]*?\*\)/,string:[{pattern:/"(?:\\.|[^\\\r\n"])*"/,greedy:!0},{pattern:/(['`])(?:\\(?:\d+|x[\da-f]+|.)|(?!\1)[^\\\r\n])\1/i,greedy:!0}],number:/\b(?:0x[\da-f][\da-f_]+|(?:0[bo])?\d[\d_]*\.?[\d_]*(?:e[+-]?[\d_]+)?)/i,type:{pattern:/\B['`]\w*/,alias:"variable"},directive:{pattern:/\B#\w+/,alias:"function"},keyword:/\b(?:as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|match|method|module|mutable|new|object|of|open|prefix|private|rec|then|sig|struct|to|try|type|val|value|virtual|where|while|with)\b/,boolean:/\b(?:false|true)\b/,operator:/:=|[=<>@^|&+\-*\/$%!?~][!$%&*+\-.\/:<=>?@^|~]*|\b(?:and|asr|land|lor|lxor|lsl|lsr|mod|nor|or)\b/,punctuation:/[(){}\[\]|_.,:;]/},i.languages.python={comment:{pattern:/(^|[^\\])#.*/,lookbehind:!0},"string-interpolation":{pattern:/(?:f|rf|fr)(?:("""|''')[\s\S]+?\1|("|')(?:\\.|(?!\2)[^\\\r\n])*\2)/i,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^{])(?:{{)*){(?!{)(?:[^{}]|{(?!{)(?:[^{}]|{(?!{)(?:[^{}])+})+})+}/,lookbehind:!0,inside:{"format-spec":{pattern:/(:)[^:(){}]+(?=}$)/,lookbehind:!0},"conversion-option":{pattern:/![sra](?=[:}]$)/,alias:"punctuation"},rest:null}},string:/[\s\S]+/}},"triple-quoted-string":{pattern:/(?:[rub]|rb|br)?("""|''')[\s\S]+?\1/i,greedy:!0,alias:"string"},string:{pattern:/(?:[rub]|rb|br)?("|')(?:\\.|(?!\1)[^\\\r\n])*\1/i,greedy:!0},function:{pattern:/((?:^|\s)def[ \t]+)[a-zA-Z_]\w*(?=\s*\()/g,lookbehind:!0},"class-name":{pattern:/(\bclass\s+)\w+/i,lookbehind:!0},decorator:{pattern:/(^\s*)@\w+(?:\.\w+)*/i,lookbehind:!0,alias:["annotation","punctuation"],inside:{punctuation:/\./}},keyword:/\b(?:and|as|assert|async|await|break|class|continue|def|del|elif|else|except|exec|finally|for|from|global|if|import|in|is|lambda|nonlocal|not|or|pass|print|raise|return|try|while|with|yield)\b/,builtin:/\b(?:__import__|abs|all|any|apply|ascii|basestring|bin|bool|buffer|bytearray|bytes|callable|chr|classmethod|cmp|coerce|compile|complex|delattr|dict|dir|divmod|enumerate|eval|execfile|file|filter|float|format|frozenset|getattr|globals|hasattr|hash|help|hex|id|input|int|intern|isinstance|issubclass|iter|len|list|locals|long|map|max|memoryview|min|next|object|oct|open|ord|pow|property|range|raw_input|reduce|reload|repr|reversed|round|set|setattr|slice|sorted|staticmethod|str|sum|super|tuple|type|unichr|unicode|vars|xrange|zip)\b/,boolean:/\b(?:True|False|None)\b/,number:/(?:\b(?=\d)|\B(?=\.))(?:0[bo])?(?:(?:\d|0x[\da-f])[\da-f]*\.?\d*|\.\d+)(?:e[+-]?\d+)?j?\b/i,operator:/[-+%=]=?|!=|\*\*?=?|\/\/?=?|<[<=>]?|>[=>]?|[&|^~]/,punctuation:/[{}[\];(),.:]/},i.languages.python["string-interpolation"].inside.interpolation.inside.rest=i.languages.python,i.languages.py=i.languages.python,i.languages.reason=i.languages.extend("clike",{comment:{pattern:/(^|[^\\])\/\*[\s\S]*?\*\//,lookbehind:!0},string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^\\\r\n"])*"/,greedy:!0},"class-name":/\b[A-Z]\w*/,keyword:/\b(?:and|as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|method|module|mutable|new|nonrec|object|of|open|or|private|rec|sig|struct|switch|then|to|try|type|val|virtual|when|while|with)\b/,operator:/\.{3}|:[:=]|\|>|->|=(?:==?|>)?|<=?|>=?|[|^?'#!~`]|[+\-*\/]\.?|\b(?:mod|land|lor|lxor|lsl|lsr|asr)\b/}),i.languages.insertBefore("reason","class-name",{character:{pattern:/'(?:\\x[\da-f]{2}|\\o[0-3][0-7][0-7]|\\\d{3}|\\.|[^'\\\r\n])'/,alias:"string"},constructor:{pattern:/\b[A-Z]\w*\b(?!\s*\.)/,alias:"variable"},label:{pattern:/\b[a-z]\w*(?=::)/,alias:"symbol"}}),delete i.languages.reason.function,function(e){e.languages.sass=e.languages.extend("css",{comment:{pattern:/^([ \t]*)\/[\/*].*(?:(?:\r?\n|\r)\1[ \t]+.+)*/m,lookbehind:!0}}),e.languages.insertBefore("sass","atrule",{"atrule-line":{pattern:/^(?:[ \t]*)[@+=].+/m,inside:{atrule:/(?:@[\w-]+|[+=])/m}}}),delete e.languages.sass.atrule;var t=/\$[-\w]+|#\{\$[-\w]+\}/,n=[/[+*\/%]|[=!]=|<=?|>=?|\b(?:and|or|not)\b/,{pattern:/(\s+)-(?=\s)/,lookbehind:!0}];e.languages.insertBefore("sass","property",{"variable-line":{pattern:/^[ \t]*\$.+/m,inside:{punctuation:/:/,variable:t,operator:n}},"property-line":{pattern:/^[ \t]*(?:[^:\s]+ *:.*|:[^:\s]+.*)/m,inside:{property:[/[^:\s]+(?=\s*:)/,{pattern:/(:)[^:\s]+/,lookbehind:!0}],punctuation:/:/,variable:t,operator:n,important:e.languages.sass.important}}}),delete e.languages.sass.property,delete e.languages.sass.important,e.languages.insertBefore("sass","punctuation",{selector:{pattern:/([ \t]*)\S(?:,?[^,\r\n]+)*(?:,(?:\r?\n|\r)\1[ \t]+\S(?:,?[^,\r\n]+)*)*/,lookbehind:!0}})}(i),i.languages.scss=i.languages.extend("css",{comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},atrule:{pattern:/@[\w-]+(?:\([^()]+\)|[^(])*?(?=\s+[{;])/,inside:{rule:/@[\w-]+/}},url:/(?:[-a-z]+-)?url(?=\()/i,selector:{pattern:/(?=\S)[^@;{}()]?(?:[^@;{}()]|#\{\$[-\w]+\})+(?=\s*\{(?:\}|\s|[^}]+[:{][^}]+))/m,inside:{parent:{pattern:/&/,alias:"important"},placeholder:/%[-\w]+/,variable:/\$[-\w]+|#\{\$[-\w]+\}/}},property:{pattern:/(?:[\w-]|\$[-\w]+|#\{\$[-\w]+\})+(?=\s*:)/,inside:{variable:/\$[-\w]+|#\{\$[-\w]+\}/}}}),i.languages.insertBefore("scss","atrule",{keyword:[/@(?:if|else(?: if)?|for|each|while|import|extend|debug|warn|mixin|include|function|return|content)/i,{pattern:/( +)(?:from|through)(?= )/,lookbehind:!0}]}),i.languages.insertBefore("scss","important",{variable:/\$[-\w]+|#\{\$[-\w]+\}/}),i.languages.insertBefore("scss","function",{placeholder:{pattern:/%[-\w]+/,alias:"selector"},statement:{pattern:/\B!(?:default|optional)\b/i,alias:"keyword"},boolean:/\b(?:true|false)\b/,null:{pattern:/\bnull\b/,alias:"keyword"},operator:{pattern:/(\s)(?:[-+*\/%]|[=!]=|<=?|>=?|and|or|not)(?=\s)/,lookbehind:!0}}),i.languages.scss.atrule.inside.rest=i.languages.scss,i.languages.sql={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/|#).*)/,lookbehind:!0},variable:[{pattern:/@(["'`])(?:\\[\s\S]|(?!\1)[^\\])+\1/,greedy:!0},/@[\w.$]+/],string:{pattern:/(^|[^@\\])("|')(?:\\[\s\S]|(?!\2)[^\\]|\2\2)*\2/,greedy:!0,lookbehind:!0},function:/\b(?:AVG|COUNT|FIRST|FORMAT|LAST|LCASE|LEN|MAX|MID|MIN|MOD|NOW|ROUND|SUM|UCASE)(?=\s*\()/i,keyword:/\b(?:ACTION|ADD|AFTER|ALGORITHM|ALL|ALTER|ANALYZE|ANY|APPLY|AS|ASC|AUTHORIZATION|AUTO_INCREMENT|BACKUP|BDB|BEGIN|BERKELEYDB|BIGINT|BINARY|BIT|BLOB|BOOL|BOOLEAN|BREAK|BROWSE|BTREE|BULK|BY|CALL|CASCADED?|CASE|CHAIN|CHAR(?:ACTER|SET)?|CHECK(?:POINT)?|CLOSE|CLUSTERED|COALESCE|COLLATE|COLUMNS?|COMMENT|COMMIT(?:TED)?|COMPUTE|CONNECT|CONSISTENT|CONSTRAINT|CONTAINS(?:TABLE)?|CONTINUE|CONVERT|CREATE|CROSS|CURRENT(?:_DATE|_TIME|_TIMESTAMP|_USER)?|CURSOR|CYCLE|DATA(?:BASES?)?|DATE(?:TIME)?|DAY|DBCC|DEALLOCATE|DEC|DECIMAL|DECLARE|DEFAULT|DEFINER|DELAYED|DELETE|DELIMITERS?|DENY|DESC|DESCRIBE|DETERMINISTIC|DISABLE|DISCARD|DISK|DISTINCT|DISTINCTROW|DISTRIBUTED|DO|DOUBLE|DROP|DUMMY|DUMP(?:FILE)?|DUPLICATE|ELSE(?:IF)?|ENABLE|ENCLOSED|END|ENGINE|ENUM|ERRLVL|ERRORS|ESCAPED?|EXCEPT|EXEC(?:UTE)?|EXISTS|EXIT|EXPLAIN|EXTENDED|FETCH|FIELDS|FILE|FILLFACTOR|FIRST|FIXED|FLOAT|FOLLOWING|FOR(?: EACH ROW)?|FORCE|FOREIGN|FREETEXT(?:TABLE)?|FROM|FULL|FUNCTION|GEOMETRY(?:COLLECTION)?|GLOBAL|GOTO|GRANT|GROUP|HANDLER|HASH|HAVING|HOLDLOCK|HOUR|IDENTITY(?:_INSERT|COL)?|IF|IGNORE|IMPORT|INDEX|INFILE|INNER|INNODB|INOUT|INSERT|INT|INTEGER|INTERSECT|INTERVAL|INTO|INVOKER|ISOLATION|ITERATE|JOIN|KEYS?|KILL|LANGUAGE|LAST|LEAVE|LEFT|LEVEL|LIMIT|LINENO|LINES|LINESTRING|LOAD|LOCAL|LOCK|LONG(?:BLOB|TEXT)|LOOP|MATCH(?:ED)?|MEDIUM(?:BLOB|INT|TEXT)|MERGE|MIDDLEINT|MINUTE|MODE|MODIFIES|MODIFY|MONTH|MULTI(?:LINESTRING|POINT|POLYGON)|NATIONAL|NATURAL|NCHAR|NEXT|NO|NONCLUSTERED|NULLIF|NUMERIC|OFF?|OFFSETS?|ON|OPEN(?:DATASOURCE|QUERY|ROWSET)?|OPTIMIZE|OPTION(?:ALLY)?|ORDER|OUT(?:ER|FILE)?|OVER|PARTIAL|PARTITION|PERCENT|PIVOT|PLAN|POINT|POLYGON|PRECEDING|PRECISION|PREPARE|PREV|PRIMARY|PRINT|PRIVILEGES|PROC(?:EDURE)?|PUBLIC|PURGE|QUICK|RAISERROR|READS?|REAL|RECONFIGURE|REFERENCES|RELEASE|RENAME|REPEAT(?:ABLE)?|REPLACE|REPLICATION|REQUIRE|RESIGNAL|RESTORE|RESTRICT|RETURNS?|REVOKE|RIGHT|ROLLBACK|ROUTINE|ROW(?:COUNT|GUIDCOL|S)?|RTREE|RULE|SAVE(?:POINT)?|SCHEMA|SECOND|SELECT|SERIAL(?:IZABLE)?|SESSION(?:_USER)?|SET(?:USER)?|SHARE|SHOW|SHUTDOWN|SIMPLE|SMALLINT|SNAPSHOT|SOME|SONAME|SQL|START(?:ING)?|STATISTICS|STATUS|STRIPED|SYSTEM_USER|TABLES?|TABLESPACE|TEMP(?:ORARY|TABLE)?|TERMINATED|TEXT(?:SIZE)?|THEN|TIME(?:STAMP)?|TINY(?:BLOB|INT|TEXT)|TOP?|TRAN(?:SACTIONS?)?|TRIGGER|TRUNCATE|TSEQUAL|TYPES?|UNBOUNDED|UNCOMMITTED|UNDEFINED|UNION|UNIQUE|UNLOCK|UNPIVOT|UNSIGNED|UPDATE(?:TEXT)?|USAGE|USE|USER|USING|VALUES?|VAR(?:BINARY|CHAR|CHARACTER|YING)|VIEW|WAITFOR|WARNINGS|WHEN|WHERE|WHILE|WITH(?: ROLLUP|IN)?|WORK|WRITE(?:TEXT)?|YEAR)\b/i,boolean:/\b(?:TRUE|FALSE|NULL)\b/i,number:/\b0x[\da-f]+\b|\b\d+\.?\d*|\B\.\d+\b/i,operator:/[-+*\/=%^~]|&&?|\|\|?|!=?|<(?:=>?|<|>)?|>[>=]?|\b(?:AND|BETWEEN|IN|LIKE|NOT|OR|IS|DIV|REGEXP|RLIKE|SOUNDS LIKE|XOR)\b/i,punctuation:/[;[\]()`,.]/},function(e){var t={url:/url\((["']?).*?\1\)/i,string:{pattern:/("|')(?:(?!\1)[^\\\r\n]|\\(?:\r\n|[\s\S]))*\1/,greedy:!0},interpolation:null,func:null,important:/\B!(?:important|optional)\b/i,keyword:{pattern:/(^|\s+)(?:(?:if|else|for|return|unless)(?=\s+|$)|@[\w-]+)/,lookbehind:!0},hexcode:/#[\da-f]{3,6}/i,number:/\b\d+(?:\.\d+)?%?/,boolean:/\b(?:true|false)\b/,operator:[/~|[+!\/%<>?=]=?|[-:]=|\*[*=]?|\.+|&&|\|\||\B-\B|\b(?:and|in|is(?: a| defined| not|nt)?|not|or)\b/],punctuation:/[{}()\[\];:,]/};t.interpolation={pattern:/\{[^\r\n}:]+\}/,alias:"variable",inside:{delimiter:{pattern:/^{|}$/,alias:"punctuation"},rest:t}},t.func={pattern:/[\w-]+\([^)]*\).*/,inside:{function:/^[^(]+/,rest:t}},e.languages.stylus={comment:{pattern:/(^|[^\\])(\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},"atrule-declaration":{pattern:/(^\s*)@.+/m,lookbehind:!0,inside:{atrule:/^@[\w-]+/,rest:t}},"variable-declaration":{pattern:/(^[ \t]*)[\w$-]+\s*.?=[ \t]*(?:(?:\{[^}]*\}|.+)|$)/m,lookbehind:!0,inside:{variable:/^\S+/,rest:t}},statement:{pattern:/(^[ \t]*)(?:if|else|for|return|unless)[ \t]+.+/m,lookbehind:!0,inside:{keyword:/^\S+/,rest:t}},"property-declaration":{pattern:/((?:^|\{)([ \t]*))(?:[\w-]|\{[^}\r\n]+\})+(?:\s*:\s*|[ \t]+)[^{\r\n]*(?:;|[^{\r\n,](?=$)(?!(\r?\n|\r)(?:\{|\2[ \t]+)))/m,lookbehind:!0,inside:{property:{pattern:/^[^\s:]+/,inside:{interpolation:t.interpolation}},rest:t}},selector:{pattern:/(^[ \t]*)(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\))?|\{[^}\r\n]+\})+)(?:(?:\r?\n|\r)(?:\1(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\))?|\{[^}\r\n]+\})+)))*(?:,$|\{|(?=(?:\r?\n|\r)(?:\{|\1[ \t]+)))/m,lookbehind:!0,inside:{interpolation:t.interpolation,punctuation:/[{},]/}},func:t.func,string:t.string,interpolation:t.interpolation,punctuation:/[{}()\[\];:.]/}}(i);var l=i.util.clone(i.languages.typescript);i.languages.tsx=i.languages.extend("jsx",l),i.languages.wasm={comment:[/\(;[\s\S]*?;\)/,{pattern:/;;.*/,greedy:!0}],string:{pattern:/"(?:\\[\s\S]|[^"\\])*"/,greedy:!0},keyword:[{pattern:/\b(?:align|offset)=/,inside:{operator:/=/}},{pattern:/\b(?:(?:f32|f64|i32|i64)(?:\.(?:abs|add|and|ceil|clz|const|convert_[su]\/i(?:32|64)|copysign|ctz|demote\/f64|div(?:_[su])?|eqz?|extend_[su]\/i32|floor|ge(?:_[su])?|gt(?:_[su])?|le(?:_[su])?|load(?:(?:8|16|32)_[su])?|lt(?:_[su])?|max|min|mul|nearest|neg?|or|popcnt|promote\/f32|reinterpret\/[fi](?:32|64)|rem_[su]|rot[lr]|shl|shr_[su]|store(?:8|16|32)?|sqrt|sub|trunc(?:_[su]\/f(?:32|64))?|wrap\/i64|xor))?|memory\.(?:grow|size))\b/,inside:{punctuation:/\./}},/\b(?:anyfunc|block|br(?:_if|_table)?|call(?:_indirect)?|data|drop|elem|else|end|export|func|get_(?:global|local)|global|if|import|local|loop|memory|module|mut|nop|offset|param|result|return|select|set_(?:global|local)|start|table|tee_local|then|type|unreachable)\b/],variable:/\$[\w!#$%&'*+\-./:<=>?@\\^_`|~]+/i,number:/[+-]?\b(?:\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:[eE][+-]?\d(?:_?\d)*)?|0x[\da-fA-F](?:_?[\da-fA-F])*(?:\.[\da-fA-F](?:_?[\da-fA-D])*)?(?:[pP][+-]?\d(?:_?\d)*)?)\b|\binf\b|\bnan(?::0x[\da-fA-F](?:_?[\da-fA-D])*)?\b/,punctuation:/[()]/},i.languages.yaml={scalar:{pattern:/([\-:]\s*(?:![^\s]+)?[ \t]*[|>])[ \t]*(?:((?:\r?\n|\r)[ \t]+)[^\r\n]+(?:\2[^\r\n]+)*)/,lookbehind:!0,alias:"string"},comment:/#.*/,key:{pattern:/(\s*(?:^|[:\-,[{\r\n?])[ \t]*(?:![^\s]+)?[ \t]*)[^\r\n{[\]},#\s]+?(?=\s*:\s)/,lookbehind:!0,alias:"atrule"},directive:{pattern:/(^[ \t]*)%.+/m,lookbehind:!0,alias:"important"},datetime:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:\d{4}-\d\d?-\d\d?(?:[tT]|[ \t]+)\d\d?:\d{2}:\d{2}(?:\.\d*)?[ \t]*(?:Z|[-+]\d\d?(?::\d{2})?)?|\d{4}-\d{2}-\d{2}|\d\d?:\d{2}(?::\d{2}(?:\.\d*)?)?)(?=[ \t]*(?:$|,|]|}))/m,lookbehind:!0,alias:"number"},boolean:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:true|false)[ \t]*(?=$|,|]|})/im,lookbehind:!0,alias:"important"},null:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:null|~)[ \t]*(?=$|,|]|})/im,lookbehind:!0,alias:"important"},string:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)("|')(?:(?!\2)[^\\\r\n]|\\.)*\2(?=[ \t]*(?:$|,|]|}|\s*#))/m,lookbehind:!0,greedy:!0},number:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)[+-]?(?:0x[\da-f]+|0o[0-7]+|(?:\d+\.?\d*|\.?\d+)(?:e[+-]?\d+)?|\.inf|\.nan)[ \t]*(?=$|,|]|})/im,lookbehind:!0},tag:/![^\s]+/,important:/[&*][\w]+/,punctuation:/---|[:[\]{}\-,|>?]|\.\.\./},i.languages.yml=i.languages.yaml,t.a=i},function(e,t,n){"use strict";var r=Object.getOwnPropertySymbols,o=Object.prototype.hasOwnProperty,a=Object.prototype.propertyIsEnumerable;function i(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(o){return!1}}()?Object.assign:function(e,t){for(var n,l,u=i(e),s=1;s<arguments.length;s++){for(var c in n=Object(arguments[s]))o.call(n,c)&&(u[c]=n[c]);if(r){l=r(n);for(var d=0;d<l.length;d++)a.call(n,l[d])&&(u[l[d]]=n[l[d]])}}return u}},function(e,t,n){"use strict";var r=n(8);t.a=r.b},function(e,t,n){"use strict";e.exports=n(38)},function(e,t,n){"use strict";var r=n(0),o=n.n(r);t.a=o.a.createContext(null)},function(e,t,n){"use strict";!function e(){if("undefined"!=typeof __REACT_DEVTOOLS_GLOBAL_HOOK__&&"function"==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE)try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(t){console.error(t)}}(),e.exports=n(32)},function(e){e.exports=JSON.parse('{"docusaurus-plugin-content-docs":{"default":{"path":"/oauth2-proxy/docs","versions":[{"name":"current","label":"Next","isLast":false,"path":"/oauth2-proxy/docs/next","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/next/behaviour","sidebar":"docs"},{"id":"community/security","path":"/oauth2-proxy/docs/next/community/security","sidebar":"docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/next/configuration/alpha-config","sidebar":"docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/next/configuration/oauth_provider","sidebar":"docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/next/configuration/overview","sidebar":"docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/next/configuration/session_storage","sidebar":"docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/next/configuration/tls","sidebar":"docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/next/features/endpoints","sidebar":"docs"},{"id":"features/request_signatures","path":"/oauth2-proxy/docs/next/features/request_signatures","sidebar":"docs"},{"id":"installation","path":"/oauth2-proxy/docs/next/","sidebar":"docs"}]},{"name":"7.0.x","label":"7.0.x","isLast":true,"path":"/oauth2-proxy/docs","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/behaviour","sidebar":"version-7.0.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/community/security","sidebar":"version-7.0.x/docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/configuration/alpha-config","sidebar":"version-7.0.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/configuration/oauth_provider","sidebar":"version-7.0.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/configuration/overview","sidebar":"version-7.0.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/configuration/session_storage","sidebar":"version-7.0.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/configuration/tls","sidebar":"version-7.0.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/features/endpoints","sidebar":"version-7.0.x/docs"},{"id":"features/request_signatures","path":"/oauth2-proxy/docs/features/request_signatures","sidebar":"version-7.0.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/","sidebar":"version-7.0.x/docs"}]},{"name":"6.1.x","label":"6.1.x","isLast":false,"path":"/oauth2-proxy/docs/6.1.x","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/6.1.x/behaviour","sidebar":"version-6.1.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/6.1.x/community/security","sidebar":"version-6.1.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider","sidebar":"version-6.1.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/6.1.x/configuration/overview","sidebar":"version-6.1.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/6.1.x/configuration/session_storage","sidebar":"version-6.1.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/6.1.x/configuration/tls","sidebar":"version-6.1.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/6.1.x/features/endpoints","sidebar":"version-6.1.x/docs"},{"id":"features/request_signatures","path":"/oauth2-proxy/docs/6.1.x/features/request_signatures","sidebar":"version-6.1.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/6.1.x/","sidebar":"version-6.1.x/docs"}]}]}}}')},function(e){e.exports=JSON.parse('{"docusaurusVersion":"2.0.0-alpha.66","siteVersion":"0.0.0","pluginVersions":{"docusaurus-plugin-content-docs":{"type":"package","name":"@docusaurus/plugin-content-docs","version":"2.0.0-alpha.66"},"docusaurus-plugin-content-blog":{"type":"package","name":"@docusaurus/plugin-content-blog","version":"2.0.0-alpha.66"},"docusaurus-plugin-content-pages":{"type":"package","name":"@docusaurus/plugin-content-pages","version":"2.0.0-alpha.66"},"docusaurus-plugin-sitemap":{"type":"package","name":"@docusaurus/plugin-sitemap","version":"2.0.0-alpha.66"},"docusaurus-theme-classic":{"type":"package","name":"@docusaurus/theme-classic","version":"2.0.0-alpha.66"}}}')},function(e,t,n){"use strict";var r=n(23),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},a={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},i={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},l={};function u(e){return r.isMemo(e)?i:l[e.$$typeof]||o}l[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},l[r.Memo]=i;var s=Object.defineProperty,c=Object.getOwnPropertyNames,d=Object.getOwnPropertySymbols,f=Object.getOwnPropertyDescriptor,p=Object.getPrototypeOf,m=Object.prototype;e.exports=function e(t,n,r){if("string"!=typeof n){if(m){var o=p(n);o&&o!==m&&e(t,o,r)}var i=c(n);d&&(i=i.concat(d(n)));for(var l=u(t),h=u(n),g=0;g<i.length;++g){var v=i[g];if(!(a[v]||r&&r[v]||h&&h[v]||l&&l[v])){var y=f(n,v);try{s(t,v,y)}catch(b){}}}}return t}},function(e,t){var n;n=function(){return this}();try{n=n||new Function("return this")()}catch(r){"object"==typeof window&&(n=window)}e.exports=n},function(e,t,n){e.exports=n(45)},function(e,t,n){"use strict";var r=n(21),o="function"==typeof Symbol&&Symbol.for,a=o?Symbol.for("react.element"):60103,i=o?Symbol.for("react.portal"):60106,l=o?Symbol.for("react.fragment"):60107,u=o?Symbol.for("react.strict_mode"):60108,s=o?Symbol.for("react.profiler"):60114,c=o?Symbol.for("react.provider"):60109,d=o?Symbol.for("react.context"):60110,f=o?Symbol.for("react.forward_ref"):60112,p=o?Symbol.for("react.suspense"):60113,m=o?Symbol.for("react.memo"):60115,h=o?Symbol.for("react.lazy"):60116,g="function"==typeof Symbol&&Symbol.iterator;function v(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n]);return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var y={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},b={};function w(e,t,n){this.props=e,this.context=t,this.refs=b,this.updater=n||y}function x(){}function k(e,t,n){this.props=e,this.context=t,this.refs=b,this.updater=n||y}w.prototype.isReactComponent={},w.prototype.setState=function(e,t){if("object"!=typeof e&&"function"!=typeof e&&null!=e)throw Error(v(85));this.updater.enqueueSetState(this,e,t,"setState")},w.prototype.forceUpdate=function(e){this.updater.enqueueForceUpdate(this,e,"forceUpdate")},x.prototype=w.prototype;var E=k.prototype=new x;E.constructor=k,r(E,w.prototype),E.isPureReactComponent=!0;var S={current:null},T=Object.prototype.hasOwnProperty,_={key:!0,ref:!0,__self:!0,__source:!0};function C(e,t,n){var r,o={},i=null,l=null;if(null!=t)for(r in void 0!==t.ref&&(l=t.ref),void 0!==t.key&&(i=""+t.key),t)T.call(t,r)&&!_.hasOwnProperty(r)&&(o[r]=t[r]);var u=arguments.length-2;if(1===u)o.children=n;else if(1<u){for(var s=Array(u),c=0;c<u;c++)s[c]=arguments[c+2];o.children=s}if(e&&e.defaultProps)for(r in u=e.defaultProps)void 0===o[r]&&(o[r]=u[r]);return{$$typeof:a,type:e,key:i,ref:l,props:o,_owner:S.current}}function O(e){return"object"==typeof e&&null!==e&&e.$$typeof===a}var P=/\/+/g,R=[];function A(e,t,n,r){if(R.length){var o=R.pop();return o.result=e,o.keyPrefix=t,o.func=n,o.context=r,o.count=0,o}return{result:e,keyPrefix:t,func:n,context:r,count:0}}function N(e){e.result=null,e.keyPrefix=null,e.func=null,e.context=null,e.count=0,10>R.length&&R.push(e)}function I(e,t,n,r){var o=typeof e;"undefined"!==o&&"boolean"!==o||(e=null);var l=!1;if(null===e)l=!0;else switch(o){case"string":case"number":l=!0;break;case"object":switch(e.$$typeof){case a:case i:l=!0}}if(l)return n(r,e,""===t?"."+D(e,0):t),1;if(l=0,t=""===t?".":t+":",Array.isArray(e))for(var u=0;u<e.length;u++){var s=t+D(o=e[u],u);l+=I(o,s,n,r)}else if(null===e||"object"!=typeof e?s=null:s="function"==typeof(s=g&&e[g]||e["@@iterator"])?s:null,"function"==typeof s)for(e=s.call(e),u=0;!(o=e.next()).done;)l+=I(o=o.value,s=t+D(o,u++),n,r);else if("object"===o)throw n=""+e,Error(v(31,"[object Object]"===n?"object with keys {"+Object.keys(e).join(", ")+"}":n,""));return l}function L(e,t,n){return null==e?0:I(e,"",t,n)}function D(e,t){return"object"==typeof e&&null!==e&&null!=e.key?function(e){var t={"=":"=0",":":"=2"};return"$"+(""+e).replace(/[=:]/g,(function(e){return t[e]}))}(e.key):t.toString(36)}function j(e,t){e.func.call(e.context,t,e.count++)}function F(e,t,n){var r=e.result,o=e.keyPrefix;e=e.func.call(e.context,t,e.count++),Array.isArray(e)?M(e,r,n,(function(e){return e})):null!=e&&(O(e)&&(e=function(e,t){return{$$typeof:a,type:e.type,key:t,ref:e.ref,props:e.props,_owner:e._owner}}(e,o+(!e.key||t&&t.key===e.key?"":(""+e.key).replace(P,"$&/")+"/")+n)),r.push(e))}function M(e,t,n,r,o){var a="";null!=n&&(a=(""+n).replace(P,"$&/")+"/"),L(e,F,t=A(t,a,r,o)),N(t)}var z={current:null};function U(){var e=z.current;if(null===e)throw Error(v(321));return e}var $={ReactCurrentDispatcher:z,ReactCurrentBatchConfig:{suspense:null},ReactCurrentOwner:S,IsSomeRendererActing:{current:!1},assign:r};t.Children={map:function(e,t,n){if(null==e)return e;var r=[];return M(e,r,null,t,n),r},forEach:function(e,t,n){if(null==e)return e;L(e,j,t=A(null,null,t,n)),N(t)},count:function(e){return L(e,(function(){return null}),null)},toArray:function(e){var t=[];return M(e,t,null,(function(e){return e})),t},only:function(e){if(!O(e))throw Error(v(143));return e}},t.Component=w,t.Fragment=l,t.Profiler=s,t.PureComponent=k,t.StrictMode=u,t.Suspense=p,t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=$,t.cloneElement=function(e,t,n){if(null==e)throw Error(v(267,e));var o=r({},e.props),i=e.key,l=e.ref,u=e._owner;if(null!=t){if(void 0!==t.ref&&(l=t.ref,u=S.current),void 0!==t.key&&(i=""+t.key),e.type&&e.type.defaultProps)var s=e.type.defaultProps;for(c in t)T.call(t,c)&&!_.hasOwnProperty(c)&&(o[c]=void 0===t[c]&&void 0!==s?s[c]:t[c])}var c=arguments.length-2;if(1===c)o.children=n;else if(1<c){s=Array(c);for(var d=0;d<c;d++)s[d]=arguments[d+2];o.children=s}return{$$typeof:a,type:e.type,key:i,ref:l,props:o,_owner:u}},t.createContext=function(e,t){return void 0===t&&(t=null),(e={$$typeof:d,_calculateChangedBits:t,_currentValue:e,_currentValue2:e,_threadCount:0,Provider:null,Consumer:null}).Provider={$$typeof:c,_context:e},e.Consumer=e},t.createElement=C,t.createFactory=function(e){var t=C.bind(null,e);return t.type=e,t},t.createRef=function(){return{current:null}},t.forwardRef=function(e){return{$$typeof:f,render:e}},t.isValidElement=O,t.lazy=function(e){return{$$typeof:h,_ctor:e,_status:-1,_result:null}},t.memo=function(e,t){return{$$typeof:m,type:e,compare:void 0===t?null:t}},t.useCallback=function(e,t){return U().useCallback(e,t)},t.useContext=function(e,t){return U().useContext(e,t)},t.useDebugValue=function(){},t.useEffect=function(e,t){return U().useEffect(e,t)},t.useImperativeHandle=function(e,t,n){return U().useImperativeHandle(e,t,n)},t.useLayoutEffect=function(e,t){return U().useLayoutEffect(e,t)},t.useMemo=function(e,t){return U().useMemo(e,t)},t.useReducer=function(e,t,n){return U().useReducer(e,t,n)},t.useRef=function(e){return U().useRef(e)},t.useState=function(e){return U().useState(e)},t.version="16.14.0"},function(e,t,n){"use strict";var r=n(0),o=n(21),a=n(33);function i(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n]);return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}if(!r)throw Error(i(227));function l(e,t,n,r,o,a,i,l,u){var s=Array.prototype.slice.call(arguments,3);try{t.apply(n,s)}catch(c){this.onError(c)}}var u=!1,s=null,c=!1,d=null,f={onError:function(e){u=!0,s=e}};function p(e,t,n,r,o,a,i,c,d){u=!1,s=null,l.apply(f,arguments)}var m=null,h=null,g=null;function v(e,t,n){var r=e.type||"unknown-event";e.currentTarget=g(n),function(e,t,n,r,o,a,l,f,m){if(p.apply(this,arguments),u){if(!u)throw Error(i(198));var h=s;u=!1,s=null,c||(c=!0,d=h)}}(r,t,void 0,e),e.currentTarget=null}var y=null,b={};function w(){if(y)for(var e in b){var t=b[e],n=y.indexOf(e);if(!(-1<n))throw Error(i(96,e));if(!k[n]){if(!t.extractEvents)throw Error(i(97,e));for(var r in k[n]=t,n=t.eventTypes){var o=void 0,a=n[r],l=t,u=r;if(E.hasOwnProperty(u))throw Error(i(99,u));E[u]=a;var s=a.phasedRegistrationNames;if(s){for(o in s)s.hasOwnProperty(o)&&x(s[o],l,u);o=!0}else a.registrationName?(x(a.registrationName,l,u),o=!0):o=!1;if(!o)throw Error(i(98,r,e))}}}}function x(e,t,n){if(S[e])throw Error(i(100,e));S[e]=t,T[e]=t.eventTypes[n].dependencies}var k=[],E={},S={},T={};function _(e){var t,n=!1;for(t in e)if(e.hasOwnProperty(t)){var r=e[t];if(!b.hasOwnProperty(t)||b[t]!==r){if(b[t])throw Error(i(102,t));b[t]=r,n=!0}}n&&w()}var C=!("undefined"==typeof window||void 0===window.document||void 0===window.document.createElement),O=null,P=null,R=null;function A(e){if(e=h(e)){if("function"!=typeof O)throw Error(i(280));var t=e.stateNode;t&&(t=m(t),O(e.stateNode,e.type,t))}}function N(e){P?R?R.push(e):R=[e]:P=e}function I(){if(P){var e=P,t=R;if(R=P=null,A(e),t)for(e=0;e<t.length;e++)A(t[e])}}function L(e,t){return e(t)}function D(e,t,n,r,o){return e(t,n,r,o)}function j(){}var F=L,M=!1,z=!1;function U(){null===P&&null===R||(j(),I())}function $(e,t,n){if(z)return e(t,n);z=!0;try{return F(e,t,n)}finally{z=!1,U()}}var B=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\-.0-9\u00B7\u0300-\u036F\u203F-\u2040]*$/,q=Object.prototype.hasOwnProperty,G={},H={};function V(e,t,n,r,o,a){this.acceptsBooleans=2===t||3===t||4===t,this.attributeName=r,this.attributeNamespace=o,this.mustUseProperty=n,this.propertyName=e,this.type=t,this.sanitizeURL=a}var W={};"children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style".split(" ").forEach((function(e){W[e]=new V(e,0,!1,e,null,!1)})),[["acceptCharset","accept-charset"],["className","class"],["htmlFor","for"],["httpEquiv","http-equiv"]].forEach((function(e){var t=e[0];W[t]=new V(t,1,!1,e[1],null,!1)})),["contentEditable","draggable","spellCheck","value"].forEach((function(e){W[e]=new V(e,2,!1,e.toLowerCase(),null,!1)})),["autoReverse","externalResourcesRequired","focusable","preserveAlpha"].forEach((function(e){W[e]=new V(e,2,!1,e,null,!1)})),"allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope".split(" ").forEach((function(e){W[e]=new V(e,3,!1,e.toLowerCase(),null,!1)})),["checked","multiple","muted","selected"].forEach((function(e){W[e]=new V(e,3,!0,e,null,!1)})),["capture","download"].forEach((function(e){W[e]=new V(e,4,!1,e,null,!1)})),["cols","rows","size","span"].forEach((function(e){W[e]=new V(e,6,!1,e,null,!1)})),["rowSpan","start"].forEach((function(e){W[e]=new V(e,5,!1,e.toLowerCase(),null,!1)}));var Q=/[\-:]([a-z])/g;function K(e){return e[1].toUpperCase()}"accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-name glyph-orientation-horizontal glyph-orientation-vertical horiz-adv-x horiz-origin-x image-rendering letter-spacing lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematical vector-effect vert-adv-y vert-origin-x vert-origin-y word-spacing writing-mode xmlns:xlink x-height".split(" ").forEach((function(e){var t=e.replace(Q,K);W[t]=new V(t,1,!1,e,null,!1)})),"xlink:actuate xlink:arcrole xlink:role xlink:show xlink:title xlink:type".split(" ").forEach((function(e){var t=e.replace(Q,K);W[t]=new V(t,1,!1,e,"http://www.w3.org/1999/xlink",!1)})),["xml:base","xml:lang","xml:space"].forEach((function(e){var t=e.replace(Q,K);W[t]=new V(t,1,!1,e,"http://www.w3.org/XML/1998/namespace",!1)})),["tabIndex","crossOrigin"].forEach((function(e){W[e]=new V(e,1,!1,e.toLowerCase(),null,!1)})),W.xlinkHref=new V("xlinkHref",1,!1,"xlink:href","http://www.w3.org/1999/xlink",!0),["src","href","action","formAction"].forEach((function(e){W[e]=new V(e,1,!1,e.toLowerCase(),null,!0)}));var X=r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;function Y(e,t,n,r){var o=W.hasOwnProperty(t)?W[t]:null;(null!==o?0===o.type:!r&&(2<t.length&&("o"===t[0]||"O"===t[0])&&("n"===t[1]||"N"===t[1])))||(function(e,t,n,r){if(null==t||function(e,t,n,r){if(null!==n&&0===n.type)return!1;switch(typeof t){case"function":case"symbol":return!0;case"boolean":return!r&&(null!==n?!n.acceptsBooleans:"data-"!==(e=e.toLowerCase().slice(0,5))&&"aria-"!==e);default:return!1}}(e,t,n,r))return!0;if(r)return!1;if(null!==n)switch(n.type){case 3:return!t;case 4:return!1===t;case 5:return isNaN(t);case 6:return isNaN(t)||1>t}return!1}(t,n,o,r)&&(n=null),r||null===o?function(e){return!!q.call(H,e)||!q.call(G,e)&&(B.test(e)?H[e]=!0:(G[e]=!0,!1))}(t)&&(null===n?e.removeAttribute(t):e.setAttribute(t,""+n)):o.mustUseProperty?e[o.propertyName]=null===n?3!==o.type&&"":n:(t=o.attributeName,r=o.attributeNamespace,null===n?e.removeAttribute(t):(n=3===(o=o.type)||4===o&&!0===n?"":""+n,r?e.setAttributeNS(r,t,n):e.setAttribute(t,n))))}X.hasOwnProperty("ReactCurrentDispatcher")||(X.ReactCurrentDispatcher={current:null}),X.hasOwnProperty("ReactCurrentBatchConfig")||(X.ReactCurrentBatchConfig={suspense:null});var Z=/^(.*)[\\\/]/,J="function"==typeof Symbol&&Symbol.for,ee=J?Symbol.for("react.element"):60103,te=J?Symbol.for("react.portal"):60106,ne=J?Symbol.for("react.fragment"):60107,re=J?Symbol.for("react.strict_mode"):60108,oe=J?Symbol.for("react.profiler"):60114,ae=J?Symbol.for("react.provider"):60109,ie=J?Symbol.for("react.context"):60110,le=J?Symbol.for("react.concurrent_mode"):60111,ue=J?Symbol.for("react.forward_ref"):60112,se=J?Symbol.for("react.suspense"):60113,ce=J?Symbol.for("react.suspense_list"):60120,de=J?Symbol.for("react.memo"):60115,fe=J?Symbol.for("react.lazy"):60116,pe=J?Symbol.for("react.block"):60121,me="function"==typeof Symbol&&Symbol.iterator;function he(e){return null===e||"object"!=typeof e?null:"function"==typeof(e=me&&e[me]||e["@@iterator"])?e:null}function ge(e){if(null==e)return null;if("function"==typeof e)return e.displayName||e.name||null;if("string"==typeof e)return e;switch(e){case ne:return"Fragment";case te:return"Portal";case oe:return"Profiler";case re:return"StrictMode";case se:return"Suspense";case ce:return"SuspenseList"}if("object"==typeof e)switch(e.$$typeof){case ie:return"Context.Consumer";case ae:return"Context.Provider";case ue:var t=e.render;return t=t.displayName||t.name||"",e.displayName||(""!==t?"ForwardRef("+t+")":"ForwardRef");case de:return ge(e.type);case pe:return ge(e.render);case fe:if(e=1===e._status?e._result:null)return ge(e)}return null}function ve(e){var t="";do{e:switch(e.tag){case 3:case 4:case 6:case 7:case 10:case 9:var n="";break e;default:var r=e._debugOwner,o=e._debugSource,a=ge(e.type);n=null,r&&(n=ge(r.type)),r=a,a="",o?a=" (at "+o.fileName.replace(Z,"")+":"+o.lineNumber+")":n&&(a=" (created by "+n+")"),n="\n    in "+(r||"Unknown")+a}t+=n,e=e.return}while(e);return t}function ye(e){switch(typeof e){case"boolean":case"number":case"object":case"string":case"undefined":return e;default:return""}}function be(e){var t=e.type;return(e=e.nodeName)&&"input"===e.toLowerCase()&&("checkbox"===t||"radio"===t)}function we(e){e._valueTracker||(e._valueTracker=function(e){var t=be(e)?"checked":"value",n=Object.getOwnPropertyDescriptor(e.constructor.prototype,t),r=""+e[t];if(!e.hasOwnProperty(t)&&void 0!==n&&"function"==typeof n.get&&"function"==typeof n.set){var o=n.get,a=n.set;return Object.defineProperty(e,t,{configurable:!0,get:function(){return o.call(this)},set:function(e){r=""+e,a.call(this,e)}}),Object.defineProperty(e,t,{enumerable:n.enumerable}),{getValue:function(){return r},setValue:function(e){r=""+e},stopTracking:function(){e._valueTracker=null,delete e[t]}}}}(e))}function xe(e){if(!e)return!1;var t=e._valueTracker;if(!t)return!0;var n=t.getValue(),r="";return e&&(r=be(e)?e.checked?"true":"false":e.value),(e=r)!==n&&(t.setValue(e),!0)}function ke(e,t){var n=t.checked;return o({},t,{defaultChecked:void 0,defaultValue:void 0,value:void 0,checked:null!=n?n:e._wrapperState.initialChecked})}function Ee(e,t){var n=null==t.defaultValue?"":t.defaultValue,r=null!=t.checked?t.checked:t.defaultChecked;n=ye(null!=t.value?t.value:n),e._wrapperState={initialChecked:r,initialValue:n,controlled:"checkbox"===t.type||"radio"===t.type?null!=t.checked:null!=t.value}}function Se(e,t){null!=(t=t.checked)&&Y(e,"checked",t,!1)}function Te(e,t){Se(e,t);var n=ye(t.value),r=t.type;if(null!=n)"number"===r?(0===n&&""===e.value||e.value!=n)&&(e.value=""+n):e.value!==""+n&&(e.value=""+n);else if("submit"===r||"reset"===r)return void e.removeAttribute("value");t.hasOwnProperty("value")?Ce(e,t.type,n):t.hasOwnProperty("defaultValue")&&Ce(e,t.type,ye(t.defaultValue)),null==t.checked&&null!=t.defaultChecked&&(e.defaultChecked=!!t.defaultChecked)}function _e(e,t,n){if(t.hasOwnProperty("value")||t.hasOwnProperty("defaultValue")){var r=t.type;if(!("submit"!==r&&"reset"!==r||void 0!==t.value&&null!==t.value))return;t=""+e._wrapperState.initialValue,n||t===e.value||(e.value=t),e.defaultValue=t}""!==(n=e.name)&&(e.name=""),e.defaultChecked=!!e._wrapperState.initialChecked,""!==n&&(e.name=n)}function Ce(e,t,n){"number"===t&&e.ownerDocument.activeElement===e||(null==n?e.defaultValue=""+e._wrapperState.initialValue:e.defaultValue!==""+n&&(e.defaultValue=""+n))}function Oe(e,t){return e=o({children:void 0},t),(t=function(e){var t="";return r.Children.forEach(e,(function(e){null!=e&&(t+=e)})),t}(t.children))&&(e.children=t),e}function Pe(e,t,n,r){if(e=e.options,t){t={};for(var o=0;o<n.length;o++)t["$"+n[o]]=!0;for(n=0;n<e.length;n++)o=t.hasOwnProperty("$"+e[n].value),e[n].selected!==o&&(e[n].selected=o),o&&r&&(e[n].defaultSelected=!0)}else{for(n=""+ye(n),t=null,o=0;o<e.length;o++){if(e[o].value===n)return e[o].selected=!0,void(r&&(e[o].defaultSelected=!0));null!==t||e[o].disabled||(t=e[o])}null!==t&&(t.selected=!0)}}function Re(e,t){if(null!=t.dangerouslySetInnerHTML)throw Error(i(91));return o({},t,{value:void 0,defaultValue:void 0,children:""+e._wrapperState.initialValue})}function Ae(e,t){var n=t.value;if(null==n){if(n=t.children,t=t.defaultValue,null!=n){if(null!=t)throw Error(i(92));if(Array.isArray(n)){if(!(1>=n.length))throw Error(i(93));n=n[0]}t=n}null==t&&(t=""),n=t}e._wrapperState={initialValue:ye(n)}}function Ne(e,t){var n=ye(t.value),r=ye(t.defaultValue);null!=n&&((n=""+n)!==e.value&&(e.value=n),null==t.defaultValue&&e.defaultValue!==n&&(e.defaultValue=n)),null!=r&&(e.defaultValue=""+r)}function Ie(e){var t=e.textContent;t===e._wrapperState.initialValue&&""!==t&&null!==t&&(e.value=t)}var Le="http://www.w3.org/1999/xhtml",De="http://www.w3.org/2000/svg";function je(e){switch(e){case"svg":return"http://www.w3.org/2000/svg";case"math":return"http://www.w3.org/1998/Math/MathML";default:return"http://www.w3.org/1999/xhtml"}}function Fe(e,t){return null==e||"http://www.w3.org/1999/xhtml"===e?je(t):"http://www.w3.org/2000/svg"===e&&"foreignObject"===t?"http://www.w3.org/1999/xhtml":e}var Me,ze,Ue=(ze=function(e,t){if(e.namespaceURI!==De||"innerHTML"in e)e.innerHTML=t;else{for((Me=Me||document.createElement("div")).innerHTML="<svg>"+t.valueOf().toString()+"</svg>",t=Me.firstChild;e.firstChild;)e.removeChild(e.firstChild);for(;t.firstChild;)e.appendChild(t.firstChild)}},"undefined"!=typeof MSApp&&MSApp.execUnsafeLocalFunction?function(e,t,n,r){MSApp.execUnsafeLocalFunction((function(){return ze(e,t)}))}:ze);function $e(e,t){if(t){var n=e.firstChild;if(n&&n===e.lastChild&&3===n.nodeType)return void(n.nodeValue=t)}e.textContent=t}function Be(e,t){var n={};return n[e.toLowerCase()]=t.toLowerCase(),n["Webkit"+e]="webkit"+t,n["Moz"+e]="moz"+t,n}var qe={animationend:Be("Animation","AnimationEnd"),animationiteration:Be("Animation","AnimationIteration"),animationstart:Be("Animation","AnimationStart"),transitionend:Be("Transition","TransitionEnd")},Ge={},He={};function Ve(e){if(Ge[e])return Ge[e];if(!qe[e])return e;var t,n=qe[e];for(t in n)if(n.hasOwnProperty(t)&&t in He)return Ge[e]=n[t];return e}C&&(He=document.createElement("div").style,"AnimationEvent"in window||(delete qe.animationend.animation,delete qe.animationiteration.animation,delete qe.animationstart.animation),"TransitionEvent"in window||delete qe.transitionend.transition);var We=Ve("animationend"),Qe=Ve("animationiteration"),Ke=Ve("animationstart"),Xe=Ve("transitionend"),Ye="abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange seeked seeking stalled suspend timeupdate volumechange waiting".split(" "),Ze=new("function"==typeof WeakMap?WeakMap:Map);function Je(e){var t=Ze.get(e);return void 0===t&&(t=new Map,Ze.set(e,t)),t}function et(e){var t=e,n=e;if(e.alternate)for(;t.return;)t=t.return;else{e=t;do{0!=(1026&(t=e).effectTag)&&(n=t.return),e=t.return}while(e)}return 3===t.tag?n:null}function tt(e){if(13===e.tag){var t=e.memoizedState;if(null===t&&(null!==(e=e.alternate)&&(t=e.memoizedState)),null!==t)return t.dehydrated}return null}function nt(e){if(et(e)!==e)throw Error(i(188))}function rt(e){if(!(e=function(e){var t=e.alternate;if(!t){if(null===(t=et(e)))throw Error(i(188));return t!==e?null:e}for(var n=e,r=t;;){var o=n.return;if(null===o)break;var a=o.alternate;if(null===a){if(null!==(r=o.return)){n=r;continue}break}if(o.child===a.child){for(a=o.child;a;){if(a===n)return nt(o),e;if(a===r)return nt(o),t;a=a.sibling}throw Error(i(188))}if(n.return!==r.return)n=o,r=a;else{for(var l=!1,u=o.child;u;){if(u===n){l=!0,n=o,r=a;break}if(u===r){l=!0,r=o,n=a;break}u=u.sibling}if(!l){for(u=a.child;u;){if(u===n){l=!0,n=a,r=o;break}if(u===r){l=!0,r=a,n=o;break}u=u.sibling}if(!l)throw Error(i(189))}}if(n.alternate!==r)throw Error(i(190))}if(3!==n.tag)throw Error(i(188));return n.stateNode.current===n?e:t}(e)))return null;for(var t=e;;){if(5===t.tag||6===t.tag)return t;if(t.child)t.child.return=t,t=t.child;else{if(t===e)break;for(;!t.sibling;){if(!t.return||t.return===e)return null;t=t.return}t.sibling.return=t.return,t=t.sibling}}return null}function ot(e,t){if(null==t)throw Error(i(30));return null==e?t:Array.isArray(e)?Array.isArray(t)?(e.push.apply(e,t),e):(e.push(t),e):Array.isArray(t)?[e].concat(t):[e,t]}function at(e,t,n){Array.isArray(e)?e.forEach(t,n):e&&t.call(n,e)}var it=null;function lt(e){if(e){var t=e._dispatchListeners,n=e._dispatchInstances;if(Array.isArray(t))for(var r=0;r<t.length&&!e.isPropagationStopped();r++)v(e,t[r],n[r]);else t&&v(e,t,n);e._dispatchListeners=null,e._dispatchInstances=null,e.isPersistent()||e.constructor.release(e)}}function ut(e){if(null!==e&&(it=ot(it,e)),e=it,it=null,e){if(at(e,lt),it)throw Error(i(95));if(c)throw e=d,c=!1,d=null,e}}function st(e){return(e=e.target||e.srcElement||window).correspondingUseElement&&(e=e.correspondingUseElement),3===e.nodeType?e.parentNode:e}function ct(e){if(!C)return!1;var t=(e="on"+e)in document;return t||((t=document.createElement("div")).setAttribute(e,"return;"),t="function"==typeof t[e]),t}var dt=[];function ft(e){e.topLevelType=null,e.nativeEvent=null,e.targetInst=null,e.ancestors.length=0,10>dt.length&&dt.push(e)}function pt(e,t,n,r){if(dt.length){var o=dt.pop();return o.topLevelType=e,o.eventSystemFlags=r,o.nativeEvent=t,o.targetInst=n,o}return{topLevelType:e,eventSystemFlags:r,nativeEvent:t,targetInst:n,ancestors:[]}}function mt(e){var t=e.targetInst,n=t;do{if(!n){e.ancestors.push(n);break}var r=n;if(3===r.tag)r=r.stateNode.containerInfo;else{for(;r.return;)r=r.return;r=3!==r.tag?null:r.stateNode.containerInfo}if(!r)break;5!==(t=n.tag)&&6!==t||e.ancestors.push(n),n=An(r)}while(n);for(n=0;n<e.ancestors.length;n++){t=e.ancestors[n];var o=st(e.nativeEvent);r=e.topLevelType;var a=e.nativeEvent,i=e.eventSystemFlags;0===n&&(i|=64);for(var l=null,u=0;u<k.length;u++){var s=k[u];s&&(s=s.extractEvents(r,t,a,o,i))&&(l=ot(l,s))}ut(l)}}function ht(e,t,n){if(!n.has(e)){switch(e){case"scroll":Kt(t,"scroll",!0);break;case"focus":case"blur":Kt(t,"focus",!0),Kt(t,"blur",!0),n.set("blur",null),n.set("focus",null);break;case"cancel":case"close":ct(e)&&Kt(t,e,!0);break;case"invalid":case"submit":case"reset":break;default:-1===Ye.indexOf(e)&&Qt(e,t)}n.set(e,null)}}var gt,vt,yt,bt=!1,wt=[],xt=null,kt=null,Et=null,St=new Map,Tt=new Map,_t=[],Ct="mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput close cancel copy cut paste click change contextmenu reset submit".split(" "),Ot="focus blur dragenter dragleave mouseover mouseout pointerover pointerout gotpointercapture lostpointercapture".split(" ");function Pt(e,t,n,r,o){return{blockedOn:e,topLevelType:t,eventSystemFlags:32|n,nativeEvent:o,container:r}}function Rt(e,t){switch(e){case"focus":case"blur":xt=null;break;case"dragenter":case"dragleave":kt=null;break;case"mouseover":case"mouseout":Et=null;break;case"pointerover":case"pointerout":St.delete(t.pointerId);break;case"gotpointercapture":case"lostpointercapture":Tt.delete(t.pointerId)}}function At(e,t,n,r,o,a){return null===e||e.nativeEvent!==a?(e=Pt(t,n,r,o,a),null!==t&&(null!==(t=Nn(t))&&vt(t)),e):(e.eventSystemFlags|=r,e)}function Nt(e){var t=An(e.target);if(null!==t){var n=et(t);if(null!==n)if(13===(t=n.tag)){if(null!==(t=tt(n)))return e.blockedOn=t,void a.unstable_runWithPriority(e.priority,(function(){yt(n)}))}else if(3===t&&n.stateNode.hydrate)return void(e.blockedOn=3===n.tag?n.stateNode.containerInfo:null)}e.blockedOn=null}function It(e){if(null!==e.blockedOn)return!1;var t=Jt(e.topLevelType,e.eventSystemFlags,e.container,e.nativeEvent);if(null!==t){var n=Nn(t);return null!==n&&vt(n),e.blockedOn=t,!1}return!0}function Lt(e,t,n){It(e)&&n.delete(t)}function Dt(){for(bt=!1;0<wt.length;){var e=wt[0];if(null!==e.blockedOn){null!==(e=Nn(e.blockedOn))&&gt(e);break}var t=Jt(e.topLevelType,e.eventSystemFlags,e.container,e.nativeEvent);null!==t?e.blockedOn=t:wt.shift()}null!==xt&&It(xt)&&(xt=null),null!==kt&&It(kt)&&(kt=null),null!==Et&&It(Et)&&(Et=null),St.forEach(Lt),Tt.forEach(Lt)}function jt(e,t){e.blockedOn===t&&(e.blockedOn=null,bt||(bt=!0,a.unstable_scheduleCallback(a.unstable_NormalPriority,Dt)))}function Ft(e){function t(t){return jt(t,e)}if(0<wt.length){jt(wt[0],e);for(var n=1;n<wt.length;n++){var r=wt[n];r.blockedOn===e&&(r.blockedOn=null)}}for(null!==xt&&jt(xt,e),null!==kt&&jt(kt,e),null!==Et&&jt(Et,e),St.forEach(t),Tt.forEach(t),n=0;n<_t.length;n++)(r=_t[n]).blockedOn===e&&(r.blockedOn=null);for(;0<_t.length&&null===(n=_t[0]).blockedOn;)Nt(n),null===n.blockedOn&&_t.shift()}var Mt={},zt=new Map,Ut=new Map,$t=["abort","abort",We,"animationEnd",Qe,"animationIteration",Ke,"animationStart","canplay","canPlay","canplaythrough","canPlayThrough","durationchange","durationChange","emptied","emptied","encrypted","encrypted","ended","ended","error","error","gotpointercapture","gotPointerCapture","load","load","loadeddata","loadedData","loadedmetadata","loadedMetadata","loadstart","loadStart","lostpointercapture","lostPointerCapture","playing","playing","progress","progress","seeking","seeking","stalled","stalled","suspend","suspend","timeupdate","timeUpdate",Xe,"transitionEnd","waiting","waiting"];function Bt(e,t){for(var n=0;n<e.length;n+=2){var r=e[n],o=e[n+1],a="on"+(o[0].toUpperCase()+o.slice(1));a={phasedRegistrationNames:{bubbled:a,captured:a+"Capture"},dependencies:[r],eventPriority:t},Ut.set(r,t),zt.set(r,a),Mt[o]=a}}Bt("blur blur cancel cancel click click close close contextmenu contextMenu copy copy cut cut auxclick auxClick dblclick doubleClick dragend dragEnd dragstart dragStart drop drop focus focus input input invalid invalid keydown keyDown keypress keyPress keyup keyUp mousedown mouseDown mouseup mouseUp paste paste pause pause play play pointercancel pointerCancel pointerdown pointerDown pointerup pointerUp ratechange rateChange reset reset seeked seeked submit submit touchcancel touchCancel touchend touchEnd touchstart touchStart volumechange volumeChange".split(" "),0),Bt("drag drag dragenter dragEnter dragexit dragExit dragleave dragLeave dragover dragOver mousemove mouseMove mouseout mouseOut mouseover mouseOver pointermove pointerMove pointerout pointerOut pointerover pointerOver scroll scroll toggle toggle touchmove touchMove wheel wheel".split(" "),1),Bt($t,2);for(var qt="change selectionchange textInput compositionstart compositionend compositionupdate".split(" "),Gt=0;Gt<qt.length;Gt++)Ut.set(qt[Gt],0);var Ht=a.unstable_UserBlockingPriority,Vt=a.unstable_runWithPriority,Wt=!0;function Qt(e,t){Kt(t,e,!1)}function Kt(e,t,n){var r=Ut.get(t);switch(void 0===r?2:r){case 0:r=Xt.bind(null,t,1,e);break;case 1:r=Yt.bind(null,t,1,e);break;default:r=Zt.bind(null,t,1,e)}n?e.addEventListener(t,r,!0):e.addEventListener(t,r,!1)}function Xt(e,t,n,r){M||j();var o=Zt,a=M;M=!0;try{D(o,e,t,n,r)}finally{(M=a)||U()}}function Yt(e,t,n,r){Vt(Ht,Zt.bind(null,e,t,n,r))}function Zt(e,t,n,r){if(Wt)if(0<wt.length&&-1<Ct.indexOf(e))e=Pt(null,e,t,n,r),wt.push(e);else{var o=Jt(e,t,n,r);if(null===o)Rt(e,r);else if(-1<Ct.indexOf(e))e=Pt(o,e,t,n,r),wt.push(e);else if(!function(e,t,n,r,o){switch(t){case"focus":return xt=At(xt,e,t,n,r,o),!0;case"dragenter":return kt=At(kt,e,t,n,r,o),!0;case"mouseover":return Et=At(Et,e,t,n,r,o),!0;case"pointerover":var a=o.pointerId;return St.set(a,At(St.get(a)||null,e,t,n,r,o)),!0;case"gotpointercapture":return a=o.pointerId,Tt.set(a,At(Tt.get(a)||null,e,t,n,r,o)),!0}return!1}(o,e,t,n,r)){Rt(e,r),e=pt(e,r,null,t);try{$(mt,e)}finally{ft(e)}}}}function Jt(e,t,n,r){if(null!==(n=An(n=st(r)))){var o=et(n);if(null===o)n=null;else{var a=o.tag;if(13===a){if(null!==(n=tt(o)))return n;n=null}else if(3===a){if(o.stateNode.hydrate)return 3===o.tag?o.stateNode.containerInfo:null;n=null}else o!==n&&(n=null)}}e=pt(e,r,n,t);try{$(mt,e)}finally{ft(e)}return null}var en={animationIterationCount:!0,borderImageOutset:!0,borderImageSlice:!0,borderImageWidth:!0,boxFlex:!0,boxFlexGroup:!0,boxOrdinalGroup:!0,columnCount:!0,columns:!0,flex:!0,flexGrow:!0,flexPositive:!0,flexShrink:!0,flexNegative:!0,flexOrder:!0,gridArea:!0,gridRow:!0,gridRowEnd:!0,gridRowSpan:!0,gridRowStart:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnSpan:!0,gridColumnStart:!0,fontWeight:!0,lineClamp:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,tabSize:!0,widows:!0,zIndex:!0,zoom:!0,fillOpacity:!0,floodOpacity:!0,stopOpacity:!0,strokeDasharray:!0,strokeDashoffset:!0,strokeMiterlimit:!0,strokeOpacity:!0,strokeWidth:!0},tn=["Webkit","ms","Moz","O"];function nn(e,t,n){return null==t||"boolean"==typeof t||""===t?"":n||"number"!=typeof t||0===t||en.hasOwnProperty(e)&&en[e]?(""+t).trim():t+"px"}function rn(e,t){for(var n in e=e.style,t)if(t.hasOwnProperty(n)){var r=0===n.indexOf("--"),o=nn(n,t[n],r);"float"===n&&(n="cssFloat"),r?e.setProperty(n,o):e[n]=o}}Object.keys(en).forEach((function(e){tn.forEach((function(t){t=t+e.charAt(0).toUpperCase()+e.substring(1),en[t]=en[e]}))}));var on=o({menuitem:!0},{area:!0,base:!0,br:!0,col:!0,embed:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0});function an(e,t){if(t){if(on[e]&&(null!=t.children||null!=t.dangerouslySetInnerHTML))throw Error(i(137,e,""));if(null!=t.dangerouslySetInnerHTML){if(null!=t.children)throw Error(i(60));if("object"!=typeof t.dangerouslySetInnerHTML||!("__html"in t.dangerouslySetInnerHTML))throw Error(i(61))}if(null!=t.style&&"object"!=typeof t.style)throw Error(i(62,""))}}function ln(e,t){if(-1===e.indexOf("-"))return"string"==typeof t.is;switch(e){case"annotation-xml":case"color-profile":case"font-face":case"font-face-src":case"font-face-uri":case"font-face-format":case"font-face-name":case"missing-glyph":return!1;default:return!0}}var un=Le;function sn(e,t){var n=Je(e=9===e.nodeType||11===e.nodeType?e:e.ownerDocument);t=T[t];for(var r=0;r<t.length;r++)ht(t[r],e,n)}function cn(){}function dn(e){if(void 0===(e=e||("undefined"!=typeof document?document:void 0)))return null;try{return e.activeElement||e.body}catch(t){return e.body}}function fn(e){for(;e&&e.firstChild;)e=e.firstChild;return e}function pn(e,t){var n,r=fn(e);for(e=0;r;){if(3===r.nodeType){if(n=e+r.textContent.length,e<=t&&n>=t)return{node:r,offset:t-e};e=n}e:{for(;r;){if(r.nextSibling){r=r.nextSibling;break e}r=r.parentNode}r=void 0}r=fn(r)}}function mn(e,t){return!(!e||!t)&&(e===t||(!e||3!==e.nodeType)&&(t&&3===t.nodeType?mn(e,t.parentNode):"contains"in e?e.contains(t):!!e.compareDocumentPosition&&!!(16&e.compareDocumentPosition(t))))}function hn(){for(var e=window,t=dn();t instanceof e.HTMLIFrameElement;){try{var n="string"==typeof t.contentWindow.location.href}catch(r){n=!1}if(!n)break;t=dn((e=t.contentWindow).document)}return t}function gn(e){var t=e&&e.nodeName&&e.nodeName.toLowerCase();return t&&("input"===t&&("text"===e.type||"search"===e.type||"tel"===e.type||"url"===e.type||"password"===e.type)||"textarea"===t||"true"===e.contentEditable)}var vn="$?",yn="$!",bn=null,wn=null;function xn(e,t){switch(e){case"button":case"input":case"select":case"textarea":return!!t.autoFocus}return!1}function kn(e,t){return"textarea"===e||"option"===e||"noscript"===e||"string"==typeof t.children||"number"==typeof t.children||"object"==typeof t.dangerouslySetInnerHTML&&null!==t.dangerouslySetInnerHTML&&null!=t.dangerouslySetInnerHTML.__html}var En="function"==typeof setTimeout?setTimeout:void 0,Sn="function"==typeof clearTimeout?clearTimeout:void 0;function Tn(e){for(;null!=e;e=e.nextSibling){var t=e.nodeType;if(1===t||3===t)break}return e}function _n(e){e=e.previousSibling;for(var t=0;e;){if(8===e.nodeType){var n=e.data;if("$"===n||n===yn||n===vn){if(0===t)return e;t--}else"/$"===n&&t++}e=e.previousSibling}return null}var Cn=Math.random().toString(36).slice(2),On="__reactInternalInstance$"+Cn,Pn="__reactEventHandlers$"+Cn,Rn="__reactContainere$"+Cn;function An(e){var t=e[On];if(t)return t;for(var n=e.parentNode;n;){if(t=n[Rn]||n[On]){if(n=t.alternate,null!==t.child||null!==n&&null!==n.child)for(e=_n(e);null!==e;){if(n=e[On])return n;e=_n(e)}return t}n=(e=n).parentNode}return null}function Nn(e){return!(e=e[On]||e[Rn])||5!==e.tag&&6!==e.tag&&13!==e.tag&&3!==e.tag?null:e}function In(e){if(5===e.tag||6===e.tag)return e.stateNode;throw Error(i(33))}function Ln(e){return e[Pn]||null}function Dn(e){do{e=e.return}while(e&&5!==e.tag);return e||null}function jn(e,t){var n=e.stateNode;if(!n)return null;var r=m(n);if(!r)return null;n=r[t];e:switch(t){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":case"onMouseEnter":(r=!r.disabled)||(r=!("button"===(e=e.type)||"input"===e||"select"===e||"textarea"===e)),e=!r;break e;default:e=!1}if(e)return null;if(n&&"function"!=typeof n)throw Error(i(231,t,typeof n));return n}function Fn(e,t,n){(t=jn(e,n.dispatchConfig.phasedRegistrationNames[t]))&&(n._dispatchListeners=ot(n._dispatchListeners,t),n._dispatchInstances=ot(n._dispatchInstances,e))}function Mn(e){if(e&&e.dispatchConfig.phasedRegistrationNames){for(var t=e._targetInst,n=[];t;)n.push(t),t=Dn(t);for(t=n.length;0<t--;)Fn(n[t],"captured",e);for(t=0;t<n.length;t++)Fn(n[t],"bubbled",e)}}function zn(e,t,n){e&&n&&n.dispatchConfig.registrationName&&(t=jn(e,n.dispatchConfig.registrationName))&&(n._dispatchListeners=ot(n._dispatchListeners,t),n._dispatchInstances=ot(n._dispatchInstances,e))}function Un(e){e&&e.dispatchConfig.registrationName&&zn(e._targetInst,null,e)}function $n(e){at(e,Mn)}var Bn=null,qn=null,Gn=null;function Hn(){if(Gn)return Gn;var e,t,n=qn,r=n.length,o="value"in Bn?Bn.value:Bn.textContent,a=o.length;for(e=0;e<r&&n[e]===o[e];e++);var i=r-e;for(t=1;t<=i&&n[r-t]===o[a-t];t++);return Gn=o.slice(e,1<t?1-t:void 0)}function Vn(){return!0}function Wn(){return!1}function Qn(e,t,n,r){for(var o in this.dispatchConfig=e,this._targetInst=t,this.nativeEvent=n,e=this.constructor.Interface)e.hasOwnProperty(o)&&((t=e[o])?this[o]=t(n):"target"===o?this.target=r:this[o]=n[o]);return this.isDefaultPrevented=(null!=n.defaultPrevented?n.defaultPrevented:!1===n.returnValue)?Vn:Wn,this.isPropagationStopped=Wn,this}function Kn(e,t,n,r){if(this.eventPool.length){var o=this.eventPool.pop();return this.call(o,e,t,n,r),o}return new this(e,t,n,r)}function Xn(e){if(!(e instanceof this))throw Error(i(279));e.destructor(),10>this.eventPool.length&&this.eventPool.push(e)}function Yn(e){e.eventPool=[],e.getPooled=Kn,e.release=Xn}o(Qn.prototype,{preventDefault:function(){this.defaultPrevented=!0;var e=this.nativeEvent;e&&(e.preventDefault?e.preventDefault():"unknown"!=typeof e.returnValue&&(e.returnValue=!1),this.isDefaultPrevented=Vn)},stopPropagation:function(){var e=this.nativeEvent;e&&(e.stopPropagation?e.stopPropagation():"unknown"!=typeof e.cancelBubble&&(e.cancelBubble=!0),this.isPropagationStopped=Vn)},persist:function(){this.isPersistent=Vn},isPersistent:Wn,destructor:function(){var e,t=this.constructor.Interface;for(e in t)this[e]=null;this.nativeEvent=this._targetInst=this.dispatchConfig=null,this.isPropagationStopped=this.isDefaultPrevented=Wn,this._dispatchInstances=this._dispatchListeners=null}}),Qn.Interface={type:null,target:null,currentTarget:function(){return null},eventPhase:null,bubbles:null,cancelable:null,timeStamp:function(e){return e.timeStamp||Date.now()},defaultPrevented:null,isTrusted:null},Qn.extend=function(e){function t(){}function n(){return r.apply(this,arguments)}var r=this;t.prototype=r.prototype;var a=new t;return o(a,n.prototype),n.prototype=a,n.prototype.constructor=n,n.Interface=o({},r.Interface,e),n.extend=r.extend,Yn(n),n},Yn(Qn);var Zn=Qn.extend({data:null}),Jn=Qn.extend({data:null}),er=[9,13,27,32],tr=C&&"CompositionEvent"in window,nr=null;C&&"documentMode"in document&&(nr=document.documentMode);var rr=C&&"TextEvent"in window&&!nr,or=C&&(!tr||nr&&8<nr&&11>=nr),ar=String.fromCharCode(32),ir={beforeInput:{phasedRegistrationNames:{bubbled:"onBeforeInput",captured:"onBeforeInputCapture"},dependencies:["compositionend","keypress","textInput","paste"]},compositionEnd:{phasedRegistrationNames:{bubbled:"onCompositionEnd",captured:"onCompositionEndCapture"},dependencies:"blur compositionend keydown keypress keyup mousedown".split(" ")},compositionStart:{phasedRegistrationNames:{bubbled:"onCompositionStart",captured:"onCompositionStartCapture"},dependencies:"blur compositionstart keydown keypress keyup mousedown".split(" ")},compositionUpdate:{phasedRegistrationNames:{bubbled:"onCompositionUpdate",captured:"onCompositionUpdateCapture"},dependencies:"blur compositionupdate keydown keypress keyup mousedown".split(" ")}},lr=!1;function ur(e,t){switch(e){case"keyup":return-1!==er.indexOf(t.keyCode);case"keydown":return 229!==t.keyCode;case"keypress":case"mousedown":case"blur":return!0;default:return!1}}function sr(e){return"object"==typeof(e=e.detail)&&"data"in e?e.data:null}var cr=!1;var dr={eventTypes:ir,extractEvents:function(e,t,n,r){var o;if(tr)e:{switch(e){case"compositionstart":var a=ir.compositionStart;break e;case"compositionend":a=ir.compositionEnd;break e;case"compositionupdate":a=ir.compositionUpdate;break e}a=void 0}else cr?ur(e,n)&&(a=ir.compositionEnd):"keydown"===e&&229===n.keyCode&&(a=ir.compositionStart);return a?(or&&"ko"!==n.locale&&(cr||a!==ir.compositionStart?a===ir.compositionEnd&&cr&&(o=Hn()):(qn="value"in(Bn=r)?Bn.value:Bn.textContent,cr=!0)),a=Zn.getPooled(a,t,n,r),o?a.data=o:null!==(o=sr(n))&&(a.data=o),$n(a),o=a):o=null,(e=rr?function(e,t){switch(e){case"compositionend":return sr(t);case"keypress":return 32!==t.which?null:(lr=!0,ar);case"textInput":return(e=t.data)===ar&&lr?null:e;default:return null}}(e,n):function(e,t){if(cr)return"compositionend"===e||!tr&&ur(e,t)?(e=Hn(),Gn=qn=Bn=null,cr=!1,e):null;switch(e){case"paste":return null;case"keypress":if(!(t.ctrlKey||t.altKey||t.metaKey)||t.ctrlKey&&t.altKey){if(t.char&&1<t.char.length)return t.char;if(t.which)return String.fromCharCode(t.which)}return null;case"compositionend":return or&&"ko"!==t.locale?null:t.data;default:return null}}(e,n))?((t=Jn.getPooled(ir.beforeInput,t,n,r)).data=e,$n(t)):t=null,null===o?t:null===t?o:[o,t]}},fr={color:!0,date:!0,datetime:!0,"datetime-local":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function pr(e){var t=e&&e.nodeName&&e.nodeName.toLowerCase();return"input"===t?!!fr[e.type]:"textarea"===t}var mr={change:{phasedRegistrationNames:{bubbled:"onChange",captured:"onChangeCapture"},dependencies:"blur change click focus input keydown keyup selectionchange".split(" ")}};function hr(e,t,n){return(e=Qn.getPooled(mr.change,e,t,n)).type="change",N(n),$n(e),e}var gr=null,vr=null;function yr(e){ut(e)}function br(e){if(xe(In(e)))return e}function wr(e,t){if("change"===e)return t}var xr=!1;function kr(){gr&&(gr.detachEvent("onpropertychange",Er),vr=gr=null)}function Er(e){if("value"===e.propertyName&&br(vr))if(e=hr(vr,e,st(e)),M)ut(e);else{M=!0;try{L(yr,e)}finally{M=!1,U()}}}function Sr(e,t,n){"focus"===e?(kr(),vr=n,(gr=t).attachEvent("onpropertychange",Er)):"blur"===e&&kr()}function Tr(e){if("selectionchange"===e||"keyup"===e||"keydown"===e)return br(vr)}function _r(e,t){if("click"===e)return br(t)}function Cr(e,t){if("input"===e||"change"===e)return br(t)}C&&(xr=ct("input")&&(!document.documentMode||9<document.documentMode));var Or={eventTypes:mr,_isInputEventSupported:xr,extractEvents:function(e,t,n,r){var o=t?In(t):window,a=o.nodeName&&o.nodeName.toLowerCase();if("select"===a||"input"===a&&"file"===o.type)var i=wr;else if(pr(o))if(xr)i=Cr;else{i=Tr;var l=Sr}else(a=o.nodeName)&&"input"===a.toLowerCase()&&("checkbox"===o.type||"radio"===o.type)&&(i=_r);if(i&&(i=i(e,t)))return hr(i,n,r);l&&l(e,o,t),"blur"===e&&(e=o._wrapperState)&&e.controlled&&"number"===o.type&&Ce(o,"number",o.value)}},Pr=Qn.extend({view:null,detail:null}),Rr={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function Ar(e){var t=this.nativeEvent;return t.getModifierState?t.getModifierState(e):!!(e=Rr[e])&&!!t[e]}function Nr(){return Ar}var Ir=0,Lr=0,Dr=!1,jr=!1,Fr=Pr.extend({screenX:null,screenY:null,clientX:null,clientY:null,pageX:null,pageY:null,ctrlKey:null,shiftKey:null,altKey:null,metaKey:null,getModifierState:Nr,button:null,buttons:null,relatedTarget:function(e){return e.relatedTarget||(e.fromElement===e.srcElement?e.toElement:e.fromElement)},movementX:function(e){if("movementX"in e)return e.movementX;var t=Ir;return Ir=e.screenX,Dr?"mousemove"===e.type?e.screenX-t:0:(Dr=!0,0)},movementY:function(e){if("movementY"in e)return e.movementY;var t=Lr;return Lr=e.screenY,jr?"mousemove"===e.type?e.screenY-t:0:(jr=!0,0)}}),Mr=Fr.extend({pointerId:null,width:null,height:null,pressure:null,tangentialPressure:null,tiltX:null,tiltY:null,twist:null,pointerType:null,isPrimary:null}),zr={mouseEnter:{registrationName:"onMouseEnter",dependencies:["mouseout","mouseover"]},mouseLeave:{registrationName:"onMouseLeave",dependencies:["mouseout","mouseover"]},pointerEnter:{registrationName:"onPointerEnter",dependencies:["pointerout","pointerover"]},pointerLeave:{registrationName:"onPointerLeave",dependencies:["pointerout","pointerover"]}},Ur={eventTypes:zr,extractEvents:function(e,t,n,r,o){var a="mouseover"===e||"pointerover"===e,i="mouseout"===e||"pointerout"===e;if(a&&0==(32&o)&&(n.relatedTarget||n.fromElement)||!i&&!a)return null;(a=r.window===r?r:(a=r.ownerDocument)?a.defaultView||a.parentWindow:window,i)?(i=t,null!==(t=(t=n.relatedTarget||n.toElement)?An(t):null)&&(t!==et(t)||5!==t.tag&&6!==t.tag)&&(t=null)):i=null;if(i===t)return null;if("mouseout"===e||"mouseover"===e)var l=Fr,u=zr.mouseLeave,s=zr.mouseEnter,c="mouse";else"pointerout"!==e&&"pointerover"!==e||(l=Mr,u=zr.pointerLeave,s=zr.pointerEnter,c="pointer");if(e=null==i?a:In(i),a=null==t?a:In(t),(u=l.getPooled(u,i,n,r)).type=c+"leave",u.target=e,u.relatedTarget=a,(n=l.getPooled(s,t,n,r)).type=c+"enter",n.target=a,n.relatedTarget=e,c=t,(r=i)&&c)e:{for(s=c,i=0,e=l=r;e;e=Dn(e))i++;for(e=0,t=s;t;t=Dn(t))e++;for(;0<i-e;)l=Dn(l),i--;for(;0<e-i;)s=Dn(s),e--;for(;i--;){if(l===s||l===s.alternate)break e;l=Dn(l),s=Dn(s)}l=null}else l=null;for(s=l,l=[];r&&r!==s&&(null===(i=r.alternate)||i!==s);)l.push(r),r=Dn(r);for(r=[];c&&c!==s&&(null===(i=c.alternate)||i!==s);)r.push(c),c=Dn(c);for(c=0;c<l.length;c++)zn(l[c],"bubbled",u);for(c=r.length;0<c--;)zn(r[c],"captured",n);return 0==(64&o)?[u]:[u,n]}};var $r="function"==typeof Object.is?Object.is:function(e,t){return e===t&&(0!==e||1/e==1/t)||e!=e&&t!=t},Br=Object.prototype.hasOwnProperty;function qr(e,t){if($r(e,t))return!0;if("object"!=typeof e||null===e||"object"!=typeof t||null===t)return!1;var n=Object.keys(e),r=Object.keys(t);if(n.length!==r.length)return!1;for(r=0;r<n.length;r++)if(!Br.call(t,n[r])||!$r(e[n[r]],t[n[r]]))return!1;return!0}var Gr=C&&"documentMode"in document&&11>=document.documentMode,Hr={select:{phasedRegistrationNames:{bubbled:"onSelect",captured:"onSelectCapture"},dependencies:"blur contextmenu dragend focus keydown keyup mousedown mouseup selectionchange".split(" ")}},Vr=null,Wr=null,Qr=null,Kr=!1;function Xr(e,t){var n=t.window===t?t.document:9===t.nodeType?t:t.ownerDocument;return Kr||null==Vr||Vr!==dn(n)?null:("selectionStart"in(n=Vr)&&gn(n)?n={start:n.selectionStart,end:n.selectionEnd}:n={anchorNode:(n=(n.ownerDocument&&n.ownerDocument.defaultView||window).getSelection()).anchorNode,anchorOffset:n.anchorOffset,focusNode:n.focusNode,focusOffset:n.focusOffset},Qr&&qr(Qr,n)?null:(Qr=n,(e=Qn.getPooled(Hr.select,Wr,e,t)).type="select",e.target=Vr,$n(e),e))}var Yr={eventTypes:Hr,extractEvents:function(e,t,n,r,o,a){if(!(a=!(o=a||(r.window===r?r.document:9===r.nodeType?r:r.ownerDocument)))){e:{o=Je(o),a=T.onSelect;for(var i=0;i<a.length;i++)if(!o.has(a[i])){o=!1;break e}o=!0}a=!o}if(a)return null;switch(o=t?In(t):window,e){case"focus":(pr(o)||"true"===o.contentEditable)&&(Vr=o,Wr=t,Qr=null);break;case"blur":Qr=Wr=Vr=null;break;case"mousedown":Kr=!0;break;case"contextmenu":case"mouseup":case"dragend":return Kr=!1,Xr(n,r);case"selectionchange":if(Gr)break;case"keydown":case"keyup":return Xr(n,r)}return null}},Zr=Qn.extend({animationName:null,elapsedTime:null,pseudoElement:null}),Jr=Qn.extend({clipboardData:function(e){return"clipboardData"in e?e.clipboardData:window.clipboardData}}),eo=Pr.extend({relatedTarget:null});function to(e){var t=e.keyCode;return"charCode"in e?0===(e=e.charCode)&&13===t&&(e=13):e=t,10===e&&(e=13),32<=e||13===e?e:0}var no={Esc:"Escape",Spacebar:" ",Left:"ArrowLeft",Up:"ArrowUp",Right:"ArrowRight",Down:"ArrowDown",Del:"Delete",Win:"OS",Menu:"ContextMenu",Apps:"ContextMenu",Scroll:"ScrollLock",MozPrintableKey:"Unidentified"},ro={8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",45:"Insert",46:"Delete",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",120:"F9",121:"F10",122:"F11",123:"F12",144:"NumLock",145:"ScrollLock",224:"Meta"},oo=Pr.extend({key:function(e){if(e.key){var t=no[e.key]||e.key;if("Unidentified"!==t)return t}return"keypress"===e.type?13===(e=to(e))?"Enter":String.fromCharCode(e):"keydown"===e.type||"keyup"===e.type?ro[e.keyCode]||"Unidentified":""},location:null,ctrlKey:null,shiftKey:null,altKey:null,metaKey:null,repeat:null,locale:null,getModifierState:Nr,charCode:function(e){return"keypress"===e.type?to(e):0},keyCode:function(e){return"keydown"===e.type||"keyup"===e.type?e.keyCode:0},which:function(e){return"keypress"===e.type?to(e):"keydown"===e.type||"keyup"===e.type?e.keyCode:0}}),ao=Fr.extend({dataTransfer:null}),io=Pr.extend({touches:null,targetTouches:null,changedTouches:null,altKey:null,metaKey:null,ctrlKey:null,shiftKey:null,getModifierState:Nr}),lo=Qn.extend({propertyName:null,elapsedTime:null,pseudoElement:null}),uo=Fr.extend({deltaX:function(e){return"deltaX"in e?e.deltaX:"wheelDeltaX"in e?-e.wheelDeltaX:0},deltaY:function(e){return"deltaY"in e?e.deltaY:"wheelDeltaY"in e?-e.wheelDeltaY:"wheelDelta"in e?-e.wheelDelta:0},deltaZ:null,deltaMode:null}),so={eventTypes:Mt,extractEvents:function(e,t,n,r){var o=zt.get(e);if(!o)return null;switch(e){case"keypress":if(0===to(n))return null;case"keydown":case"keyup":e=oo;break;case"blur":case"focus":e=eo;break;case"click":if(2===n.button)return null;case"auxclick":case"dblclick":case"mousedown":case"mousemove":case"mouseup":case"mouseout":case"mouseover":case"contextmenu":e=Fr;break;case"drag":case"dragend":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"dragstart":case"drop":e=ao;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":e=io;break;case We:case Qe:case Ke:e=Zr;break;case Xe:e=lo;break;case"scroll":e=Pr;break;case"wheel":e=uo;break;case"copy":case"cut":case"paste":e=Jr;break;case"gotpointercapture":case"lostpointercapture":case"pointercancel":case"pointerdown":case"pointermove":case"pointerout":case"pointerover":case"pointerup":e=Mr;break;default:e=Qn}return $n(t=e.getPooled(o,t,n,r)),t}};if(y)throw Error(i(101));y=Array.prototype.slice.call("ResponderEventPlugin SimpleEventPlugin EnterLeaveEventPlugin ChangeEventPlugin SelectEventPlugin BeforeInputEventPlugin".split(" ")),w(),m=Ln,h=Nn,g=In,_({SimpleEventPlugin:so,EnterLeaveEventPlugin:Ur,ChangeEventPlugin:Or,SelectEventPlugin:Yr,BeforeInputEventPlugin:dr});var co=[],fo=-1;function po(e){0>fo||(e.current=co[fo],co[fo]=null,fo--)}function mo(e,t){fo++,co[fo]=e.current,e.current=t}var ho={},go={current:ho},vo={current:!1},yo=ho;function bo(e,t){var n=e.type.contextTypes;if(!n)return ho;var r=e.stateNode;if(r&&r.__reactInternalMemoizedUnmaskedChildContext===t)return r.__reactInternalMemoizedMaskedChildContext;var o,a={};for(o in n)a[o]=t[o];return r&&((e=e.stateNode).__reactInternalMemoizedUnmaskedChildContext=t,e.__reactInternalMemoizedMaskedChildContext=a),a}function wo(e){return null!=(e=e.childContextTypes)}function xo(){po(vo),po(go)}function ko(e,t,n){if(go.current!==ho)throw Error(i(168));mo(go,t),mo(vo,n)}function Eo(e,t,n){var r=e.stateNode;if(e=t.childContextTypes,"function"!=typeof r.getChildContext)return n;for(var a in r=r.getChildContext())if(!(a in e))throw Error(i(108,ge(t)||"Unknown",a));return o({},n,{},r)}function So(e){return e=(e=e.stateNode)&&e.__reactInternalMemoizedMergedChildContext||ho,yo=go.current,mo(go,e),mo(vo,vo.current),!0}function To(e,t,n){var r=e.stateNode;if(!r)throw Error(i(169));n?(e=Eo(e,t,yo),r.__reactInternalMemoizedMergedChildContext=e,po(vo),po(go),mo(go,e)):po(vo),mo(vo,n)}var _o=a.unstable_runWithPriority,Co=a.unstable_scheduleCallback,Oo=a.unstable_cancelCallback,Po=a.unstable_requestPaint,Ro=a.unstable_now,Ao=a.unstable_getCurrentPriorityLevel,No=a.unstable_ImmediatePriority,Io=a.unstable_UserBlockingPriority,Lo=a.unstable_NormalPriority,Do=a.unstable_LowPriority,jo=a.unstable_IdlePriority,Fo={},Mo=a.unstable_shouldYield,zo=void 0!==Po?Po:function(){},Uo=null,$o=null,Bo=!1,qo=Ro(),Go=1e4>qo?Ro:function(){return Ro()-qo};function Ho(){switch(Ao()){case No:return 99;case Io:return 98;case Lo:return 97;case Do:return 96;case jo:return 95;default:throw Error(i(332))}}function Vo(e){switch(e){case 99:return No;case 98:return Io;case 97:return Lo;case 96:return Do;case 95:return jo;default:throw Error(i(332))}}function Wo(e,t){return e=Vo(e),_o(e,t)}function Qo(e,t,n){return e=Vo(e),Co(e,t,n)}function Ko(e){return null===Uo?(Uo=[e],$o=Co(No,Yo)):Uo.push(e),Fo}function Xo(){if(null!==$o){var e=$o;$o=null,Oo(e)}Yo()}function Yo(){if(!Bo&&null!==Uo){Bo=!0;var e=0;try{var t=Uo;Wo(99,(function(){for(;e<t.length;e++){var n=t[e];do{n=n(!0)}while(null!==n)}})),Uo=null}catch(n){throw null!==Uo&&(Uo=Uo.slice(e+1)),Co(No,Xo),n}finally{Bo=!1}}}function Zo(e,t,n){return 1073741821-(1+((1073741821-e+t/10)/(n/=10)|0))*n}function Jo(e,t){if(e&&e.defaultProps)for(var n in t=o({},t),e=e.defaultProps)void 0===t[n]&&(t[n]=e[n]);return t}var ea={current:null},ta=null,na=null,ra=null;function oa(){ra=na=ta=null}function aa(e){var t=ea.current;po(ea),e.type._context._currentValue=t}function ia(e,t){for(;null!==e;){var n=e.alternate;if(e.childExpirationTime<t)e.childExpirationTime=t,null!==n&&n.childExpirationTime<t&&(n.childExpirationTime=t);else{if(!(null!==n&&n.childExpirationTime<t))break;n.childExpirationTime=t}e=e.return}}function la(e,t){ta=e,ra=na=null,null!==(e=e.dependencies)&&null!==e.firstContext&&(e.expirationTime>=t&&(Li=!0),e.firstContext=null)}function ua(e,t){if(ra!==e&&!1!==t&&0!==t)if("number"==typeof t&&1073741823!==t||(ra=e,t=1073741823),t={context:e,observedBits:t,next:null},null===na){if(null===ta)throw Error(i(308));na=t,ta.dependencies={expirationTime:0,firstContext:t,responders:null}}else na=na.next=t;return e._currentValue}var sa=!1;function ca(e){e.updateQueue={baseState:e.memoizedState,baseQueue:null,shared:{pending:null},effects:null}}function da(e,t){e=e.updateQueue,t.updateQueue===e&&(t.updateQueue={baseState:e.baseState,baseQueue:e.baseQueue,shared:e.shared,effects:e.effects})}function fa(e,t){return(e={expirationTime:e,suspenseConfig:t,tag:0,payload:null,callback:null,next:null}).next=e}function pa(e,t){if(null!==(e=e.updateQueue)){var n=(e=e.shared).pending;null===n?t.next=t:(t.next=n.next,n.next=t),e.pending=t}}function ma(e,t){var n=e.alternate;null!==n&&da(n,e),null===(n=(e=e.updateQueue).baseQueue)?(e.baseQueue=t.next=t,t.next=t):(t.next=n.next,n.next=t)}function ha(e,t,n,r){var a=e.updateQueue;sa=!1;var i=a.baseQueue,l=a.shared.pending;if(null!==l){if(null!==i){var u=i.next;i.next=l.next,l.next=u}i=l,a.shared.pending=null,null!==(u=e.alternate)&&(null!==(u=u.updateQueue)&&(u.baseQueue=l))}if(null!==i){u=i.next;var s=a.baseState,c=0,d=null,f=null,p=null;if(null!==u)for(var m=u;;){if((l=m.expirationTime)<r){var h={expirationTime:m.expirationTime,suspenseConfig:m.suspenseConfig,tag:m.tag,payload:m.payload,callback:m.callback,next:null};null===p?(f=p=h,d=s):p=p.next=h,l>c&&(c=l)}else{null!==p&&(p=p.next={expirationTime:1073741823,suspenseConfig:m.suspenseConfig,tag:m.tag,payload:m.payload,callback:m.callback,next:null}),pu(l,m.suspenseConfig);e:{var g=e,v=m;switch(l=t,h=n,v.tag){case 1:if("function"==typeof(g=v.payload)){s=g.call(h,s,l);break e}s=g;break e;case 3:g.effectTag=-4097&g.effectTag|64;case 0:if(null==(l="function"==typeof(g=v.payload)?g.call(h,s,l):g))break e;s=o({},s,l);break e;case 2:sa=!0}}null!==m.callback&&(e.effectTag|=32,null===(l=a.effects)?a.effects=[m]:l.push(m))}if(null===(m=m.next)||m===u){if(null===(l=a.shared.pending))break;m=i.next=l.next,l.next=u,a.baseQueue=i=l,a.shared.pending=null}}null===p?d=s:p.next=f,a.baseState=d,a.baseQueue=p,mu(c),e.expirationTime=c,e.memoizedState=s}}function ga(e,t,n){if(e=t.effects,t.effects=null,null!==e)for(t=0;t<e.length;t++){var r=e[t],o=r.callback;if(null!==o){if(r.callback=null,r=o,o=n,"function"!=typeof r)throw Error(i(191,r));r.call(o)}}}var va=X.ReactCurrentBatchConfig,ya=(new r.Component).refs;function ba(e,t,n,r){n=null==(n=n(r,t=e.memoizedState))?t:o({},t,n),e.memoizedState=n,0===e.expirationTime&&(e.updateQueue.baseState=n)}var wa={isMounted:function(e){return!!(e=e._reactInternalFiber)&&et(e)===e},enqueueSetState:function(e,t,n){e=e._reactInternalFiber;var r=eu(),o=va.suspense;(o=fa(r=tu(r,e,o),o)).payload=t,null!=n&&(o.callback=n),pa(e,o),nu(e,r)},enqueueReplaceState:function(e,t,n){e=e._reactInternalFiber;var r=eu(),o=va.suspense;(o=fa(r=tu(r,e,o),o)).tag=1,o.payload=t,null!=n&&(o.callback=n),pa(e,o),nu(e,r)},enqueueForceUpdate:function(e,t){e=e._reactInternalFiber;var n=eu(),r=va.suspense;(r=fa(n=tu(n,e,r),r)).tag=2,null!=t&&(r.callback=t),pa(e,r),nu(e,n)}};function xa(e,t,n,r,o,a,i){return"function"==typeof(e=e.stateNode).shouldComponentUpdate?e.shouldComponentUpdate(r,a,i):!t.prototype||!t.prototype.isPureReactComponent||(!qr(n,r)||!qr(o,a))}function ka(e,t,n){var r=!1,o=ho,a=t.contextType;return"object"==typeof a&&null!==a?a=ua(a):(o=wo(t)?yo:go.current,a=(r=null!=(r=t.contextTypes))?bo(e,o):ho),t=new t(n,a),e.memoizedState=null!==t.state&&void 0!==t.state?t.state:null,t.updater=wa,e.stateNode=t,t._reactInternalFiber=e,r&&((e=e.stateNode).__reactInternalMemoizedUnmaskedChildContext=o,e.__reactInternalMemoizedMaskedChildContext=a),t}function Ea(e,t,n,r){e=t.state,"function"==typeof t.componentWillReceiveProps&&t.componentWillReceiveProps(n,r),"function"==typeof t.UNSAFE_componentWillReceiveProps&&t.UNSAFE_componentWillReceiveProps(n,r),t.state!==e&&wa.enqueueReplaceState(t,t.state,null)}function Sa(e,t,n,r){var o=e.stateNode;o.props=n,o.state=e.memoizedState,o.refs=ya,ca(e);var a=t.contextType;"object"==typeof a&&null!==a?o.context=ua(a):(a=wo(t)?yo:go.current,o.context=bo(e,a)),ha(e,n,o,r),o.state=e.memoizedState,"function"==typeof(a=t.getDerivedStateFromProps)&&(ba(e,t,a,n),o.state=e.memoizedState),"function"==typeof t.getDerivedStateFromProps||"function"==typeof o.getSnapshotBeforeUpdate||"function"!=typeof o.UNSAFE_componentWillMount&&"function"!=typeof o.componentWillMount||(t=o.state,"function"==typeof o.componentWillMount&&o.componentWillMount(),"function"==typeof o.UNSAFE_componentWillMount&&o.UNSAFE_componentWillMount(),t!==o.state&&wa.enqueueReplaceState(o,o.state,null),ha(e,n,o,r),o.state=e.memoizedState),"function"==typeof o.componentDidMount&&(e.effectTag|=4)}var Ta=Array.isArray;function _a(e,t,n){if(null!==(e=n.ref)&&"function"!=typeof e&&"object"!=typeof e){if(n._owner){if(n=n._owner){if(1!==n.tag)throw Error(i(309));var r=n.stateNode}if(!r)throw Error(i(147,e));var o=""+e;return null!==t&&null!==t.ref&&"function"==typeof t.ref&&t.ref._stringRef===o?t.ref:((t=function(e){var t=r.refs;t===ya&&(t=r.refs={}),null===e?delete t[o]:t[o]=e})._stringRef=o,t)}if("string"!=typeof e)throw Error(i(284));if(!n._owner)throw Error(i(290,e))}return e}function Ca(e,t){if("textarea"!==e.type)throw Error(i(31,"[object Object]"===Object.prototype.toString.call(t)?"object with keys {"+Object.keys(t).join(", ")+"}":t,""))}function Oa(e){function t(t,n){if(e){var r=t.lastEffect;null!==r?(r.nextEffect=n,t.lastEffect=n):t.firstEffect=t.lastEffect=n,n.nextEffect=null,n.effectTag=8}}function n(n,r){if(!e)return null;for(;null!==r;)t(n,r),r=r.sibling;return null}function r(e,t){for(e=new Map;null!==t;)null!==t.key?e.set(t.key,t):e.set(t.index,t),t=t.sibling;return e}function o(e,t){return(e=Lu(e,t)).index=0,e.sibling=null,e}function a(t,n,r){return t.index=r,e?null!==(r=t.alternate)?(r=r.index)<n?(t.effectTag=2,n):r:(t.effectTag=2,n):n}function l(t){return e&&null===t.alternate&&(t.effectTag=2),t}function u(e,t,n,r){return null===t||6!==t.tag?((t=Fu(n,e.mode,r)).return=e,t):((t=o(t,n)).return=e,t)}function s(e,t,n,r){return null!==t&&t.elementType===n.type?((r=o(t,n.props)).ref=_a(e,t,n),r.return=e,r):((r=Du(n.type,n.key,n.props,null,e.mode,r)).ref=_a(e,t,n),r.return=e,r)}function c(e,t,n,r){return null===t||4!==t.tag||t.stateNode.containerInfo!==n.containerInfo||t.stateNode.implementation!==n.implementation?((t=Mu(n,e.mode,r)).return=e,t):((t=o(t,n.children||[])).return=e,t)}function d(e,t,n,r,a){return null===t||7!==t.tag?((t=ju(n,e.mode,r,a)).return=e,t):((t=o(t,n)).return=e,t)}function f(e,t,n){if("string"==typeof t||"number"==typeof t)return(t=Fu(""+t,e.mode,n)).return=e,t;if("object"==typeof t&&null!==t){switch(t.$$typeof){case ee:return(n=Du(t.type,t.key,t.props,null,e.mode,n)).ref=_a(e,null,t),n.return=e,n;case te:return(t=Mu(t,e.mode,n)).return=e,t}if(Ta(t)||he(t))return(t=ju(t,e.mode,n,null)).return=e,t;Ca(e,t)}return null}function p(e,t,n,r){var o=null!==t?t.key:null;if("string"==typeof n||"number"==typeof n)return null!==o?null:u(e,t,""+n,r);if("object"==typeof n&&null!==n){switch(n.$$typeof){case ee:return n.key===o?n.type===ne?d(e,t,n.props.children,r,o):s(e,t,n,r):null;case te:return n.key===o?c(e,t,n,r):null}if(Ta(n)||he(n))return null!==o?null:d(e,t,n,r,null);Ca(e,n)}return null}function m(e,t,n,r,o){if("string"==typeof r||"number"==typeof r)return u(t,e=e.get(n)||null,""+r,o);if("object"==typeof r&&null!==r){switch(r.$$typeof){case ee:return e=e.get(null===r.key?n:r.key)||null,r.type===ne?d(t,e,r.props.children,o,r.key):s(t,e,r,o);case te:return c(t,e=e.get(null===r.key?n:r.key)||null,r,o)}if(Ta(r)||he(r))return d(t,e=e.get(n)||null,r,o,null);Ca(t,r)}return null}function h(o,i,l,u){for(var s=null,c=null,d=i,h=i=0,g=null;null!==d&&h<l.length;h++){d.index>h?(g=d,d=null):g=d.sibling;var v=p(o,d,l[h],u);if(null===v){null===d&&(d=g);break}e&&d&&null===v.alternate&&t(o,d),i=a(v,i,h),null===c?s=v:c.sibling=v,c=v,d=g}if(h===l.length)return n(o,d),s;if(null===d){for(;h<l.length;h++)null!==(d=f(o,l[h],u))&&(i=a(d,i,h),null===c?s=d:c.sibling=d,c=d);return s}for(d=r(o,d);h<l.length;h++)null!==(g=m(d,o,h,l[h],u))&&(e&&null!==g.alternate&&d.delete(null===g.key?h:g.key),i=a(g,i,h),null===c?s=g:c.sibling=g,c=g);return e&&d.forEach((function(e){return t(o,e)})),s}function g(o,l,u,s){var c=he(u);if("function"!=typeof c)throw Error(i(150));if(null==(u=c.call(u)))throw Error(i(151));for(var d=c=null,h=l,g=l=0,v=null,y=u.next();null!==h&&!y.done;g++,y=u.next()){h.index>g?(v=h,h=null):v=h.sibling;var b=p(o,h,y.value,s);if(null===b){null===h&&(h=v);break}e&&h&&null===b.alternate&&t(o,h),l=a(b,l,g),null===d?c=b:d.sibling=b,d=b,h=v}if(y.done)return n(o,h),c;if(null===h){for(;!y.done;g++,y=u.next())null!==(y=f(o,y.value,s))&&(l=a(y,l,g),null===d?c=y:d.sibling=y,d=y);return c}for(h=r(o,h);!y.done;g++,y=u.next())null!==(y=m(h,o,g,y.value,s))&&(e&&null!==y.alternate&&h.delete(null===y.key?g:y.key),l=a(y,l,g),null===d?c=y:d.sibling=y,d=y);return e&&h.forEach((function(e){return t(o,e)})),c}return function(e,r,a,u){var s="object"==typeof a&&null!==a&&a.type===ne&&null===a.key;s&&(a=a.props.children);var c="object"==typeof a&&null!==a;if(c)switch(a.$$typeof){case ee:e:{for(c=a.key,s=r;null!==s;){if(s.key===c){switch(s.tag){case 7:if(a.type===ne){n(e,s.sibling),(r=o(s,a.props.children)).return=e,e=r;break e}break;default:if(s.elementType===a.type){n(e,s.sibling),(r=o(s,a.props)).ref=_a(e,s,a),r.return=e,e=r;break e}}n(e,s);break}t(e,s),s=s.sibling}a.type===ne?((r=ju(a.props.children,e.mode,u,a.key)).return=e,e=r):((u=Du(a.type,a.key,a.props,null,e.mode,u)).ref=_a(e,r,a),u.return=e,e=u)}return l(e);case te:e:{for(s=a.key;null!==r;){if(r.key===s){if(4===r.tag&&r.stateNode.containerInfo===a.containerInfo&&r.stateNode.implementation===a.implementation){n(e,r.sibling),(r=o(r,a.children||[])).return=e,e=r;break e}n(e,r);break}t(e,r),r=r.sibling}(r=Mu(a,e.mode,u)).return=e,e=r}return l(e)}if("string"==typeof a||"number"==typeof a)return a=""+a,null!==r&&6===r.tag?(n(e,r.sibling),(r=o(r,a)).return=e,e=r):(n(e,r),(r=Fu(a,e.mode,u)).return=e,e=r),l(e);if(Ta(a))return h(e,r,a,u);if(he(a))return g(e,r,a,u);if(c&&Ca(e,a),void 0===a&&!s)switch(e.tag){case 1:case 0:throw e=e.type,Error(i(152,e.displayName||e.name||"Component"))}return n(e,r)}}var Pa=Oa(!0),Ra=Oa(!1),Aa={},Na={current:Aa},Ia={current:Aa},La={current:Aa};function Da(e){if(e===Aa)throw Error(i(174));return e}function ja(e,t){switch(mo(La,t),mo(Ia,e),mo(Na,Aa),e=t.nodeType){case 9:case 11:t=(t=t.documentElement)?t.namespaceURI:Fe(null,"");break;default:t=Fe(t=(e=8===e?t.parentNode:t).namespaceURI||null,e=e.tagName)}po(Na),mo(Na,t)}function Fa(){po(Na),po(Ia),po(La)}function Ma(e){Da(La.current);var t=Da(Na.current),n=Fe(t,e.type);t!==n&&(mo(Ia,e),mo(Na,n))}function za(e){Ia.current===e&&(po(Na),po(Ia))}var Ua={current:0};function $a(e){for(var t=e;null!==t;){if(13===t.tag){var n=t.memoizedState;if(null!==n&&(null===(n=n.dehydrated)||n.data===vn||n.data===yn))return t}else if(19===t.tag&&void 0!==t.memoizedProps.revealOrder){if(0!=(64&t.effectTag))return t}else if(null!==t.child){t.child.return=t,t=t.child;continue}if(t===e)break;for(;null===t.sibling;){if(null===t.return||t.return===e)return null;t=t.return}t.sibling.return=t.return,t=t.sibling}return null}function Ba(e,t){return{responder:e,props:t}}var qa=X.ReactCurrentDispatcher,Ga=X.ReactCurrentBatchConfig,Ha=0,Va=null,Wa=null,Qa=null,Ka=!1;function Xa(){throw Error(i(321))}function Ya(e,t){if(null===t)return!1;for(var n=0;n<t.length&&n<e.length;n++)if(!$r(e[n],t[n]))return!1;return!0}function Za(e,t,n,r,o,a){if(Ha=a,Va=t,t.memoizedState=null,t.updateQueue=null,t.expirationTime=0,qa.current=null===e||null===e.memoizedState?xi:ki,e=n(r,o),t.expirationTime===Ha){a=0;do{if(t.expirationTime=0,!(25>a))throw Error(i(301));a+=1,Qa=Wa=null,t.updateQueue=null,qa.current=Ei,e=n(r,o)}while(t.expirationTime===Ha)}if(qa.current=wi,t=null!==Wa&&null!==Wa.next,Ha=0,Qa=Wa=Va=null,Ka=!1,t)throw Error(i(300));return e}function Ja(){var e={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};return null===Qa?Va.memoizedState=Qa=e:Qa=Qa.next=e,Qa}function ei(){if(null===Wa){var e=Va.alternate;e=null!==e?e.memoizedState:null}else e=Wa.next;var t=null===Qa?Va.memoizedState:Qa.next;if(null!==t)Qa=t,Wa=e;else{if(null===e)throw Error(i(310));e={memoizedState:(Wa=e).memoizedState,baseState:Wa.baseState,baseQueue:Wa.baseQueue,queue:Wa.queue,next:null},null===Qa?Va.memoizedState=Qa=e:Qa=Qa.next=e}return Qa}function ti(e,t){return"function"==typeof t?t(e):t}function ni(e){var t=ei(),n=t.queue;if(null===n)throw Error(i(311));n.lastRenderedReducer=e;var r=Wa,o=r.baseQueue,a=n.pending;if(null!==a){if(null!==o){var l=o.next;o.next=a.next,a.next=l}r.baseQueue=o=a,n.pending=null}if(null!==o){o=o.next,r=r.baseState;var u=l=a=null,s=o;do{var c=s.expirationTime;if(c<Ha){var d={expirationTime:s.expirationTime,suspenseConfig:s.suspenseConfig,action:s.action,eagerReducer:s.eagerReducer,eagerState:s.eagerState,next:null};null===u?(l=u=d,a=r):u=u.next=d,c>Va.expirationTime&&(Va.expirationTime=c,mu(c))}else null!==u&&(u=u.next={expirationTime:1073741823,suspenseConfig:s.suspenseConfig,action:s.action,eagerReducer:s.eagerReducer,eagerState:s.eagerState,next:null}),pu(c,s.suspenseConfig),r=s.eagerReducer===e?s.eagerState:e(r,s.action);s=s.next}while(null!==s&&s!==o);null===u?a=r:u.next=l,$r(r,t.memoizedState)||(Li=!0),t.memoizedState=r,t.baseState=a,t.baseQueue=u,n.lastRenderedState=r}return[t.memoizedState,n.dispatch]}function ri(e){var t=ei(),n=t.queue;if(null===n)throw Error(i(311));n.lastRenderedReducer=e;var r=n.dispatch,o=n.pending,a=t.memoizedState;if(null!==o){n.pending=null;var l=o=o.next;do{a=e(a,l.action),l=l.next}while(l!==o);$r(a,t.memoizedState)||(Li=!0),t.memoizedState=a,null===t.baseQueue&&(t.baseState=a),n.lastRenderedState=a}return[a,r]}function oi(e){var t=Ja();return"function"==typeof e&&(e=e()),t.memoizedState=t.baseState=e,e=(e=t.queue={pending:null,dispatch:null,lastRenderedReducer:ti,lastRenderedState:e}).dispatch=bi.bind(null,Va,e),[t.memoizedState,e]}function ai(e,t,n,r){return e={tag:e,create:t,destroy:n,deps:r,next:null},null===(t=Va.updateQueue)?(t={lastEffect:null},Va.updateQueue=t,t.lastEffect=e.next=e):null===(n=t.lastEffect)?t.lastEffect=e.next=e:(r=n.next,n.next=e,e.next=r,t.lastEffect=e),e}function ii(){return ei().memoizedState}function li(e,t,n,r){var o=Ja();Va.effectTag|=e,o.memoizedState=ai(1|t,n,void 0,void 0===r?null:r)}function ui(e,t,n,r){var o=ei();r=void 0===r?null:r;var a=void 0;if(null!==Wa){var i=Wa.memoizedState;if(a=i.destroy,null!==r&&Ya(r,i.deps))return void ai(t,n,a,r)}Va.effectTag|=e,o.memoizedState=ai(1|t,n,a,r)}function si(e,t){return li(516,4,e,t)}function ci(e,t){return ui(516,4,e,t)}function di(e,t){return ui(4,2,e,t)}function fi(e,t){return"function"==typeof t?(e=e(),t(e),function(){t(null)}):null!=t?(e=e(),t.current=e,function(){t.current=null}):void 0}function pi(e,t,n){return n=null!=n?n.concat([e]):null,ui(4,2,fi.bind(null,t,e),n)}function mi(){}function hi(e,t){return Ja().memoizedState=[e,void 0===t?null:t],e}function gi(e,t){var n=ei();t=void 0===t?null:t;var r=n.memoizedState;return null!==r&&null!==t&&Ya(t,r[1])?r[0]:(n.memoizedState=[e,t],e)}function vi(e,t){var n=ei();t=void 0===t?null:t;var r=n.memoizedState;return null!==r&&null!==t&&Ya(t,r[1])?r[0]:(e=e(),n.memoizedState=[e,t],e)}function yi(e,t,n){var r=Ho();Wo(98>r?98:r,(function(){e(!0)})),Wo(97<r?97:r,(function(){var r=Ga.suspense;Ga.suspense=void 0===t?null:t;try{e(!1),n()}finally{Ga.suspense=r}}))}function bi(e,t,n){var r=eu(),o=va.suspense;o={expirationTime:r=tu(r,e,o),suspenseConfig:o,action:n,eagerReducer:null,eagerState:null,next:null};var a=t.pending;if(null===a?o.next=o:(o.next=a.next,a.next=o),t.pending=o,a=e.alternate,e===Va||null!==a&&a===Va)Ka=!0,o.expirationTime=Ha,Va.expirationTime=Ha;else{if(0===e.expirationTime&&(null===a||0===a.expirationTime)&&null!==(a=t.lastRenderedReducer))try{var i=t.lastRenderedState,l=a(i,n);if(o.eagerReducer=a,o.eagerState=l,$r(l,i))return}catch(u){}nu(e,r)}}var wi={readContext:ua,useCallback:Xa,useContext:Xa,useEffect:Xa,useImperativeHandle:Xa,useLayoutEffect:Xa,useMemo:Xa,useReducer:Xa,useRef:Xa,useState:Xa,useDebugValue:Xa,useResponder:Xa,useDeferredValue:Xa,useTransition:Xa},xi={readContext:ua,useCallback:hi,useContext:ua,useEffect:si,useImperativeHandle:function(e,t,n){return n=null!=n?n.concat([e]):null,li(4,2,fi.bind(null,t,e),n)},useLayoutEffect:function(e,t){return li(4,2,e,t)},useMemo:function(e,t){var n=Ja();return t=void 0===t?null:t,e=e(),n.memoizedState=[e,t],e},useReducer:function(e,t,n){var r=Ja();return t=void 0!==n?n(t):t,r.memoizedState=r.baseState=t,e=(e=r.queue={pending:null,dispatch:null,lastRenderedReducer:e,lastRenderedState:t}).dispatch=bi.bind(null,Va,e),[r.memoizedState,e]},useRef:function(e){return e={current:e},Ja().memoizedState=e},useState:oi,useDebugValue:mi,useResponder:Ba,useDeferredValue:function(e,t){var n=oi(e),r=n[0],o=n[1];return si((function(){var n=Ga.suspense;Ga.suspense=void 0===t?null:t;try{o(e)}finally{Ga.suspense=n}}),[e,t]),r},useTransition:function(e){var t=oi(!1),n=t[0];return t=t[1],[hi(yi.bind(null,t,e),[t,e]),n]}},ki={readContext:ua,useCallback:gi,useContext:ua,useEffect:ci,useImperativeHandle:pi,useLayoutEffect:di,useMemo:vi,useReducer:ni,useRef:ii,useState:function(){return ni(ti)},useDebugValue:mi,useResponder:Ba,useDeferredValue:function(e,t){var n=ni(ti),r=n[0],o=n[1];return ci((function(){var n=Ga.suspense;Ga.suspense=void 0===t?null:t;try{o(e)}finally{Ga.suspense=n}}),[e,t]),r},useTransition:function(e){var t=ni(ti),n=t[0];return t=t[1],[gi(yi.bind(null,t,e),[t,e]),n]}},Ei={readContext:ua,useCallback:gi,useContext:ua,useEffect:ci,useImperativeHandle:pi,useLayoutEffect:di,useMemo:vi,useReducer:ri,useRef:ii,useState:function(){return ri(ti)},useDebugValue:mi,useResponder:Ba,useDeferredValue:function(e,t){var n=ri(ti),r=n[0],o=n[1];return ci((function(){var n=Ga.suspense;Ga.suspense=void 0===t?null:t;try{o(e)}finally{Ga.suspense=n}}),[e,t]),r},useTransition:function(e){var t=ri(ti),n=t[0];return t=t[1],[gi(yi.bind(null,t,e),[t,e]),n]}},Si=null,Ti=null,_i=!1;function Ci(e,t){var n=Nu(5,null,null,0);n.elementType="DELETED",n.type="DELETED",n.stateNode=t,n.return=e,n.effectTag=8,null!==e.lastEffect?(e.lastEffect.nextEffect=n,e.lastEffect=n):e.firstEffect=e.lastEffect=n}function Oi(e,t){switch(e.tag){case 5:var n=e.type;return null!==(t=1!==t.nodeType||n.toLowerCase()!==t.nodeName.toLowerCase()?null:t)&&(e.stateNode=t,!0);case 6:return null!==(t=""===e.pendingProps||3!==t.nodeType?null:t)&&(e.stateNode=t,!0);case 13:default:return!1}}function Pi(e){if(_i){var t=Ti;if(t){var n=t;if(!Oi(e,t)){if(!(t=Tn(n.nextSibling))||!Oi(e,t))return e.effectTag=-1025&e.effectTag|2,_i=!1,void(Si=e);Ci(Si,n)}Si=e,Ti=Tn(t.firstChild)}else e.effectTag=-1025&e.effectTag|2,_i=!1,Si=e}}function Ri(e){for(e=e.return;null!==e&&5!==e.tag&&3!==e.tag&&13!==e.tag;)e=e.return;Si=e}function Ai(e){if(e!==Si)return!1;if(!_i)return Ri(e),_i=!0,!1;var t=e.type;if(5!==e.tag||"head"!==t&&"body"!==t&&!kn(t,e.memoizedProps))for(t=Ti;t;)Ci(e,t),t=Tn(t.nextSibling);if(Ri(e),13===e.tag){if(!(e=null!==(e=e.memoizedState)?e.dehydrated:null))throw Error(i(317));e:{for(e=e.nextSibling,t=0;e;){if(8===e.nodeType){var n=e.data;if("/$"===n){if(0===t){Ti=Tn(e.nextSibling);break e}t--}else"$"!==n&&n!==yn&&n!==vn||t++}e=e.nextSibling}Ti=null}}else Ti=Si?Tn(e.stateNode.nextSibling):null;return!0}function Ni(){Ti=Si=null,_i=!1}var Ii=X.ReactCurrentOwner,Li=!1;function Di(e,t,n,r){t.child=null===e?Ra(t,null,n,r):Pa(t,e.child,n,r)}function ji(e,t,n,r,o){n=n.render;var a=t.ref;return la(t,o),r=Za(e,t,n,r,a,o),null===e||Li?(t.effectTag|=1,Di(e,t,r,o),t.child):(t.updateQueue=e.updateQueue,t.effectTag&=-517,e.expirationTime<=o&&(e.expirationTime=0),Zi(e,t,o))}function Fi(e,t,n,r,o,a){if(null===e){var i=n.type;return"function"!=typeof i||Iu(i)||void 0!==i.defaultProps||null!==n.compare||void 0!==n.defaultProps?((e=Du(n.type,null,r,null,t.mode,a)).ref=t.ref,e.return=t,t.child=e):(t.tag=15,t.type=i,Mi(e,t,i,r,o,a))}return i=e.child,o<a&&(o=i.memoizedProps,(n=null!==(n=n.compare)?n:qr)(o,r)&&e.ref===t.ref)?Zi(e,t,a):(t.effectTag|=1,(e=Lu(i,r)).ref=t.ref,e.return=t,t.child=e)}function Mi(e,t,n,r,o,a){return null!==e&&qr(e.memoizedProps,r)&&e.ref===t.ref&&(Li=!1,o<a)?(t.expirationTime=e.expirationTime,Zi(e,t,a)):Ui(e,t,n,r,a)}function zi(e,t){var n=t.ref;(null===e&&null!==n||null!==e&&e.ref!==n)&&(t.effectTag|=128)}function Ui(e,t,n,r,o){var a=wo(n)?yo:go.current;return a=bo(t,a),la(t,o),n=Za(e,t,n,r,a,o),null===e||Li?(t.effectTag|=1,Di(e,t,n,o),t.child):(t.updateQueue=e.updateQueue,t.effectTag&=-517,e.expirationTime<=o&&(e.expirationTime=0),Zi(e,t,o))}function $i(e,t,n,r,o){if(wo(n)){var a=!0;So(t)}else a=!1;if(la(t,o),null===t.stateNode)null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),ka(t,n,r),Sa(t,n,r,o),r=!0;else if(null===e){var i=t.stateNode,l=t.memoizedProps;i.props=l;var u=i.context,s=n.contextType;"object"==typeof s&&null!==s?s=ua(s):s=bo(t,s=wo(n)?yo:go.current);var c=n.getDerivedStateFromProps,d="function"==typeof c||"function"==typeof i.getSnapshotBeforeUpdate;d||"function"!=typeof i.UNSAFE_componentWillReceiveProps&&"function"!=typeof i.componentWillReceiveProps||(l!==r||u!==s)&&Ea(t,i,r,s),sa=!1;var f=t.memoizedState;i.state=f,ha(t,r,i,o),u=t.memoizedState,l!==r||f!==u||vo.current||sa?("function"==typeof c&&(ba(t,n,c,r),u=t.memoizedState),(l=sa||xa(t,n,l,r,f,u,s))?(d||"function"!=typeof i.UNSAFE_componentWillMount&&"function"!=typeof i.componentWillMount||("function"==typeof i.componentWillMount&&i.componentWillMount(),"function"==typeof i.UNSAFE_componentWillMount&&i.UNSAFE_componentWillMount()),"function"==typeof i.componentDidMount&&(t.effectTag|=4)):("function"==typeof i.componentDidMount&&(t.effectTag|=4),t.memoizedProps=r,t.memoizedState=u),i.props=r,i.state=u,i.context=s,r=l):("function"==typeof i.componentDidMount&&(t.effectTag|=4),r=!1)}else i=t.stateNode,da(e,t),l=t.memoizedProps,i.props=t.type===t.elementType?l:Jo(t.type,l),u=i.context,"object"==typeof(s=n.contextType)&&null!==s?s=ua(s):s=bo(t,s=wo(n)?yo:go.current),(d="function"==typeof(c=n.getDerivedStateFromProps)||"function"==typeof i.getSnapshotBeforeUpdate)||"function"!=typeof i.UNSAFE_componentWillReceiveProps&&"function"!=typeof i.componentWillReceiveProps||(l!==r||u!==s)&&Ea(t,i,r,s),sa=!1,u=t.memoizedState,i.state=u,ha(t,r,i,o),f=t.memoizedState,l!==r||u!==f||vo.current||sa?("function"==typeof c&&(ba(t,n,c,r),f=t.memoizedState),(c=sa||xa(t,n,l,r,u,f,s))?(d||"function"!=typeof i.UNSAFE_componentWillUpdate&&"function"!=typeof i.componentWillUpdate||("function"==typeof i.componentWillUpdate&&i.componentWillUpdate(r,f,s),"function"==typeof i.UNSAFE_componentWillUpdate&&i.UNSAFE_componentWillUpdate(r,f,s)),"function"==typeof i.componentDidUpdate&&(t.effectTag|=4),"function"==typeof i.getSnapshotBeforeUpdate&&(t.effectTag|=256)):("function"!=typeof i.componentDidUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=4),"function"!=typeof i.getSnapshotBeforeUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=256),t.memoizedProps=r,t.memoizedState=f),i.props=r,i.state=f,i.context=s,r=c):("function"!=typeof i.componentDidUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=4),"function"!=typeof i.getSnapshotBeforeUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=256),r=!1);return Bi(e,t,n,r,a,o)}function Bi(e,t,n,r,o,a){zi(e,t);var i=0!=(64&t.effectTag);if(!r&&!i)return o&&To(t,n,!1),Zi(e,t,a);r=t.stateNode,Ii.current=t;var l=i&&"function"!=typeof n.getDerivedStateFromError?null:r.render();return t.effectTag|=1,null!==e&&i?(t.child=Pa(t,e.child,null,a),t.child=Pa(t,null,l,a)):Di(e,t,l,a),t.memoizedState=r.state,o&&To(t,n,!0),t.child}function qi(e){var t=e.stateNode;t.pendingContext?ko(0,t.pendingContext,t.pendingContext!==t.context):t.context&&ko(0,t.context,!1),ja(e,t.containerInfo)}var Gi,Hi,Vi,Wi={dehydrated:null,retryTime:0};function Qi(e,t,n){var r,o=t.mode,a=t.pendingProps,i=Ua.current,l=!1;if((r=0!=(64&t.effectTag))||(r=0!=(2&i)&&(null===e||null!==e.memoizedState)),r?(l=!0,t.effectTag&=-65):null!==e&&null===e.memoizedState||void 0===a.fallback||!0===a.unstable_avoidThisFallback||(i|=1),mo(Ua,1&i),null===e){if(void 0!==a.fallback&&Pi(t),l){if(l=a.fallback,(a=ju(null,o,0,null)).return=t,0==(2&t.mode))for(e=null!==t.memoizedState?t.child.child:t.child,a.child=e;null!==e;)e.return=a,e=e.sibling;return(n=ju(l,o,n,null)).return=t,a.sibling=n,t.memoizedState=Wi,t.child=a,n}return o=a.children,t.memoizedState=null,t.child=Ra(t,null,o,n)}if(null!==e.memoizedState){if(o=(e=e.child).sibling,l){if(a=a.fallback,(n=Lu(e,e.pendingProps)).return=t,0==(2&t.mode)&&(l=null!==t.memoizedState?t.child.child:t.child)!==e.child)for(n.child=l;null!==l;)l.return=n,l=l.sibling;return(o=Lu(o,a)).return=t,n.sibling=o,n.childExpirationTime=0,t.memoizedState=Wi,t.child=n,o}return n=Pa(t,e.child,a.children,n),t.memoizedState=null,t.child=n}if(e=e.child,l){if(l=a.fallback,(a=ju(null,o,0,null)).return=t,a.child=e,null!==e&&(e.return=a),0==(2&t.mode))for(e=null!==t.memoizedState?t.child.child:t.child,a.child=e;null!==e;)e.return=a,e=e.sibling;return(n=ju(l,o,n,null)).return=t,a.sibling=n,n.effectTag|=2,a.childExpirationTime=0,t.memoizedState=Wi,t.child=a,n}return t.memoizedState=null,t.child=Pa(t,e,a.children,n)}function Ki(e,t){e.expirationTime<t&&(e.expirationTime=t);var n=e.alternate;null!==n&&n.expirationTime<t&&(n.expirationTime=t),ia(e.return,t)}function Xi(e,t,n,r,o,a){var i=e.memoizedState;null===i?e.memoizedState={isBackwards:t,rendering:null,renderingStartTime:0,last:r,tail:n,tailExpiration:0,tailMode:o,lastEffect:a}:(i.isBackwards=t,i.rendering=null,i.renderingStartTime=0,i.last=r,i.tail=n,i.tailExpiration=0,i.tailMode=o,i.lastEffect=a)}function Yi(e,t,n){var r=t.pendingProps,o=r.revealOrder,a=r.tail;if(Di(e,t,r.children,n),0!=(2&(r=Ua.current)))r=1&r|2,t.effectTag|=64;else{if(null!==e&&0!=(64&e.effectTag))e:for(e=t.child;null!==e;){if(13===e.tag)null!==e.memoizedState&&Ki(e,n);else if(19===e.tag)Ki(e,n);else if(null!==e.child){e.child.return=e,e=e.child;continue}if(e===t)break e;for(;null===e.sibling;){if(null===e.return||e.return===t)break e;e=e.return}e.sibling.return=e.return,e=e.sibling}r&=1}if(mo(Ua,r),0==(2&t.mode))t.memoizedState=null;else switch(o){case"forwards":for(n=t.child,o=null;null!==n;)null!==(e=n.alternate)&&null===$a(e)&&(o=n),n=n.sibling;null===(n=o)?(o=t.child,t.child=null):(o=n.sibling,n.sibling=null),Xi(t,!1,o,n,a,t.lastEffect);break;case"backwards":for(n=null,o=t.child,t.child=null;null!==o;){if(null!==(e=o.alternate)&&null===$a(e)){t.child=o;break}e=o.sibling,o.sibling=n,n=o,o=e}Xi(t,!0,n,null,a,t.lastEffect);break;case"together":Xi(t,!1,null,null,void 0,t.lastEffect);break;default:t.memoizedState=null}return t.child}function Zi(e,t,n){null!==e&&(t.dependencies=e.dependencies);var r=t.expirationTime;if(0!==r&&mu(r),t.childExpirationTime<n)return null;if(null!==e&&t.child!==e.child)throw Error(i(153));if(null!==t.child){for(n=Lu(e=t.child,e.pendingProps),t.child=n,n.return=t;null!==e.sibling;)e=e.sibling,(n=n.sibling=Lu(e,e.pendingProps)).return=t;n.sibling=null}return t.child}function Ji(e,t){switch(e.tailMode){case"hidden":t=e.tail;for(var n=null;null!==t;)null!==t.alternate&&(n=t),t=t.sibling;null===n?e.tail=null:n.sibling=null;break;case"collapsed":n=e.tail;for(var r=null;null!==n;)null!==n.alternate&&(r=n),n=n.sibling;null===r?t||null===e.tail?e.tail=null:e.tail.sibling=null:r.sibling=null}}function el(e,t,n){var r=t.pendingProps;switch(t.tag){case 2:case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return null;case 1:return wo(t.type)&&xo(),null;case 3:return Fa(),po(vo),po(go),(n=t.stateNode).pendingContext&&(n.context=n.pendingContext,n.pendingContext=null),null!==e&&null!==e.child||!Ai(t)||(t.effectTag|=4),null;case 5:za(t),n=Da(La.current);var a=t.type;if(null!==e&&null!=t.stateNode)Hi(e,t,a,r,n),e.ref!==t.ref&&(t.effectTag|=128);else{if(!r){if(null===t.stateNode)throw Error(i(166));return null}if(e=Da(Na.current),Ai(t)){r=t.stateNode,a=t.type;var l=t.memoizedProps;switch(r[On]=t,r[Pn]=l,a){case"iframe":case"object":case"embed":Qt("load",r);break;case"video":case"audio":for(e=0;e<Ye.length;e++)Qt(Ye[e],r);break;case"source":Qt("error",r);break;case"img":case"image":case"link":Qt("error",r),Qt("load",r);break;case"form":Qt("reset",r),Qt("submit",r);break;case"details":Qt("toggle",r);break;case"input":Ee(r,l),Qt("invalid",r),sn(n,"onChange");break;case"select":r._wrapperState={wasMultiple:!!l.multiple},Qt("invalid",r),sn(n,"onChange");break;case"textarea":Ae(r,l),Qt("invalid",r),sn(n,"onChange")}for(var u in an(a,l),e=null,l)if(l.hasOwnProperty(u)){var s=l[u];"children"===u?"string"==typeof s?r.textContent!==s&&(e=["children",s]):"number"==typeof s&&r.textContent!==""+s&&(e=["children",""+s]):S.hasOwnProperty(u)&&null!=s&&sn(n,u)}switch(a){case"input":we(r),_e(r,l,!0);break;case"textarea":we(r),Ie(r);break;case"select":case"option":break;default:"function"==typeof l.onClick&&(r.onclick=cn)}n=e,t.updateQueue=n,null!==n&&(t.effectTag|=4)}else{switch(u=9===n.nodeType?n:n.ownerDocument,e===un&&(e=je(a)),e===un?"script"===a?((e=u.createElement("div")).innerHTML="<script><\/script>",e=e.removeChild(e.firstChild)):"string"==typeof r.is?e=u.createElement(a,{is:r.is}):(e=u.createElement(a),"select"===a&&(u=e,r.multiple?u.multiple=!0:r.size&&(u.size=r.size))):e=u.createElementNS(e,a),e[On]=t,e[Pn]=r,Gi(e,t),t.stateNode=e,u=ln(a,r),a){case"iframe":case"object":case"embed":Qt("load",e),s=r;break;case"video":case"audio":for(s=0;s<Ye.length;s++)Qt(Ye[s],e);s=r;break;case"source":Qt("error",e),s=r;break;case"img":case"image":case"link":Qt("error",e),Qt("load",e),s=r;break;case"form":Qt("reset",e),Qt("submit",e),s=r;break;case"details":Qt("toggle",e),s=r;break;case"input":Ee(e,r),s=ke(e,r),Qt("invalid",e),sn(n,"onChange");break;case"option":s=Oe(e,r);break;case"select":e._wrapperState={wasMultiple:!!r.multiple},s=o({},r,{value:void 0}),Qt("invalid",e),sn(n,"onChange");break;case"textarea":Ae(e,r),s=Re(e,r),Qt("invalid",e),sn(n,"onChange");break;default:s=r}an(a,s);var c=s;for(l in c)if(c.hasOwnProperty(l)){var d=c[l];"style"===l?rn(e,d):"dangerouslySetInnerHTML"===l?null!=(d=d?d.__html:void 0)&&Ue(e,d):"children"===l?"string"==typeof d?("textarea"!==a||""!==d)&&$e(e,d):"number"==typeof d&&$e(e,""+d):"suppressContentEditableWarning"!==l&&"suppressHydrationWarning"!==l&&"autoFocus"!==l&&(S.hasOwnProperty(l)?null!=d&&sn(n,l):null!=d&&Y(e,l,d,u))}switch(a){case"input":we(e),_e(e,r,!1);break;case"textarea":we(e),Ie(e);break;case"option":null!=r.value&&e.setAttribute("value",""+ye(r.value));break;case"select":e.multiple=!!r.multiple,null!=(n=r.value)?Pe(e,!!r.multiple,n,!1):null!=r.defaultValue&&Pe(e,!!r.multiple,r.defaultValue,!0);break;default:"function"==typeof s.onClick&&(e.onclick=cn)}xn(a,r)&&(t.effectTag|=4)}null!==t.ref&&(t.effectTag|=128)}return null;case 6:if(e&&null!=t.stateNode)Vi(0,t,e.memoizedProps,r);else{if("string"!=typeof r&&null===t.stateNode)throw Error(i(166));n=Da(La.current),Da(Na.current),Ai(t)?(n=t.stateNode,r=t.memoizedProps,n[On]=t,n.nodeValue!==r&&(t.effectTag|=4)):((n=(9===n.nodeType?n:n.ownerDocument).createTextNode(r))[On]=t,t.stateNode=n)}return null;case 13:return po(Ua),r=t.memoizedState,0!=(64&t.effectTag)?(t.expirationTime=n,t):(n=null!==r,r=!1,null===e?void 0!==t.memoizedProps.fallback&&Ai(t):(r=null!==(a=e.memoizedState),n||null===a||null!==(a=e.child.sibling)&&(null!==(l=t.firstEffect)?(t.firstEffect=a,a.nextEffect=l):(t.firstEffect=t.lastEffect=a,a.nextEffect=null),a.effectTag=8)),n&&!r&&0!=(2&t.mode)&&(null===e&&!0!==t.memoizedProps.unstable_avoidThisFallback||0!=(1&Ua.current)?Dl===Ol&&(Dl=Pl):(Dl!==Ol&&Dl!==Pl||(Dl=Rl),0!==Ul&&null!==Nl&&($u(Nl,Ll),Bu(Nl,Ul)))),(n||r)&&(t.effectTag|=4),null);case 4:return Fa(),null;case 10:return aa(t),null;case 17:return wo(t.type)&&xo(),null;case 19:if(po(Ua),null===(r=t.memoizedState))return null;if(a=0!=(64&t.effectTag),null===(l=r.rendering)){if(a)Ji(r,!1);else if(Dl!==Ol||null!==e&&0!=(64&e.effectTag))for(l=t.child;null!==l;){if(null!==(e=$a(l))){for(t.effectTag|=64,Ji(r,!1),null!==(a=e.updateQueue)&&(t.updateQueue=a,t.effectTag|=4),null===r.lastEffect&&(t.firstEffect=null),t.lastEffect=r.lastEffect,r=t.child;null!==r;)l=n,(a=r).effectTag&=2,a.nextEffect=null,a.firstEffect=null,a.lastEffect=null,null===(e=a.alternate)?(a.childExpirationTime=0,a.expirationTime=l,a.child=null,a.memoizedProps=null,a.memoizedState=null,a.updateQueue=null,a.dependencies=null):(a.childExpirationTime=e.childExpirationTime,a.expirationTime=e.expirationTime,a.child=e.child,a.memoizedProps=e.memoizedProps,a.memoizedState=e.memoizedState,a.updateQueue=e.updateQueue,l=e.dependencies,a.dependencies=null===l?null:{expirationTime:l.expirationTime,firstContext:l.firstContext,responders:l.responders}),r=r.sibling;return mo(Ua,1&Ua.current|2),t.child}l=l.sibling}}else{if(!a)if(null!==(e=$a(l))){if(t.effectTag|=64,a=!0,null!==(n=e.updateQueue)&&(t.updateQueue=n,t.effectTag|=4),Ji(r,!0),null===r.tail&&"hidden"===r.tailMode&&!l.alternate)return null!==(t=t.lastEffect=r.lastEffect)&&(t.nextEffect=null),null}else 2*Go()-r.renderingStartTime>r.tailExpiration&&1<n&&(t.effectTag|=64,a=!0,Ji(r,!1),t.expirationTime=t.childExpirationTime=n-1);r.isBackwards?(l.sibling=t.child,t.child=l):(null!==(n=r.last)?n.sibling=l:t.child=l,r.last=l)}return null!==r.tail?(0===r.tailExpiration&&(r.tailExpiration=Go()+500),n=r.tail,r.rendering=n,r.tail=n.sibling,r.lastEffect=t.lastEffect,r.renderingStartTime=Go(),n.sibling=null,t=Ua.current,mo(Ua,a?1&t|2:1&t),n):null}throw Error(i(156,t.tag))}function tl(e){switch(e.tag){case 1:wo(e.type)&&xo();var t=e.effectTag;return 4096&t?(e.effectTag=-4097&t|64,e):null;case 3:if(Fa(),po(vo),po(go),0!=(64&(t=e.effectTag)))throw Error(i(285));return e.effectTag=-4097&t|64,e;case 5:return za(e),null;case 13:return po(Ua),4096&(t=e.effectTag)?(e.effectTag=-4097&t|64,e):null;case 19:return po(Ua),null;case 4:return Fa(),null;case 10:return aa(e),null;default:return null}}function nl(e,t){return{value:e,source:t,stack:ve(t)}}Gi=function(e,t){for(var n=t.child;null!==n;){if(5===n.tag||6===n.tag)e.appendChild(n.stateNode);else if(4!==n.tag&&null!==n.child){n.child.return=n,n=n.child;continue}if(n===t)break;for(;null===n.sibling;){if(null===n.return||n.return===t)return;n=n.return}n.sibling.return=n.return,n=n.sibling}},Hi=function(e,t,n,r,a){var i=e.memoizedProps;if(i!==r){var l,u,s=t.stateNode;switch(Da(Na.current),e=null,n){case"input":i=ke(s,i),r=ke(s,r),e=[];break;case"option":i=Oe(s,i),r=Oe(s,r),e=[];break;case"select":i=o({},i,{value:void 0}),r=o({},r,{value:void 0}),e=[];break;case"textarea":i=Re(s,i),r=Re(s,r),e=[];break;default:"function"!=typeof i.onClick&&"function"==typeof r.onClick&&(s.onclick=cn)}for(l in an(n,r),n=null,i)if(!r.hasOwnProperty(l)&&i.hasOwnProperty(l)&&null!=i[l])if("style"===l)for(u in s=i[l])s.hasOwnProperty(u)&&(n||(n={}),n[u]="");else"dangerouslySetInnerHTML"!==l&&"children"!==l&&"suppressContentEditableWarning"!==l&&"suppressHydrationWarning"!==l&&"autoFocus"!==l&&(S.hasOwnProperty(l)?e||(e=[]):(e=e||[]).push(l,null));for(l in r){var c=r[l];if(s=null!=i?i[l]:void 0,r.hasOwnProperty(l)&&c!==s&&(null!=c||null!=s))if("style"===l)if(s){for(u in s)!s.hasOwnProperty(u)||c&&c.hasOwnProperty(u)||(n||(n={}),n[u]="");for(u in c)c.hasOwnProperty(u)&&s[u]!==c[u]&&(n||(n={}),n[u]=c[u])}else n||(e||(e=[]),e.push(l,n)),n=c;else"dangerouslySetInnerHTML"===l?(c=c?c.__html:void 0,s=s?s.__html:void 0,null!=c&&s!==c&&(e=e||[]).push(l,c)):"children"===l?s===c||"string"!=typeof c&&"number"!=typeof c||(e=e||[]).push(l,""+c):"suppressContentEditableWarning"!==l&&"suppressHydrationWarning"!==l&&(S.hasOwnProperty(l)?(null!=c&&sn(a,l),e||s===c||(e=[])):(e=e||[]).push(l,c))}n&&(e=e||[]).push("style",n),a=e,(t.updateQueue=a)&&(t.effectTag|=4)}},Vi=function(e,t,n,r){n!==r&&(t.effectTag|=4)};var rl="function"==typeof WeakSet?WeakSet:Set;function ol(e,t){var n=t.source,r=t.stack;null===r&&null!==n&&(r=ve(n)),null!==n&&ge(n.type),t=t.value,null!==e&&1===e.tag&&ge(e.type);try{console.error(t)}catch(o){setTimeout((function(){throw o}))}}function al(e){var t=e.ref;if(null!==t)if("function"==typeof t)try{t(null)}catch(n){_u(e,n)}else t.current=null}function il(e,t){switch(t.tag){case 0:case 11:case 15:case 22:return;case 1:if(256&t.effectTag&&null!==e){var n=e.memoizedProps,r=e.memoizedState;t=(e=t.stateNode).getSnapshotBeforeUpdate(t.elementType===t.type?n:Jo(t.type,n),r),e.__reactInternalSnapshotBeforeUpdate=t}return;case 3:case 5:case 6:case 4:case 17:return}throw Error(i(163))}function ll(e,t){if(null!==(t=null!==(t=t.updateQueue)?t.lastEffect:null)){var n=t=t.next;do{if((n.tag&e)===e){var r=n.destroy;n.destroy=void 0,void 0!==r&&r()}n=n.next}while(n!==t)}}function ul(e,t){if(null!==(t=null!==(t=t.updateQueue)?t.lastEffect:null)){var n=t=t.next;do{if((n.tag&e)===e){var r=n.create;n.destroy=r()}n=n.next}while(n!==t)}}function sl(e,t,n){switch(n.tag){case 0:case 11:case 15:case 22:return void ul(3,n);case 1:if(e=n.stateNode,4&n.effectTag)if(null===t)e.componentDidMount();else{var r=n.elementType===n.type?t.memoizedProps:Jo(n.type,t.memoizedProps);e.componentDidUpdate(r,t.memoizedState,e.__reactInternalSnapshotBeforeUpdate)}return void(null!==(t=n.updateQueue)&&ga(n,t,e));case 3:if(null!==(t=n.updateQueue)){if(e=null,null!==n.child)switch(n.child.tag){case 5:e=n.child.stateNode;break;case 1:e=n.child.stateNode}ga(n,t,e)}return;case 5:return e=n.stateNode,void(null===t&&4&n.effectTag&&xn(n.type,n.memoizedProps)&&e.focus());case 6:case 4:case 12:return;case 13:return void(null===n.memoizedState&&(n=n.alternate,null!==n&&(n=n.memoizedState,null!==n&&(n=n.dehydrated,null!==n&&Ft(n)))));case 19:case 17:case 20:case 21:return}throw Error(i(163))}function cl(e,t,n){switch("function"==typeof Ru&&Ru(t),t.tag){case 0:case 11:case 14:case 15:case 22:if(null!==(e=t.updateQueue)&&null!==(e=e.lastEffect)){var r=e.next;Wo(97<n?97:n,(function(){var e=r;do{var n=e.destroy;if(void 0!==n){var o=t;try{n()}catch(a){_u(o,a)}}e=e.next}while(e!==r)}))}break;case 1:al(t),"function"==typeof(n=t.stateNode).componentWillUnmount&&function(e,t){try{t.props=e.memoizedProps,t.state=e.memoizedState,t.componentWillUnmount()}catch(n){_u(e,n)}}(t,n);break;case 5:al(t);break;case 4:gl(e,t,n)}}function dl(e){var t=e.alternate;e.return=null,e.child=null,e.memoizedState=null,e.updateQueue=null,e.dependencies=null,e.alternate=null,e.firstEffect=null,e.lastEffect=null,e.pendingProps=null,e.memoizedProps=null,e.stateNode=null,null!==t&&dl(t)}function fl(e){return 5===e.tag||3===e.tag||4===e.tag}function pl(e){e:{for(var t=e.return;null!==t;){if(fl(t)){var n=t;break e}t=t.return}throw Error(i(160))}switch(t=n.stateNode,n.tag){case 5:var r=!1;break;case 3:case 4:t=t.containerInfo,r=!0;break;default:throw Error(i(161))}16&n.effectTag&&($e(t,""),n.effectTag&=-17);e:t:for(n=e;;){for(;null===n.sibling;){if(null===n.return||fl(n.return)){n=null;break e}n=n.return}for(n.sibling.return=n.return,n=n.sibling;5!==n.tag&&6!==n.tag&&18!==n.tag;){if(2&n.effectTag)continue t;if(null===n.child||4===n.tag)continue t;n.child.return=n,n=n.child}if(!(2&n.effectTag)){n=n.stateNode;break e}}r?ml(e,n,t):hl(e,n,t)}function ml(e,t,n){var r=e.tag,o=5===r||6===r;if(o)e=o?e.stateNode:e.stateNode.instance,t?8===n.nodeType?n.parentNode.insertBefore(e,t):n.insertBefore(e,t):(8===n.nodeType?(t=n.parentNode).insertBefore(e,n):(t=n).appendChild(e),null!=(n=n._reactRootContainer)||null!==t.onclick||(t.onclick=cn));else if(4!==r&&null!==(e=e.child))for(ml(e,t,n),e=e.sibling;null!==e;)ml(e,t,n),e=e.sibling}function hl(e,t,n){var r=e.tag,o=5===r||6===r;if(o)e=o?e.stateNode:e.stateNode.instance,t?n.insertBefore(e,t):n.appendChild(e);else if(4!==r&&null!==(e=e.child))for(hl(e,t,n),e=e.sibling;null!==e;)hl(e,t,n),e=e.sibling}function gl(e,t,n){for(var r,o,a=t,l=!1;;){if(!l){l=a.return;e:for(;;){if(null===l)throw Error(i(160));switch(r=l.stateNode,l.tag){case 5:o=!1;break e;case 3:case 4:r=r.containerInfo,o=!0;break e}l=l.return}l=!0}if(5===a.tag||6===a.tag){e:for(var u=e,s=a,c=n,d=s;;)if(cl(u,d,c),null!==d.child&&4!==d.tag)d.child.return=d,d=d.child;else{if(d===s)break e;for(;null===d.sibling;){if(null===d.return||d.return===s)break e;d=d.return}d.sibling.return=d.return,d=d.sibling}o?(u=r,s=a.stateNode,8===u.nodeType?u.parentNode.removeChild(s):u.removeChild(s)):r.removeChild(a.stateNode)}else if(4===a.tag){if(null!==a.child){r=a.stateNode.containerInfo,o=!0,a.child.return=a,a=a.child;continue}}else if(cl(e,a,n),null!==a.child){a.child.return=a,a=a.child;continue}if(a===t)break;for(;null===a.sibling;){if(null===a.return||a.return===t)return;4===(a=a.return).tag&&(l=!1)}a.sibling.return=a.return,a=a.sibling}}function vl(e,t){switch(t.tag){case 0:case 11:case 14:case 15:case 22:return void ll(3,t);case 1:return;case 5:var n=t.stateNode;if(null!=n){var r=t.memoizedProps,o=null!==e?e.memoizedProps:r;e=t.type;var a=t.updateQueue;if(t.updateQueue=null,null!==a){for(n[Pn]=r,"input"===e&&"radio"===r.type&&null!=r.name&&Se(n,r),ln(e,o),t=ln(e,r),o=0;o<a.length;o+=2){var l=a[o],u=a[o+1];"style"===l?rn(n,u):"dangerouslySetInnerHTML"===l?Ue(n,u):"children"===l?$e(n,u):Y(n,l,u,t)}switch(e){case"input":Te(n,r);break;case"textarea":Ne(n,r);break;case"select":t=n._wrapperState.wasMultiple,n._wrapperState.wasMultiple=!!r.multiple,null!=(e=r.value)?Pe(n,!!r.multiple,e,!1):t!==!!r.multiple&&(null!=r.defaultValue?Pe(n,!!r.multiple,r.defaultValue,!0):Pe(n,!!r.multiple,r.multiple?[]:"",!1))}}}return;case 6:if(null===t.stateNode)throw Error(i(162));return void(t.stateNode.nodeValue=t.memoizedProps);case 3:return void((t=t.stateNode).hydrate&&(t.hydrate=!1,Ft(t.containerInfo)));case 12:return;case 13:if(n=t,null===t.memoizedState?r=!1:(r=!0,n=t.child,Bl=Go()),null!==n)e:for(e=n;;){if(5===e.tag)a=e.stateNode,r?"function"==typeof(a=a.style).setProperty?a.setProperty("display","none","important"):a.display="none":(a=e.stateNode,o=null!=(o=e.memoizedProps.style)&&o.hasOwnProperty("display")?o.display:null,a.style.display=nn("display",o));else if(6===e.tag)e.stateNode.nodeValue=r?"":e.memoizedProps;else{if(13===e.tag&&null!==e.memoizedState&&null===e.memoizedState.dehydrated){(a=e.child.sibling).return=e,e=a;continue}if(null!==e.child){e.child.return=e,e=e.child;continue}}if(e===n)break;for(;null===e.sibling;){if(null===e.return||e.return===n)break e;e=e.return}e.sibling.return=e.return,e=e.sibling}return void yl(t);case 19:return void yl(t);case 17:return}throw Error(i(163))}function yl(e){var t=e.updateQueue;if(null!==t){e.updateQueue=null;var n=e.stateNode;null===n&&(n=e.stateNode=new rl),t.forEach((function(t){var r=Ou.bind(null,e,t);n.has(t)||(n.add(t),t.then(r,r))}))}}var bl="function"==typeof WeakMap?WeakMap:Map;function wl(e,t,n){(n=fa(n,null)).tag=3,n.payload={element:null};var r=t.value;return n.callback=function(){Gl||(Gl=!0,Hl=r),ol(e,t)},n}function xl(e,t,n){(n=fa(n,null)).tag=3;var r=e.type.getDerivedStateFromError;if("function"==typeof r){var o=t.value;n.payload=function(){return ol(e,t),r(o)}}var a=e.stateNode;return null!==a&&"function"==typeof a.componentDidCatch&&(n.callback=function(){"function"!=typeof r&&(null===Vl?Vl=new Set([this]):Vl.add(this),ol(e,t));var n=t.stack;this.componentDidCatch(t.value,{componentStack:null!==n?n:""})}),n}var kl,El=Math.ceil,Sl=X.ReactCurrentDispatcher,Tl=X.ReactCurrentOwner,_l=16,Cl=32,Ol=0,Pl=3,Rl=4,Al=0,Nl=null,Il=null,Ll=0,Dl=Ol,jl=null,Fl=1073741823,Ml=1073741823,zl=null,Ul=0,$l=!1,Bl=0,ql=null,Gl=!1,Hl=null,Vl=null,Wl=!1,Ql=null,Kl=90,Xl=null,Yl=0,Zl=null,Jl=0;function eu(){return 0!=(48&Al)?1073741821-(Go()/10|0):0!==Jl?Jl:Jl=1073741821-(Go()/10|0)}function tu(e,t,n){if(0==(2&(t=t.mode)))return 1073741823;var r=Ho();if(0==(4&t))return 99===r?1073741823:1073741822;if(0!=(Al&_l))return Ll;if(null!==n)e=Zo(e,0|n.timeoutMs||5e3,250);else switch(r){case 99:e=1073741823;break;case 98:e=Zo(e,150,100);break;case 97:case 96:e=Zo(e,5e3,250);break;case 95:e=2;break;default:throw Error(i(326))}return null!==Nl&&e===Ll&&--e,e}function nu(e,t){if(50<Yl)throw Yl=0,Zl=null,Error(i(185));if(null!==(e=ru(e,t))){var n=Ho();1073741823===t?0!=(8&Al)&&0==(48&Al)?lu(e):(au(e),0===Al&&Xo()):au(e),0==(4&Al)||98!==n&&99!==n||(null===Xl?Xl=new Map([[e,t]]):(void 0===(n=Xl.get(e))||n>t)&&Xl.set(e,t))}}function ru(e,t){e.expirationTime<t&&(e.expirationTime=t);var n=e.alternate;null!==n&&n.expirationTime<t&&(n.expirationTime=t);var r=e.return,o=null;if(null===r&&3===e.tag)o=e.stateNode;else for(;null!==r;){if(n=r.alternate,r.childExpirationTime<t&&(r.childExpirationTime=t),null!==n&&n.childExpirationTime<t&&(n.childExpirationTime=t),null===r.return&&3===r.tag){o=r.stateNode;break}r=r.return}return null!==o&&(Nl===o&&(mu(t),Dl===Rl&&$u(o,Ll)),Bu(o,t)),o}function ou(e){var t=e.lastExpiredTime;if(0!==t)return t;if(!Uu(e,t=e.firstPendingTime))return t;var n=e.lastPingedTime;return 2>=(e=n>(e=e.nextKnownPendingLevel)?n:e)&&t!==e?0:e}function au(e){if(0!==e.lastExpiredTime)e.callbackExpirationTime=1073741823,e.callbackPriority=99,e.callbackNode=Ko(lu.bind(null,e));else{var t=ou(e),n=e.callbackNode;if(0===t)null!==n&&(e.callbackNode=null,e.callbackExpirationTime=0,e.callbackPriority=90);else{var r=eu();if(1073741823===t?r=99:1===t||2===t?r=95:r=0>=(r=10*(1073741821-t)-10*(1073741821-r))?99:250>=r?98:5250>=r?97:95,null!==n){var o=e.callbackPriority;if(e.callbackExpirationTime===t&&o>=r)return;n!==Fo&&Oo(n)}e.callbackExpirationTime=t,e.callbackPriority=r,t=1073741823===t?Ko(lu.bind(null,e)):Qo(r,iu.bind(null,e),{timeout:10*(1073741821-t)-Go()}),e.callbackNode=t}}}function iu(e,t){if(Jl=0,t)return qu(e,t=eu()),au(e),null;var n=ou(e);if(0!==n){if(t=e.callbackNode,0!=(48&Al))throw Error(i(327));if(Eu(),e===Nl&&n===Ll||cu(e,n),null!==Il){var r=Al;Al|=_l;for(var o=fu();;)try{gu();break}catch(u){du(e,u)}if(oa(),Al=r,Sl.current=o,1===Dl)throw t=jl,cu(e,n),$u(e,n),au(e),t;if(null===Il)switch(o=e.finishedWork=e.current.alternate,e.finishedExpirationTime=n,r=Dl,Nl=null,r){case Ol:case 1:throw Error(i(345));case 2:qu(e,2<n?2:n);break;case Pl:if($u(e,n),n===(r=e.lastSuspendedTime)&&(e.nextKnownPendingLevel=bu(o)),1073741823===Fl&&10<(o=Bl+500-Go())){if($l){var a=e.lastPingedTime;if(0===a||a>=n){e.lastPingedTime=n,cu(e,n);break}}if(0!==(a=ou(e))&&a!==n)break;if(0!==r&&r!==n){e.lastPingedTime=r;break}e.timeoutHandle=En(wu.bind(null,e),o);break}wu(e);break;case Rl:if($u(e,n),n===(r=e.lastSuspendedTime)&&(e.nextKnownPendingLevel=bu(o)),$l&&(0===(o=e.lastPingedTime)||o>=n)){e.lastPingedTime=n,cu(e,n);break}if(0!==(o=ou(e))&&o!==n)break;if(0!==r&&r!==n){e.lastPingedTime=r;break}if(1073741823!==Ml?r=10*(1073741821-Ml)-Go():1073741823===Fl?r=0:(r=10*(1073741821-Fl)-5e3,0>(r=(o=Go())-r)&&(r=0),(n=10*(1073741821-n)-o)<(r=(120>r?120:480>r?480:1080>r?1080:1920>r?1920:3e3>r?3e3:4320>r?4320:1960*El(r/1960))-r)&&(r=n)),10<r){e.timeoutHandle=En(wu.bind(null,e),r);break}wu(e);break;case 5:if(1073741823!==Fl&&null!==zl){a=Fl;var l=zl;if(0>=(r=0|l.busyMinDurationMs)?r=0:(o=0|l.busyDelayMs,r=(a=Go()-(10*(1073741821-a)-(0|l.timeoutMs||5e3)))<=o?0:o+r-a),10<r){$u(e,n),e.timeoutHandle=En(wu.bind(null,e),r);break}}wu(e);break;default:throw Error(i(329))}if(au(e),e.callbackNode===t)return iu.bind(null,e)}}return null}function lu(e){var t=e.lastExpiredTime;if(t=0!==t?t:1073741823,0!=(48&Al))throw Error(i(327));if(Eu(),e===Nl&&t===Ll||cu(e,t),null!==Il){var n=Al;Al|=_l;for(var r=fu();;)try{hu();break}catch(o){du(e,o)}if(oa(),Al=n,Sl.current=r,1===Dl)throw n=jl,cu(e,t),$u(e,t),au(e),n;if(null!==Il)throw Error(i(261));e.finishedWork=e.current.alternate,e.finishedExpirationTime=t,Nl=null,wu(e),au(e)}return null}function uu(e,t){var n=Al;Al|=1;try{return e(t)}finally{0===(Al=n)&&Xo()}}function su(e,t){var n=Al;Al&=-2,Al|=8;try{return e(t)}finally{0===(Al=n)&&Xo()}}function cu(e,t){e.finishedWork=null,e.finishedExpirationTime=0;var n=e.timeoutHandle;if(-1!==n&&(e.timeoutHandle=-1,Sn(n)),null!==Il)for(n=Il.return;null!==n;){var r=n;switch(r.tag){case 1:null!=(r=r.type.childContextTypes)&&xo();break;case 3:Fa(),po(vo),po(go);break;case 5:za(r);break;case 4:Fa();break;case 13:case 19:po(Ua);break;case 10:aa(r)}n=n.return}Nl=e,Il=Lu(e.current,null),Ll=t,Dl=Ol,jl=null,Ml=Fl=1073741823,zl=null,Ul=0,$l=!1}function du(e,t){for(;;){try{if(oa(),qa.current=wi,Ka)for(var n=Va.memoizedState;null!==n;){var r=n.queue;null!==r&&(r.pending=null),n=n.next}if(Ha=0,Qa=Wa=Va=null,Ka=!1,null===Il||null===Il.return)return Dl=1,jl=t,Il=null;e:{var o=e,a=Il.return,i=Il,l=t;if(t=Ll,i.effectTag|=2048,i.firstEffect=i.lastEffect=null,null!==l&&"object"==typeof l&&"function"==typeof l.then){var u=l;if(0==(2&i.mode)){var s=i.alternate;s?(i.updateQueue=s.updateQueue,i.memoizedState=s.memoizedState,i.expirationTime=s.expirationTime):(i.updateQueue=null,i.memoizedState=null)}var c=0!=(1&Ua.current),d=a;do{var f;if(f=13===d.tag){var p=d.memoizedState;if(null!==p)f=null!==p.dehydrated;else{var m=d.memoizedProps;f=void 0!==m.fallback&&(!0!==m.unstable_avoidThisFallback||!c)}}if(f){var h=d.updateQueue;if(null===h){var g=new Set;g.add(u),d.updateQueue=g}else h.add(u);if(0==(2&d.mode)){if(d.effectTag|=64,i.effectTag&=-2981,1===i.tag)if(null===i.alternate)i.tag=17;else{var v=fa(1073741823,null);v.tag=2,pa(i,v)}i.expirationTime=1073741823;break e}l=void 0,i=t;var y=o.pingCache;if(null===y?(y=o.pingCache=new bl,l=new Set,y.set(u,l)):void 0===(l=y.get(u))&&(l=new Set,y.set(u,l)),!l.has(i)){l.add(i);var b=Cu.bind(null,o,u,i);u.then(b,b)}d.effectTag|=4096,d.expirationTime=t;break e}d=d.return}while(null!==d);l=Error((ge(i.type)||"A React component")+" suspended while rendering, but no fallback UI was specified.\n\nAdd a <Suspense fallback=...> component higher in the tree to provide a loading indicator or placeholder to display."+ve(i))}5!==Dl&&(Dl=2),l=nl(l,i),d=a;do{switch(d.tag){case 3:u=l,d.effectTag|=4096,d.expirationTime=t,ma(d,wl(d,u,t));break e;case 1:u=l;var w=d.type,x=d.stateNode;if(0==(64&d.effectTag)&&("function"==typeof w.getDerivedStateFromError||null!==x&&"function"==typeof x.componentDidCatch&&(null===Vl||!Vl.has(x)))){d.effectTag|=4096,d.expirationTime=t,ma(d,xl(d,u,t));break e}}d=d.return}while(null!==d)}Il=yu(Il)}catch(k){t=k;continue}break}}function fu(){var e=Sl.current;return Sl.current=wi,null===e?wi:e}function pu(e,t){e<Fl&&2<e&&(Fl=e),null!==t&&e<Ml&&2<e&&(Ml=e,zl=t)}function mu(e){e>Ul&&(Ul=e)}function hu(){for(;null!==Il;)Il=vu(Il)}function gu(){for(;null!==Il&&!Mo();)Il=vu(Il)}function vu(e){var t=kl(e.alternate,e,Ll);return e.memoizedProps=e.pendingProps,null===t&&(t=yu(e)),Tl.current=null,t}function yu(e){Il=e;do{var t=Il.alternate;if(e=Il.return,0==(2048&Il.effectTag)){if(t=el(t,Il,Ll),1===Ll||1!==Il.childExpirationTime){for(var n=0,r=Il.child;null!==r;){var o=r.expirationTime,a=r.childExpirationTime;o>n&&(n=o),a>n&&(n=a),r=r.sibling}Il.childExpirationTime=n}if(null!==t)return t;null!==e&&0==(2048&e.effectTag)&&(null===e.firstEffect&&(e.firstEffect=Il.firstEffect),null!==Il.lastEffect&&(null!==e.lastEffect&&(e.lastEffect.nextEffect=Il.firstEffect),e.lastEffect=Il.lastEffect),1<Il.effectTag&&(null!==e.lastEffect?e.lastEffect.nextEffect=Il:e.firstEffect=Il,e.lastEffect=Il))}else{if(null!==(t=tl(Il)))return t.effectTag&=2047,t;null!==e&&(e.firstEffect=e.lastEffect=null,e.effectTag|=2048)}if(null!==(t=Il.sibling))return t;Il=e}while(null!==Il);return Dl===Ol&&(Dl=5),null}function bu(e){var t=e.expirationTime;return t>(e=e.childExpirationTime)?t:e}function wu(e){var t=Ho();return Wo(99,xu.bind(null,e,t)),null}function xu(e,t){do{Eu()}while(null!==Ql);if(0!=(48&Al))throw Error(i(327));var n=e.finishedWork,r=e.finishedExpirationTime;if(null===n)return null;if(e.finishedWork=null,e.finishedExpirationTime=0,n===e.current)throw Error(i(177));e.callbackNode=null,e.callbackExpirationTime=0,e.callbackPriority=90,e.nextKnownPendingLevel=0;var o=bu(n);if(e.firstPendingTime=o,r<=e.lastSuspendedTime?e.firstSuspendedTime=e.lastSuspendedTime=e.nextKnownPendingLevel=0:r<=e.firstSuspendedTime&&(e.firstSuspendedTime=r-1),r<=e.lastPingedTime&&(e.lastPingedTime=0),r<=e.lastExpiredTime&&(e.lastExpiredTime=0),e===Nl&&(Il=Nl=null,Ll=0),1<n.effectTag?null!==n.lastEffect?(n.lastEffect.nextEffect=n,o=n.firstEffect):o=n:o=n.firstEffect,null!==o){var a=Al;Al|=Cl,Tl.current=null,bn=Wt;var l=hn();if(gn(l)){if("selectionStart"in l)var u={start:l.selectionStart,end:l.selectionEnd};else e:{var s=(u=(u=l.ownerDocument)&&u.defaultView||window).getSelection&&u.getSelection();if(s&&0!==s.rangeCount){u=s.anchorNode;var c=s.anchorOffset,d=s.focusNode;s=s.focusOffset;try{u.nodeType,d.nodeType}catch(_){u=null;break e}var f=0,p=-1,m=-1,h=0,g=0,v=l,y=null;t:for(;;){for(var b;v!==u||0!==c&&3!==v.nodeType||(p=f+c),v!==d||0!==s&&3!==v.nodeType||(m=f+s),3===v.nodeType&&(f+=v.nodeValue.length),null!==(b=v.firstChild);)y=v,v=b;for(;;){if(v===l)break t;if(y===u&&++h===c&&(p=f),y===d&&++g===s&&(m=f),null!==(b=v.nextSibling))break;y=(v=y).parentNode}v=b}u=-1===p||-1===m?null:{start:p,end:m}}else u=null}u=u||{start:0,end:0}}else u=null;wn={activeElementDetached:null,focusedElem:l,selectionRange:u},Wt=!1,ql=o;do{try{ku()}catch(_){if(null===ql)throw Error(i(330));_u(ql,_),ql=ql.nextEffect}}while(null!==ql);ql=o;do{try{for(l=e,u=t;null!==ql;){var w=ql.effectTag;if(16&w&&$e(ql.stateNode,""),128&w){var x=ql.alternate;if(null!==x){var k=x.ref;null!==k&&("function"==typeof k?k(null):k.current=null)}}switch(1038&w){case 2:pl(ql),ql.effectTag&=-3;break;case 6:pl(ql),ql.effectTag&=-3,vl(ql.alternate,ql);break;case 1024:ql.effectTag&=-1025;break;case 1028:ql.effectTag&=-1025,vl(ql.alternate,ql);break;case 4:vl(ql.alternate,ql);break;case 8:gl(l,c=ql,u),dl(c)}ql=ql.nextEffect}}catch(_){if(null===ql)throw Error(i(330));_u(ql,_),ql=ql.nextEffect}}while(null!==ql);if(k=wn,x=hn(),w=k.focusedElem,u=k.selectionRange,x!==w&&w&&w.ownerDocument&&mn(w.ownerDocument.documentElement,w)){null!==u&&gn(w)&&(x=u.start,void 0===(k=u.end)&&(k=x),"selectionStart"in w?(w.selectionStart=x,w.selectionEnd=Math.min(k,w.value.length)):(k=(x=w.ownerDocument||document)&&x.defaultView||window).getSelection&&(k=k.getSelection(),c=w.textContent.length,l=Math.min(u.start,c),u=void 0===u.end?l:Math.min(u.end,c),!k.extend&&l>u&&(c=u,u=l,l=c),c=pn(w,l),d=pn(w,u),c&&d&&(1!==k.rangeCount||k.anchorNode!==c.node||k.anchorOffset!==c.offset||k.focusNode!==d.node||k.focusOffset!==d.offset)&&((x=x.createRange()).setStart(c.node,c.offset),k.removeAllRanges(),l>u?(k.addRange(x),k.extend(d.node,d.offset)):(x.setEnd(d.node,d.offset),k.addRange(x))))),x=[];for(k=w;k=k.parentNode;)1===k.nodeType&&x.push({element:k,left:k.scrollLeft,top:k.scrollTop});for("function"==typeof w.focus&&w.focus(),w=0;w<x.length;w++)(k=x[w]).element.scrollLeft=k.left,k.element.scrollTop=k.top}Wt=!!bn,wn=bn=null,e.current=n,ql=o;do{try{for(w=e;null!==ql;){var E=ql.effectTag;if(36&E&&sl(w,ql.alternate,ql),128&E){x=void 0;var S=ql.ref;if(null!==S){var T=ql.stateNode;switch(ql.tag){case 5:x=T;break;default:x=T}"function"==typeof S?S(x):S.current=x}}ql=ql.nextEffect}}catch(_){if(null===ql)throw Error(i(330));_u(ql,_),ql=ql.nextEffect}}while(null!==ql);ql=null,zo(),Al=a}else e.current=n;if(Wl)Wl=!1,Ql=e,Kl=t;else for(ql=o;null!==ql;)t=ql.nextEffect,ql.nextEffect=null,ql=t;if(0===(t=e.firstPendingTime)&&(Vl=null),1073741823===t?e===Zl?Yl++:(Yl=0,Zl=e):Yl=0,"function"==typeof Pu&&Pu(n.stateNode,r),au(e),Gl)throw Gl=!1,e=Hl,Hl=null,e;return 0!=(8&Al)||Xo(),null}function ku(){for(;null!==ql;){var e=ql.effectTag;0!=(256&e)&&il(ql.alternate,ql),0==(512&e)||Wl||(Wl=!0,Qo(97,(function(){return Eu(),null}))),ql=ql.nextEffect}}function Eu(){if(90!==Kl){var e=97<Kl?97:Kl;return Kl=90,Wo(e,Su)}}function Su(){if(null===Ql)return!1;var e=Ql;if(Ql=null,0!=(48&Al))throw Error(i(331));var t=Al;for(Al|=Cl,e=e.current.firstEffect;null!==e;){try{var n=e;if(0!=(512&n.effectTag))switch(n.tag){case 0:case 11:case 15:case 22:ll(5,n),ul(5,n)}}catch(r){if(null===e)throw Error(i(330));_u(e,r)}n=e.nextEffect,e.nextEffect=null,e=n}return Al=t,Xo(),!0}function Tu(e,t,n){pa(e,t=wl(e,t=nl(n,t),1073741823)),null!==(e=ru(e,1073741823))&&au(e)}function _u(e,t){if(3===e.tag)Tu(e,e,t);else for(var n=e.return;null!==n;){if(3===n.tag){Tu(n,e,t);break}if(1===n.tag){var r=n.stateNode;if("function"==typeof n.type.getDerivedStateFromError||"function"==typeof r.componentDidCatch&&(null===Vl||!Vl.has(r))){pa(n,e=xl(n,e=nl(t,e),1073741823)),null!==(n=ru(n,1073741823))&&au(n);break}}n=n.return}}function Cu(e,t,n){var r=e.pingCache;null!==r&&r.delete(t),Nl===e&&Ll===n?Dl===Rl||Dl===Pl&&1073741823===Fl&&Go()-Bl<500?cu(e,Ll):$l=!0:Uu(e,n)&&(0!==(t=e.lastPingedTime)&&t<n||(e.lastPingedTime=n,au(e)))}function Ou(e,t){var n=e.stateNode;null!==n&&n.delete(t),0===(t=0)&&(t=tu(t=eu(),e,null)),null!==(e=ru(e,t))&&au(e)}kl=function(e,t,n){var r=t.expirationTime;if(null!==e){var o=t.pendingProps;if(e.memoizedProps!==o||vo.current)Li=!0;else{if(r<n){switch(Li=!1,t.tag){case 3:qi(t),Ni();break;case 5:if(Ma(t),4&t.mode&&1!==n&&o.hidden)return t.expirationTime=t.childExpirationTime=1,null;break;case 1:wo(t.type)&&So(t);break;case 4:ja(t,t.stateNode.containerInfo);break;case 10:r=t.memoizedProps.value,o=t.type._context,mo(ea,o._currentValue),o._currentValue=r;break;case 13:if(null!==t.memoizedState)return 0!==(r=t.child.childExpirationTime)&&r>=n?Qi(e,t,n):(mo(Ua,1&Ua.current),null!==(t=Zi(e,t,n))?t.sibling:null);mo(Ua,1&Ua.current);break;case 19:if(r=t.childExpirationTime>=n,0!=(64&e.effectTag)){if(r)return Yi(e,t,n);t.effectTag|=64}if(null!==(o=t.memoizedState)&&(o.rendering=null,o.tail=null),mo(Ua,Ua.current),!r)return null}return Zi(e,t,n)}Li=!1}}else Li=!1;switch(t.expirationTime=0,t.tag){case 2:if(r=t.type,null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),e=t.pendingProps,o=bo(t,go.current),la(t,n),o=Za(null,t,r,e,o,n),t.effectTag|=1,"object"==typeof o&&null!==o&&"function"==typeof o.render&&void 0===o.$$typeof){if(t.tag=1,t.memoizedState=null,t.updateQueue=null,wo(r)){var a=!0;So(t)}else a=!1;t.memoizedState=null!==o.state&&void 0!==o.state?o.state:null,ca(t);var l=r.getDerivedStateFromProps;"function"==typeof l&&ba(t,r,l,e),o.updater=wa,t.stateNode=o,o._reactInternalFiber=t,Sa(t,r,e,n),t=Bi(null,t,r,!0,a,n)}else t.tag=0,Di(null,t,o,n),t=t.child;return t;case 16:e:{if(o=t.elementType,null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),e=t.pendingProps,function(e){if(-1===e._status){e._status=0;var t=e._ctor;t=t(),e._result=t,t.then((function(t){0===e._status&&(t=t.default,e._status=1,e._result=t)}),(function(t){0===e._status&&(e._status=2,e._result=t)}))}}(o),1!==o._status)throw o._result;switch(o=o._result,t.type=o,a=t.tag=function(e){if("function"==typeof e)return Iu(e)?1:0;if(null!=e){if((e=e.$$typeof)===ue)return 11;if(e===de)return 14}return 2}(o),e=Jo(o,e),a){case 0:t=Ui(null,t,o,e,n);break e;case 1:t=$i(null,t,o,e,n);break e;case 11:t=ji(null,t,o,e,n);break e;case 14:t=Fi(null,t,o,Jo(o.type,e),r,n);break e}throw Error(i(306,o,""))}return t;case 0:return r=t.type,o=t.pendingProps,Ui(e,t,r,o=t.elementType===r?o:Jo(r,o),n);case 1:return r=t.type,o=t.pendingProps,$i(e,t,r,o=t.elementType===r?o:Jo(r,o),n);case 3:if(qi(t),r=t.updateQueue,null===e||null===r)throw Error(i(282));if(r=t.pendingProps,o=null!==(o=t.memoizedState)?o.element:null,da(e,t),ha(t,r,null,n),(r=t.memoizedState.element)===o)Ni(),t=Zi(e,t,n);else{if((o=t.stateNode.hydrate)&&(Ti=Tn(t.stateNode.containerInfo.firstChild),Si=t,o=_i=!0),o)for(n=Ra(t,null,r,n),t.child=n;n;)n.effectTag=-3&n.effectTag|1024,n=n.sibling;else Di(e,t,r,n),Ni();t=t.child}return t;case 5:return Ma(t),null===e&&Pi(t),r=t.type,o=t.pendingProps,a=null!==e?e.memoizedProps:null,l=o.children,kn(r,o)?l=null:null!==a&&kn(r,a)&&(t.effectTag|=16),zi(e,t),4&t.mode&&1!==n&&o.hidden?(t.expirationTime=t.childExpirationTime=1,t=null):(Di(e,t,l,n),t=t.child),t;case 6:return null===e&&Pi(t),null;case 13:return Qi(e,t,n);case 4:return ja(t,t.stateNode.containerInfo),r=t.pendingProps,null===e?t.child=Pa(t,null,r,n):Di(e,t,r,n),t.child;case 11:return r=t.type,o=t.pendingProps,ji(e,t,r,o=t.elementType===r?o:Jo(r,o),n);case 7:return Di(e,t,t.pendingProps,n),t.child;case 8:case 12:return Di(e,t,t.pendingProps.children,n),t.child;case 10:e:{r=t.type._context,o=t.pendingProps,l=t.memoizedProps,a=o.value;var u=t.type._context;if(mo(ea,u._currentValue),u._currentValue=a,null!==l)if(u=l.value,0===(a=$r(u,a)?0:0|("function"==typeof r._calculateChangedBits?r._calculateChangedBits(u,a):1073741823))){if(l.children===o.children&&!vo.current){t=Zi(e,t,n);break e}}else for(null!==(u=t.child)&&(u.return=t);null!==u;){var s=u.dependencies;if(null!==s){l=u.child;for(var c=s.firstContext;null!==c;){if(c.context===r&&0!=(c.observedBits&a)){1===u.tag&&((c=fa(n,null)).tag=2,pa(u,c)),u.expirationTime<n&&(u.expirationTime=n),null!==(c=u.alternate)&&c.expirationTime<n&&(c.expirationTime=n),ia(u.return,n),s.expirationTime<n&&(s.expirationTime=n);break}c=c.next}}else l=10===u.tag&&u.type===t.type?null:u.child;if(null!==l)l.return=u;else for(l=u;null!==l;){if(l===t){l=null;break}if(null!==(u=l.sibling)){u.return=l.return,l=u;break}l=l.return}u=l}Di(e,t,o.children,n),t=t.child}return t;case 9:return o=t.type,r=(a=t.pendingProps).children,la(t,n),r=r(o=ua(o,a.unstable_observedBits)),t.effectTag|=1,Di(e,t,r,n),t.child;case 14:return a=Jo(o=t.type,t.pendingProps),Fi(e,t,o,a=Jo(o.type,a),r,n);case 15:return Mi(e,t,t.type,t.pendingProps,r,n);case 17:return r=t.type,o=t.pendingProps,o=t.elementType===r?o:Jo(r,o),null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),t.tag=1,wo(r)?(e=!0,So(t)):e=!1,la(t,n),ka(t,r,o),Sa(t,r,o,n),Bi(null,t,r,!0,e,n);case 19:return Yi(e,t,n)}throw Error(i(156,t.tag))};var Pu=null,Ru=null;function Au(e,t,n,r){this.tag=e,this.key=n,this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null,this.index=0,this.ref=null,this.pendingProps=t,this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null,this.mode=r,this.effectTag=0,this.lastEffect=this.firstEffect=this.nextEffect=null,this.childExpirationTime=this.expirationTime=0,this.alternate=null}function Nu(e,t,n,r){return new Au(e,t,n,r)}function Iu(e){return!(!(e=e.prototype)||!e.isReactComponent)}function Lu(e,t){var n=e.alternate;return null===n?((n=Nu(e.tag,t,e.key,e.mode)).elementType=e.elementType,n.type=e.type,n.stateNode=e.stateNode,n.alternate=e,e.alternate=n):(n.pendingProps=t,n.effectTag=0,n.nextEffect=null,n.firstEffect=null,n.lastEffect=null),n.childExpirationTime=e.childExpirationTime,n.expirationTime=e.expirationTime,n.child=e.child,n.memoizedProps=e.memoizedProps,n.memoizedState=e.memoizedState,n.updateQueue=e.updateQueue,t=e.dependencies,n.dependencies=null===t?null:{expirationTime:t.expirationTime,firstContext:t.firstContext,responders:t.responders},n.sibling=e.sibling,n.index=e.index,n.ref=e.ref,n}function Du(e,t,n,r,o,a){var l=2;if(r=e,"function"==typeof e)Iu(e)&&(l=1);else if("string"==typeof e)l=5;else e:switch(e){case ne:return ju(n.children,o,a,t);case le:l=8,o|=7;break;case re:l=8,o|=1;break;case oe:return(e=Nu(12,n,t,8|o)).elementType=oe,e.type=oe,e.expirationTime=a,e;case se:return(e=Nu(13,n,t,o)).type=se,e.elementType=se,e.expirationTime=a,e;case ce:return(e=Nu(19,n,t,o)).elementType=ce,e.expirationTime=a,e;default:if("object"==typeof e&&null!==e)switch(e.$$typeof){case ae:l=10;break e;case ie:l=9;break e;case ue:l=11;break e;case de:l=14;break e;case fe:l=16,r=null;break e;case pe:l=22;break e}throw Error(i(130,null==e?e:typeof e,""))}return(t=Nu(l,n,t,o)).elementType=e,t.type=r,t.expirationTime=a,t}function ju(e,t,n,r){return(e=Nu(7,e,r,t)).expirationTime=n,e}function Fu(e,t,n){return(e=Nu(6,e,null,t)).expirationTime=n,e}function Mu(e,t,n){return(t=Nu(4,null!==e.children?e.children:[],e.key,t)).expirationTime=n,t.stateNode={containerInfo:e.containerInfo,pendingChildren:null,implementation:e.implementation},t}function zu(e,t,n){this.tag=t,this.current=null,this.containerInfo=e,this.pingCache=this.pendingChildren=null,this.finishedExpirationTime=0,this.finishedWork=null,this.timeoutHandle=-1,this.pendingContext=this.context=null,this.hydrate=n,this.callbackNode=null,this.callbackPriority=90,this.lastExpiredTime=this.lastPingedTime=this.nextKnownPendingLevel=this.lastSuspendedTime=this.firstSuspendedTime=this.firstPendingTime=0}function Uu(e,t){var n=e.firstSuspendedTime;return e=e.lastSuspendedTime,0!==n&&n>=t&&e<=t}function $u(e,t){var n=e.firstSuspendedTime,r=e.lastSuspendedTime;n<t&&(e.firstSuspendedTime=t),(r>t||0===n)&&(e.lastSuspendedTime=t),t<=e.lastPingedTime&&(e.lastPingedTime=0),t<=e.lastExpiredTime&&(e.lastExpiredTime=0)}function Bu(e,t){t>e.firstPendingTime&&(e.firstPendingTime=t);var n=e.firstSuspendedTime;0!==n&&(t>=n?e.firstSuspendedTime=e.lastSuspendedTime=e.nextKnownPendingLevel=0:t>=e.lastSuspendedTime&&(e.lastSuspendedTime=t+1),t>e.nextKnownPendingLevel&&(e.nextKnownPendingLevel=t))}function qu(e,t){var n=e.lastExpiredTime;(0===n||n>t)&&(e.lastExpiredTime=t)}function Gu(e,t,n,r){var o=t.current,a=eu(),l=va.suspense;a=tu(a,o,l);e:if(n){t:{if(et(n=n._reactInternalFiber)!==n||1!==n.tag)throw Error(i(170));var u=n;do{switch(u.tag){case 3:u=u.stateNode.context;break t;case 1:if(wo(u.type)){u=u.stateNode.__reactInternalMemoizedMergedChildContext;break t}}u=u.return}while(null!==u);throw Error(i(171))}if(1===n.tag){var s=n.type;if(wo(s)){n=Eo(n,s,u);break e}}n=u}else n=ho;return null===t.context?t.context=n:t.pendingContext=n,(t=fa(a,l)).payload={element:e},null!==(r=void 0===r?null:r)&&(t.callback=r),pa(o,t),nu(o,a),a}function Hu(e){if(!(e=e.current).child)return null;switch(e.child.tag){case 5:default:return e.child.stateNode}}function Vu(e,t){null!==(e=e.memoizedState)&&null!==e.dehydrated&&e.retryTime<t&&(e.retryTime=t)}function Wu(e,t){Vu(e,t),(e=e.alternate)&&Vu(e,t)}function Qu(e,t,n){var r=new zu(e,t,n=null!=n&&!0===n.hydrate),o=Nu(3,null,null,2===t?7:1===t?3:0);r.current=o,o.stateNode=r,ca(o),e[Rn]=r.current,n&&0!==t&&function(e,t){var n=Je(t);Ct.forEach((function(e){ht(e,t,n)})),Ot.forEach((function(e){ht(e,t,n)}))}(0,9===e.nodeType?e:e.ownerDocument),this._internalRoot=r}function Ku(e){return!(!e||1!==e.nodeType&&9!==e.nodeType&&11!==e.nodeType&&(8!==e.nodeType||" react-mount-point-unstable "!==e.nodeValue))}function Xu(e,t,n,r,o){var a=n._reactRootContainer;if(a){var i=a._internalRoot;if("function"==typeof o){var l=o;o=function(){var e=Hu(i);l.call(e)}}Gu(t,i,e,o)}else{if(a=n._reactRootContainer=function(e,t){if(t||(t=!(!(t=e?9===e.nodeType?e.documentElement:e.firstChild:null)||1!==t.nodeType||!t.hasAttribute("data-reactroot"))),!t)for(var n;n=e.lastChild;)e.removeChild(n);return new Qu(e,0,t?{hydrate:!0}:void 0)}(n,r),i=a._internalRoot,"function"==typeof o){var u=o;o=function(){var e=Hu(i);u.call(e)}}su((function(){Gu(t,i,e,o)}))}return Hu(i)}function Yu(e,t,n){var r=3<arguments.length&&void 0!==arguments[3]?arguments[3]:null;return{$$typeof:te,key:null==r?null:""+r,children:e,containerInfo:t,implementation:n}}function Zu(e,t){var n=2<arguments.length&&void 0!==arguments[2]?arguments[2]:null;if(!Ku(t))throw Error(i(200));return Yu(e,t,null,n)}Qu.prototype.render=function(e){Gu(e,this._internalRoot,null,null)},Qu.prototype.unmount=function(){var e=this._internalRoot,t=e.containerInfo;Gu(null,e,null,(function(){t[Rn]=null}))},gt=function(e){if(13===e.tag){var t=Zo(eu(),150,100);nu(e,t),Wu(e,t)}},vt=function(e){13===e.tag&&(nu(e,3),Wu(e,3))},yt=function(e){if(13===e.tag){var t=eu();nu(e,t=tu(t,e,null)),Wu(e,t)}},O=function(e,t,n){switch(t){case"input":if(Te(e,n),t=n.name,"radio"===n.type&&null!=t){for(n=e;n.parentNode;)n=n.parentNode;for(n=n.querySelectorAll("input[name="+JSON.stringify(""+t)+'][type="radio"]'),t=0;t<n.length;t++){var r=n[t];if(r!==e&&r.form===e.form){var o=Ln(r);if(!o)throw Error(i(90));xe(r),Te(r,o)}}}break;case"textarea":Ne(e,n);break;case"select":null!=(t=n.value)&&Pe(e,!!n.multiple,t,!1)}},L=uu,D=function(e,t,n,r,o){var a=Al;Al|=4;try{return Wo(98,e.bind(null,t,n,r,o))}finally{0===(Al=a)&&Xo()}},j=function(){0==(49&Al)&&(function(){if(null!==Xl){var e=Xl;Xl=null,e.forEach((function(e,t){qu(t,e),au(t)})),Xo()}}(),Eu())},F=function(e,t){var n=Al;Al|=2;try{return e(t)}finally{0===(Al=n)&&Xo()}};var Ju={Events:[Nn,In,Ln,_,E,$n,function(e){at(e,Un)},N,I,Zt,ut,Eu,{current:!1}]};!function(e){var t=e.findFiberByHostInstance;(function(e){if("undefined"==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__)return!1;var t=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(t.isDisabled||!t.supportsFiber)return!0;try{var n=t.inject(e);Pu=function(e){try{t.onCommitFiberRoot(n,e,void 0,64==(64&e.current.effectTag))}catch(r){}},Ru=function(e){try{t.onCommitFiberUnmount(n,e)}catch(r){}}}catch(r){}})(o({},e,{overrideHookState:null,overrideProps:null,setSuspenseHandler:null,scheduleUpdate:null,currentDispatcherRef:X.ReactCurrentDispatcher,findHostInstanceByFiber:function(e){return null===(e=rt(e))?null:e.stateNode},findFiberByHostInstance:function(e){return t?t(e):null},findHostInstancesForRefresh:null,scheduleRefresh:null,scheduleRoot:null,setRefreshHandler:null,getCurrentFiber:null}))}({findFiberByHostInstance:An,bundleType:0,version:"16.14.0",rendererPackageName:"react-dom"}),t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=Ju,t.createPortal=Zu,t.findDOMNode=function(e){if(null==e)return null;if(1===e.nodeType)return e;var t=e._reactInternalFiber;if(void 0===t){if("function"==typeof e.render)throw Error(i(188));throw Error(i(268,Object.keys(e)))}return e=null===(e=rt(t))?null:e.stateNode},t.flushSync=function(e,t){if(0!=(48&Al))throw Error(i(187));var n=Al;Al|=1;try{return Wo(99,e.bind(null,t))}finally{Al=n,Xo()}},t.hydrate=function(e,t,n){if(!Ku(t))throw Error(i(200));return Xu(null,e,t,!0,n)},t.render=function(e,t,n){if(!Ku(t))throw Error(i(200));return Xu(null,e,t,!1,n)},t.unmountComponentAtNode=function(e){if(!Ku(e))throw Error(i(40));return!!e._reactRootContainer&&(su((function(){Xu(null,null,e,!1,(function(){e._reactRootContainer=null,e[Rn]=null}))})),!0)},t.unstable_batchedUpdates=uu,t.unstable_createPortal=function(e,t){return Zu(e,t,2<arguments.length&&void 0!==arguments[2]?arguments[2]:null)},t.unstable_renderSubtreeIntoContainer=function(e,t,n,r){if(!Ku(n))throw Error(i(200));if(null==e||void 0===e._reactInternalFiber)throw Error(i(38));return Xu(e,t,n,!1,r)},t.version="16.14.0"},function(e,t,n){"use strict";e.exports=n(34)},function(e,t,n){"use strict";var r,o,a,i,l;if("undefined"==typeof window||"function"!=typeof MessageChannel){var u=null,s=null,c=function(){if(null!==u)try{var e=t.unstable_now();u(!0,e),u=null}catch(n){throw setTimeout(c,0),n}},d=Date.now();t.unstable_now=function(){return Date.now()-d},r=function(e){null!==u?setTimeout(r,0,e):(u=e,setTimeout(c,0))},o=function(e,t){s=setTimeout(e,t)},a=function(){clearTimeout(s)},i=function(){return!1},l=t.unstable_forceFrameRate=function(){}}else{var f=window.performance,p=window.Date,m=window.setTimeout,h=window.clearTimeout;if("undefined"!=typeof console){var g=window.cancelAnimationFrame;"function"!=typeof window.requestAnimationFrame&&console.error("This browser doesn't support requestAnimationFrame. Make sure that you load a polyfill in older browsers. https://fb.me/react-polyfills"),"function"!=typeof g&&console.error("This browser doesn't support cancelAnimationFrame. Make sure that you load a polyfill in older browsers. https://fb.me/react-polyfills")}if("object"==typeof f&&"function"==typeof f.now)t.unstable_now=function(){return f.now()};else{var v=p.now();t.unstable_now=function(){return p.now()-v}}var y=!1,b=null,w=-1,x=5,k=0;i=function(){return t.unstable_now()>=k},l=function(){},t.unstable_forceFrameRate=function(e){0>e||125<e?console.error("forceFrameRate takes a positive int between 0 and 125, forcing framerates higher than 125 fps is not unsupported"):x=0<e?Math.floor(1e3/e):5};var E=new MessageChannel,S=E.port2;E.port1.onmessage=function(){if(null!==b){var e=t.unstable_now();k=e+x;try{b(!0,e)?S.postMessage(null):(y=!1,b=null)}catch(n){throw S.postMessage(null),n}}else y=!1},r=function(e){b=e,y||(y=!0,S.postMessage(null))},o=function(e,n){w=m((function(){e(t.unstable_now())}),n)},a=function(){h(w),w=-1}}function T(e,t){var n=e.length;e.push(t);e:for(;;){var r=n-1>>>1,o=e[r];if(!(void 0!==o&&0<O(o,t)))break e;e[r]=t,e[n]=o,n=r}}function _(e){return void 0===(e=e[0])?null:e}function C(e){var t=e[0];if(void 0!==t){var n=e.pop();if(n!==t){e[0]=n;e:for(var r=0,o=e.length;r<o;){var a=2*(r+1)-1,i=e[a],l=a+1,u=e[l];if(void 0!==i&&0>O(i,n))void 0!==u&&0>O(u,i)?(e[r]=u,e[l]=n,r=l):(e[r]=i,e[a]=n,r=a);else{if(!(void 0!==u&&0>O(u,n)))break e;e[r]=u,e[l]=n,r=l}}}return t}return null}function O(e,t){var n=e.sortIndex-t.sortIndex;return 0!==n?n:e.id-t.id}var P=[],R=[],A=1,N=null,I=3,L=!1,D=!1,j=!1;function F(e){for(var t=_(R);null!==t;){if(null===t.callback)C(R);else{if(!(t.startTime<=e))break;C(R),t.sortIndex=t.expirationTime,T(P,t)}t=_(R)}}function M(e){if(j=!1,F(e),!D)if(null!==_(P))D=!0,r(z);else{var t=_(R);null!==t&&o(M,t.startTime-e)}}function z(e,n){D=!1,j&&(j=!1,a()),L=!0;var r=I;try{for(F(n),N=_(P);null!==N&&(!(N.expirationTime>n)||e&&!i());){var l=N.callback;if(null!==l){N.callback=null,I=N.priorityLevel;var u=l(N.expirationTime<=n);n=t.unstable_now(),"function"==typeof u?N.callback=u:N===_(P)&&C(P),F(n)}else C(P);N=_(P)}if(null!==N)var s=!0;else{var c=_(R);null!==c&&o(M,c.startTime-n),s=!1}return s}finally{N=null,I=r,L=!1}}function U(e){switch(e){case 1:return-1;case 2:return 250;case 5:return 1073741823;case 4:return 1e4;default:return 5e3}}var $=l;t.unstable_IdlePriority=5,t.unstable_ImmediatePriority=1,t.unstable_LowPriority=4,t.unstable_NormalPriority=3,t.unstable_Profiling=null,t.unstable_UserBlockingPriority=2,t.unstable_cancelCallback=function(e){e.callback=null},t.unstable_continueExecution=function(){D||L||(D=!0,r(z))},t.unstable_getCurrentPriorityLevel=function(){return I},t.unstable_getFirstCallbackNode=function(){return _(P)},t.unstable_next=function(e){switch(I){case 1:case 2:case 3:var t=3;break;default:t=I}var n=I;I=t;try{return e()}finally{I=n}},t.unstable_pauseExecution=function(){},t.unstable_requestPaint=$,t.unstable_runWithPriority=function(e,t){switch(e){case 1:case 2:case 3:case 4:case 5:break;default:e=3}var n=I;I=e;try{return t()}finally{I=n}},t.unstable_scheduleCallback=function(e,n,i){var l=t.unstable_now();if("object"==typeof i&&null!==i){var u=i.delay;u="number"==typeof u&&0<u?l+u:l,i="number"==typeof i.timeout?i.timeout:U(e)}else i=U(e),u=l;return e={id:A++,callback:n,priorityLevel:e,startTime:u,expirationTime:i=u+i,sortIndex:-1},u>l?(e.sortIndex=u,T(R,e),null===_(P)&&e===_(R)&&(j?a():j=!0,o(M,u-l))):(e.sortIndex=i,T(P,e),D||L||(D=!0,r(z))),e},t.unstable_shouldYield=function(){var e=t.unstable_now();F(e);var n=_(P);return n!==N&&null!==N&&null!==n&&null!==n.callback&&n.startTime<=e&&n.expirationTime<N.expirationTime||i()},t.unstable_wrapCallback=function(e){var t=I;return function(){var n=I;I=t;try{return e.apply(this,arguments)}finally{I=n}}}},function(e,t,n){"use strict";var r=n(36);function o(){}function a(){}a.resetWarningCache=o,e.exports=function(){function e(e,t,n,o,a,i){if(i!==r){var l=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw l.name="Invariant Violation",l}}function t(){return e}e.isRequired=e;var n={array:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,objectOf:t,oneOf:t,oneOfType:t,shape:t,exact:t,checkPropTypes:a,resetWarningCache:o};return n.PropTypes=n,n}},function(e,t,n){"use strict";e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},function(e,t){e.exports=Array.isArray||function(e){return"[object Array]"==Object.prototype.toString.call(e)}},function(e,t,n){"use strict";var r="function"==typeof Symbol&&Symbol.for,o=r?Symbol.for("react.element"):60103,a=r?Symbol.for("react.portal"):60106,i=r?Symbol.for("react.fragment"):60107,l=r?Symbol.for("react.strict_mode"):60108,u=r?Symbol.for("react.profiler"):60114,s=r?Symbol.for("react.provider"):60109,c=r?Symbol.for("react.context"):60110,d=r?Symbol.for("react.async_mode"):60111,f=r?Symbol.for("react.concurrent_mode"):60111,p=r?Symbol.for("react.forward_ref"):60112,m=r?Symbol.for("react.suspense"):60113,h=r?Symbol.for("react.suspense_list"):60120,g=r?Symbol.for("react.memo"):60115,v=r?Symbol.for("react.lazy"):60116,y=r?Symbol.for("react.block"):60121,b=r?Symbol.for("react.fundamental"):60117,w=r?Symbol.for("react.responder"):60118,x=r?Symbol.for("react.scope"):60119;function k(e){if("object"==typeof e&&null!==e){var t=e.$$typeof;switch(t){case o:switch(e=e.type){case d:case f:case i:case u:case l:case m:return e;default:switch(e=e&&e.$$typeof){case c:case p:case v:case g:case s:return e;default:return t}}case a:return t}}}function E(e){return k(e)===f}t.AsyncMode=d,t.ConcurrentMode=f,t.ContextConsumer=c,t.ContextProvider=s,t.Element=o,t.ForwardRef=p,t.Fragment=i,t.Lazy=v,t.Memo=g,t.Portal=a,t.Profiler=u,t.StrictMode=l,t.Suspense=m,t.isAsyncMode=function(e){return E(e)||k(e)===d},t.isConcurrentMode=E,t.isContextConsumer=function(e){return k(e)===c},t.isContextProvider=function(e){return k(e)===s},t.isElement=function(e){return"object"==typeof e&&null!==e&&e.$$typeof===o},t.isForwardRef=function(e){return k(e)===p},t.isFragment=function(e){return k(e)===i},t.isLazy=function(e){return k(e)===v},t.isMemo=function(e){return k(e)===g},t.isPortal=function(e){return k(e)===a},t.isProfiler=function(e){return k(e)===u},t.isStrictMode=function(e){return k(e)===l},t.isSuspense=function(e){return k(e)===m},t.isValidElementType=function(e){return"string"==typeof e||"function"==typeof e||e===i||e===f||e===u||e===l||e===m||e===h||"object"==typeof e&&null!==e&&(e.$$typeof===v||e.$$typeof===g||e.$$typeof===s||e.$$typeof===c||e.$$typeof===p||e.$$typeof===b||e.$$typeof===w||e.$$typeof===x||e.$$typeof===y)},t.typeOf=k},,function(e,t,n){const r=n(41),o=n(42),a=new Set;function i(e){void 0===e?e=Object.keys(r.languages).filter((e=>"meta"!=e)):Array.isArray(e)||(e=[e]);const t=[...a,...Object.keys(Prism.languages)];o(r,e,t).load((e=>{if(!(e in r.languages))return void(i.silent||console.warn("Language does not exist: "+e));const t="./prism-"+e;delete n.c[n(16).resolve(t)],delete Prism.languages[e],n(16)(t),a.add(e)}))}i.silent=!1,e.exports=i},function(e,t,n){e.exports&&(e.exports={core:{meta:{path:"components/prism-core.js",option:"mandatory"},core:"Core"},themes:{meta:{path:"themes/{id}.css",link:"index.html?theme={id}",exclusive:!0},prism:{title:"Default",option:"default"},"prism-dark":"Dark","prism-funky":"Funky","prism-okaidia":{title:"Okaidia",owner:"ocodia"},"prism-twilight":{title:"Twilight",owner:"remybach"},"prism-coy":{title:"Coy",owner:"tshedor"},"prism-solarizedlight":{title:"Solarized Light",owner:"hectormatos2011 "},"prism-tomorrow":{title:"Tomorrow Night",owner:"Rosey"}},languages:{meta:{path:"components/prism-{id}",noCSS:!0,examplesPath:"examples/prism-{id}",addCheckAll:!0},markup:{title:"Markup",alias:["html","xml","svg","mathml","ssml","atom","rss"],aliasTitles:{html:"HTML",xml:"XML",svg:"SVG",mathml:"MathML",ssml:"SSML",atom:"Atom",rss:"RSS"},option:"default"},css:{title:"CSS",option:"default",modify:"markup"},clike:{title:"C-like",option:"default"},javascript:{title:"JavaScript",require:"clike",modify:"markup",optional:"regex",alias:"js",option:"default"},abap:{title:"ABAP",owner:"dellagustin"},abnf:{title:"ABNF",owner:"RunDevelopment"},actionscript:{title:"ActionScript",require:"javascript",modify:"markup",owner:"Golmote"},ada:{title:"Ada",owner:"Lucretia"},agda:{title:"Agda",owner:"xy-ren"},al:{title:"AL",owner:"RunDevelopment"},antlr4:{title:"ANTLR4",alias:"g4",owner:"RunDevelopment"},apacheconf:{title:"Apache Configuration",owner:"GuiTeK"},apl:{title:"APL",owner:"ngn"},applescript:{title:"AppleScript",owner:"Golmote"},aql:{title:"AQL",owner:"RunDevelopment"},arduino:{title:"Arduino",require:"cpp",owner:"dkern"},arff:{title:"ARFF",owner:"Golmote"},asciidoc:{alias:"adoc",title:"AsciiDoc",owner:"Golmote"},aspnet:{title:"ASP.NET (C#)",require:["markup","csharp"],owner:"nauzilus"},asm6502:{title:"6502 Assembly",owner:"kzurawel"},autohotkey:{title:"AutoHotkey",owner:"aviaryan"},autoit:{title:"AutoIt",owner:"Golmote"},bash:{title:"Bash",alias:"shell",aliasTitles:{shell:"Shell"},owner:"zeitgeist87"},basic:{title:"BASIC",owner:"Golmote"},batch:{title:"Batch",owner:"Golmote"},bbcode:{title:"BBcode",alias:"shortcode",aliasTitles:{shortcode:"Shortcode"},owner:"RunDevelopment"},birb:{title:"Birb",require:"clike",owner:"Calamity210"},bison:{title:"Bison",require:"c",owner:"Golmote"},bnf:{title:"BNF",alias:"rbnf",aliasTitles:{rbnf:"RBNF"},owner:"RunDevelopment"},brainfuck:{title:"Brainfuck",owner:"Golmote"},brightscript:{title:"BrightScript",owner:"RunDevelopment"},bro:{title:"Bro",owner:"wayward710"},bsl:{title:"BSL (1C:Enterprise)",alias:"oscript",aliasTitles:{oscript:"OneScript"},owner:"Diversus23"},c:{title:"C",require:"clike",owner:"zeitgeist87"},csharp:{title:"C#",require:"clike",alias:["cs","dotnet"],owner:"mvalipour"},cpp:{title:"C++",require:"c",owner:"zeitgeist87"},cil:{title:"CIL",owner:"sbrl"},clojure:{title:"Clojure",owner:"troglotit"},cmake:{title:"CMake",owner:"mjrogozinski"},coffeescript:{title:"CoffeeScript",require:"javascript",alias:"coffee",owner:"R-osey"},concurnas:{title:"Concurnas",alias:"conc",owner:"jasontatton"},csp:{title:"Content-Security-Policy",owner:"ScottHelme"},crystal:{title:"Crystal",require:"ruby",owner:"MakeNowJust"},"css-extras":{title:"CSS Extras",require:"css",modify:"css",owner:"milesj"},cypher:{title:"Cypher",owner:"RunDevelopment"},d:{title:"D",require:"clike",owner:"Golmote"},dart:{title:"Dart",require:"clike",owner:"Golmote"},dax:{title:"DAX",owner:"peterbud"},dhall:{title:"Dhall",owner:"RunDevelopment"},diff:{title:"Diff",owner:"uranusjr"},django:{title:"Django/Jinja2",require:"markup-templating",alias:"jinja2",owner:"romanvm"},"dns-zone-file":{title:"DNS zone file",owner:"RunDevelopment",alias:"dns-zone"},docker:{title:"Docker",alias:"dockerfile",owner:"JustinBeckwith"},ebnf:{title:"EBNF",owner:"RunDevelopment"},editorconfig:{title:"EditorConfig",owner:"osipxd"},eiffel:{title:"Eiffel",owner:"Conaclos"},ejs:{title:"EJS",require:["javascript","markup-templating"],owner:"RunDevelopment",alias:"eta",aliasTitles:{eta:"Eta"}},elixir:{title:"Elixir",owner:"Golmote"},elm:{title:"Elm",owner:"zwilias"},etlua:{title:"Embedded Lua templating",require:["lua","markup-templating"],owner:"RunDevelopment"},erb:{title:"ERB",require:["ruby","markup-templating"],owner:"Golmote"},erlang:{title:"Erlang",owner:"Golmote"},"excel-formula":{title:"Excel Formula",alias:["xlsx","xls"],owner:"RunDevelopment"},fsharp:{title:"F#",require:"clike",owner:"simonreynolds7"},factor:{title:"Factor",owner:"catb0t"},"firestore-security-rules":{title:"Firestore security rules",require:"clike",owner:"RunDevelopment"},flow:{title:"Flow",require:"javascript",owner:"Golmote"},fortran:{title:"Fortran",owner:"Golmote"},ftl:{title:"FreeMarker Template Language",require:"markup-templating",owner:"RunDevelopment"},gml:{title:"GameMaker Language",alias:"gamemakerlanguage",require:"clike",owner:"LiarOnce"},gcode:{title:"G-code",owner:"RunDevelopment"},gdscript:{title:"GDScript",owner:"RunDevelopment"},gedcom:{title:"GEDCOM",owner:"Golmote"},gherkin:{title:"Gherkin",owner:"hason"},git:{title:"Git",owner:"lgiraudel"},glsl:{title:"GLSL",require:"c",owner:"Golmote"},go:{title:"Go",require:"clike",owner:"arnehormann"},graphql:{title:"GraphQL",optional:["markdown"],owner:"Golmote"},groovy:{title:"Groovy",require:"clike",owner:"robfletcher"},haml:{title:"Haml",require:"ruby",optional:["css","css-extras","coffeescript","erb","javascript","less","markdown","scss","textile"],owner:"Golmote"},handlebars:{title:"Handlebars",require:"markup-templating",owner:"Golmote"},haskell:{title:"Haskell",alias:"hs",owner:"bholst"},haxe:{title:"Haxe",require:"clike",owner:"Golmote"},hcl:{title:"HCL",owner:"outsideris"},hlsl:{title:"HLSL",require:"c",owner:"RunDevelopment"},http:{title:"HTTP",optional:["css","javascript","json","markup"],owner:"danielgtaylor"},hpkp:{title:"HTTP Public-Key-Pins",owner:"ScottHelme"},hsts:{title:"HTTP Strict-Transport-Security",owner:"ScottHelme"},ichigojam:{title:"IchigoJam",owner:"BlueCocoa"},icon:{title:"Icon",owner:"Golmote"},ignore:{title:".ignore",owner:"osipxd",alias:["gitignore","hgignore","npmignore"],aliasTitles:{gitignore:".gitignore",hgignore:".hgignore",npmignore:".npmignore"}},inform7:{title:"Inform 7",owner:"Golmote"},ini:{title:"Ini",owner:"aviaryan"},io:{title:"Io",owner:"AlesTsurko"},j:{title:"J",owner:"Golmote"},java:{title:"Java",require:"clike",owner:"sherblot"},javadoc:{title:"JavaDoc",require:["markup","java","javadoclike"],modify:"java",optional:"scala",owner:"RunDevelopment"},javadoclike:{title:"JavaDoc-like",modify:["java","javascript","php"],owner:"RunDevelopment"},javastacktrace:{title:"Java stack trace",owner:"RunDevelopment"},jolie:{title:"Jolie",require:"clike",owner:"thesave"},jq:{title:"JQ",owner:"RunDevelopment"},jsdoc:{title:"JSDoc",require:["javascript","javadoclike","typescript"],modify:"javascript",optional:["actionscript","coffeescript"],owner:"RunDevelopment"},"js-extras":{title:"JS Extras",require:"javascript",modify:"javascript",optional:["actionscript","coffeescript","flow","n4js","typescript"],owner:"RunDevelopment"},json:{title:"JSON",alias:"webmanifest",aliasTitles:{webmanifest:"Web App Manifest"},owner:"CupOfTea696"},json5:{title:"JSON5",require:"json",owner:"RunDevelopment"},jsonp:{title:"JSONP",require:"json",owner:"RunDevelopment"},jsstacktrace:{title:"JS stack trace",owner:"sbrl"},"js-templates":{title:"JS Templates",require:"javascript",modify:"javascript",optional:["css","css-extras","graphql","markdown","markup"],owner:"RunDevelopment"},julia:{title:"Julia",owner:"cdagnino"},keyman:{title:"Keyman",owner:"mcdurdin"},kotlin:{title:"Kotlin",alias:["kt","kts"],aliasTitles:{kts:"Kotlin Script"},require:"clike",owner:"Golmote"},latex:{title:"LaTeX",alias:["tex","context"],aliasTitles:{tex:"TeX",context:"ConTeXt"},owner:"japborst"},latte:{title:"Latte",require:["clike","markup-templating","php"],owner:"nette"},less:{title:"Less",require:"css",optional:"css-extras",owner:"Golmote"},lilypond:{title:"LilyPond",require:"scheme",alias:"ly",owner:"RunDevelopment"},liquid:{title:"Liquid",owner:"cinhtau"},lisp:{title:"Lisp",alias:["emacs","elisp","emacs-lisp"],owner:"JuanCaicedo"},livescript:{title:"LiveScript",owner:"Golmote"},llvm:{title:"LLVM IR",owner:"porglezomp"},lolcode:{title:"LOLCODE",owner:"Golmote"},lua:{title:"Lua",owner:"Golmote"},makefile:{title:"Makefile",owner:"Golmote"},markdown:{title:"Markdown",require:"markup",alias:"md",owner:"Golmote"},"markup-templating":{title:"Markup templating",require:"markup",owner:"Golmote"},matlab:{title:"MATLAB",owner:"Golmote"},mel:{title:"MEL",owner:"Golmote"},mizar:{title:"Mizar",owner:"Golmote"},mongodb:{title:"MongoDB",owner:"airs0urce",require:"javascript"},monkey:{title:"Monkey",owner:"Golmote"},moonscript:{title:"MoonScript",alias:"moon",owner:"RunDevelopment"},n1ql:{title:"N1QL",owner:"TMWilds"},n4js:{title:"N4JS",require:"javascript",optional:"jsdoc",alias:"n4jsd",owner:"bsmith-n4"},"nand2tetris-hdl":{title:"Nand To Tetris HDL",owner:"stephanmax"},naniscript:{title:"Naninovel Script",owner:"Elringus",alias:"nani"},nasm:{title:"NASM",owner:"rbmj"},neon:{title:"NEON",owner:"nette"},nginx:{title:"nginx",owner:"westonganger",require:"clike"},nim:{title:"Nim",owner:"Golmote"},nix:{title:"Nix",owner:"Golmote"},nsis:{title:"NSIS",owner:"idleberg"},objectivec:{title:"Objective-C",require:"c",alias:"objc",owner:"uranusjr"},ocaml:{title:"OCaml",owner:"Golmote"},opencl:{title:"OpenCL",require:"c",modify:["c","cpp"],owner:"Milania1"},oz:{title:"Oz",owner:"Golmote"},parigp:{title:"PARI/GP",owner:"Golmote"},parser:{title:"Parser",require:"markup",owner:"Golmote"},pascal:{title:"Pascal",alias:"objectpascal",aliasTitles:{objectpascal:"Object Pascal"},owner:"Golmote"},pascaligo:{title:"Pascaligo",owner:"DefinitelyNotAGoat"},pcaxis:{title:"PC-Axis",alias:"px",owner:"RunDevelopment"},peoplecode:{title:"PeopleCode",alias:"pcode",owner:"RunDevelopment"},perl:{title:"Perl",owner:"Golmote"},php:{title:"PHP",require:["clike","markup-templating"],owner:"milesj"},phpdoc:{title:"PHPDoc",require:["php","javadoclike"],modify:"php",owner:"RunDevelopment"},"php-extras":{title:"PHP Extras",require:"php",modify:"php",owner:"milesj"},plsql:{title:"PL/SQL",require:"sql",owner:"Golmote"},powerquery:{title:"PowerQuery",alias:["pq","mscript"],owner:"peterbud"},powershell:{title:"PowerShell",owner:"nauzilus"},processing:{title:"Processing",require:"clike",owner:"Golmote"},prolog:{title:"Prolog",owner:"Golmote"},properties:{title:".properties",owner:"Golmote"},protobuf:{title:"Protocol Buffers",require:"clike",owner:"just-boris"},pug:{title:"Pug",require:["markup","javascript"],optional:["coffeescript","ejs","handlebars","less","livescript","markdown","scss","stylus","twig"],owner:"Golmote"},puppet:{title:"Puppet",owner:"Golmote"},pure:{title:"Pure",optional:["c","cpp","fortran"],owner:"Golmote"},purebasic:{title:"PureBasic",require:"clike",alias:"pbfasm",owner:"HeX0R101"},purescript:{title:"PureScript",require:"haskell",alias:"purs",owner:"sriharshachilakapati"},python:{title:"Python",alias:"py",owner:"multipetros"},q:{title:"Q (kdb+ database)",owner:"Golmote"},qml:{title:"QML",require:"javascript",owner:"RunDevelopment"},qore:{title:"Qore",require:"clike",owner:"temnroegg"},r:{title:"R",owner:"Golmote"},racket:{title:"Racket",require:"scheme",alias:"rkt",owner:"RunDevelopment"},jsx:{title:"React JSX",require:["markup","javascript"],optional:["jsdoc","js-extras","js-templates"],owner:"vkbansal"},tsx:{title:"React TSX",require:["jsx","typescript"]},reason:{title:"Reason",require:"clike",owner:"Golmote"},regex:{title:"Regex",owner:"RunDevelopment"},renpy:{title:"Ren'py",alias:"rpy",owner:"HyuchiaDiego"},rest:{title:"reST (reStructuredText)",owner:"Golmote"},rip:{title:"Rip",owner:"ravinggenius"},roboconf:{title:"Roboconf",owner:"Golmote"},robotframework:{title:"Robot Framework",alias:"robot",owner:"RunDevelopment"},ruby:{title:"Ruby",require:"clike",alias:"rb",owner:"samflores"},rust:{title:"Rust",owner:"Golmote"},sas:{title:"SAS",optional:["groovy","lua","sql"],owner:"Golmote"},sass:{title:"Sass (Sass)",require:"css",owner:"Golmote"},scss:{title:"Sass (Scss)",require:"css",optional:"css-extras",owner:"MoOx"},scala:{title:"Scala",require:"java",owner:"jozic"},scheme:{title:"Scheme",owner:"bacchus123"},"shell-session":{title:"Shell session",require:"bash",alias:["sh-session","shellsession"],owner:"RunDevelopment"},smali:{title:"Smali",owner:"RunDevelopment"},smalltalk:{title:"Smalltalk",owner:"Golmote"},smarty:{title:"Smarty",require:"markup-templating",owner:"Golmote"},sml:{title:"SML",alias:"smlnj",aliasTitles:{smlnj:"SML/NJ"},owner:"RunDevelopment"},solidity:{title:"Solidity (Ethereum)",alias:"sol",require:"clike",owner:"glachaud"},"solution-file":{title:"Solution file",alias:"sln",owner:"RunDevelopment"},soy:{title:"Soy (Closure Template)",require:"markup-templating",owner:"Golmote"},sparql:{title:"SPARQL",require:"turtle",owner:"Triply-Dev",alias:"rq"},"splunk-spl":{title:"Splunk SPL",owner:"RunDevelopment"},sqf:{title:"SQF: Status Quo Function (Arma 3)",require:"clike",owner:"RunDevelopment"},sql:{title:"SQL",owner:"multipetros"},stan:{title:"Stan",owner:"RunDevelopment"},iecst:{title:"Structured Text (IEC 61131-3)",owner:"serhioromano"},stylus:{title:"Stylus",owner:"vkbansal"},swift:{title:"Swift",require:"clike",owner:"chrischares"},"t4-templating":{title:"T4 templating",owner:"RunDevelopment"},"t4-cs":{title:"T4 Text Templates (C#)",require:["t4-templating","csharp"],alias:"t4",owner:"RunDevelopment"},"t4-vb":{title:"T4 Text Templates (VB)",require:["t4-templating","vbnet"],owner:"RunDevelopment"},tap:{title:"TAP",owner:"isaacs",require:"yaml"},tcl:{title:"Tcl",owner:"PeterChaplin"},tt2:{title:"Template Toolkit 2",require:["clike","markup-templating"],owner:"gflohr"},textile:{title:"Textile",require:"markup",optional:"css",owner:"Golmote"},toml:{title:"TOML",owner:"RunDevelopment"},turtle:{title:"Turtle",alias:"trig",aliasTitles:{trig:"TriG"},owner:"jakubklimek"},twig:{title:"Twig",require:"markup",owner:"brandonkelly"},typescript:{title:"TypeScript",require:"javascript",optional:"js-templates",alias:"ts",owner:"vkbansal"},typoscript:{title:"TypoScript",alias:"tsconfig",aliasTitles:{tsconfig:"TSConfig"},owner:"dkern"},unrealscript:{title:"UnrealScript",alias:["uscript","uc"],owner:"RunDevelopment"},vala:{title:"Vala",require:"clike",optional:"regex",owner:"TemplarVolk"},vbnet:{title:"VB.Net",require:"basic",owner:"Bigsby"},velocity:{title:"Velocity",require:"markup",owner:"Golmote"},verilog:{title:"Verilog",owner:"a-rey"},vhdl:{title:"VHDL",owner:"a-rey"},vim:{title:"vim",owner:"westonganger"},"visual-basic":{title:"Visual Basic",alias:["vb","vba"],aliasTitles:{vba:"VBA"},owner:"Golmote"},warpscript:{title:"WarpScript",owner:"RunDevelopment"},wasm:{title:"WebAssembly",owner:"Golmote"},wiki:{title:"Wiki markup",require:"markup",owner:"Golmote"},xeora:{title:"Xeora",require:"markup",alias:"xeoracube",aliasTitles:{xeoracube:"XeoraCube"},owner:"freakmaxi"},"xml-doc":{title:"XML doc (.net)",require:"markup",modify:["csharp","fsharp","vbnet"],owner:"RunDevelopment"},xojo:{title:"Xojo (REALbasic)",owner:"Golmote"},xquery:{title:"XQuery",require:"markup",owner:"Golmote"},yaml:{title:"YAML",alias:"yml",owner:"hason"},yang:{title:"YANG",owner:"RunDevelopment"},zig:{title:"Zig",owner:"RunDevelopment"}},plugins:{meta:{path:"plugins/{id}/prism-{id}",link:"plugins/{id}/"},"line-highlight":{title:"Line Highlight",description:"Highlights specific lines and/or line ranges."},"line-numbers":{title:"Line Numbers",description:"Line number at the beginning of code lines.",owner:"kuba-kubula"},"show-invisibles":{title:"Show Invisibles",description:"Show hidden characters such as tabs and line breaks.",optional:["autolinker","data-uri-highlight"]},autolinker:{title:"Autolinker",description:"Converts URLs and emails in code to clickable links. Parses Markdown links in comments."},wpd:{title:"WebPlatform Docs",description:'Makes tokens link to <a href="https://webplatform.github.io/docs/">WebPlatform.org documentation</a>. The links open in a new tab.'},"custom-class":{title:"Custom Class",description:"This plugin allows you to prefix Prism's default classes (<code>.comment</code> can become <code>.namespace--comment</code>) or replace them with your defined ones (like <code>.editor__comment</code>). You can even add new classes.",owner:"dvkndn",noCSS:!0},"file-highlight":{title:"File Highlight",description:"Fetch external files and highlight them with Prism. Used on the Prism website itself.",noCSS:!0},"show-language":{title:"Show Language",description:"Display the highlighted language in code blocks (inline code does not show the label).",owner:"nauzilus",noCSS:!0,require:"toolbar"},"jsonp-highlight":{title:"JSONP Highlight",description:"Fetch content with JSONP and highlight some interesting content (e.g. GitHub/Gists or Bitbucket API).",noCSS:!0,owner:"nauzilus"},"highlight-keywords":{title:"Highlight Keywords",description:"Adds special CSS classes for each keyword matched in the code. For example, the keyword <code>if</code> will have the class <code>keyword-if</code> as well. You can have fine grained control over the appearance of each keyword by providing your own CSS rules.",owner:"vkbansal",noCSS:!0},"remove-initial-line-feed":{title:"Remove initial line feed",description:"Removes the initial line feed in code blocks.",owner:"Golmote",noCSS:!0},"inline-color":{title:"Inline color",description:"Adds a small inline preview for colors in style sheets.",require:"css-extras",owner:"RunDevelopment"},previewers:{title:"Previewers",description:"Previewers for angles, colors, gradients, easing and time.",require:"css-extras",owner:"Golmote"},autoloader:{title:"Autoloader",description:"Automatically loads the needed languages to highlight the code blocks.",owner:"Golmote",noCSS:!0},"keep-markup":{title:"Keep Markup",description:"Prevents custom markup from being dropped out during highlighting.",owner:"Golmote",optional:"normalize-whitespace",noCSS:!0},"command-line":{title:"Command Line",description:"Display a command line with a prompt and, optionally, the output/response from the commands.",owner:"chriswells0"},"unescaped-markup":{title:"Unescaped Markup",description:"Write markup without having to escape anything."},"normalize-whitespace":{title:"Normalize Whitespace",description:"Supports multiple operations to normalize whitespace in code blocks.",owner:"zeitgeist87",optional:"unescaped-markup",noCSS:!0},"data-uri-highlight":{title:"Data-URI Highlight",description:"Highlights data-URI contents.",owner:"Golmote",noCSS:!0},toolbar:{title:"Toolbar",description:"Attach a toolbar for plugins to easily register buttons on the top of a code block.",owner:"mAAdhaTTah"},"copy-to-clipboard":{title:"Copy to Clipboard Button",description:"Add a button that copies the code block to the clipboard when clicked.",owner:"mAAdhaTTah",require:"toolbar",noCSS:!0},"download-button":{title:"Download Button",description:"A button in the toolbar of a code block adding a convenient way to download a code file.",owner:"Golmote",require:"toolbar",noCSS:!0},"match-braces":{title:"Match braces",description:"Highlights matching braces.",owner:"RunDevelopment"},"diff-highlight":{title:"Diff Highlight",description:"Highlights the code inside diff blocks.",owner:"RunDevelopment",require:"diff"},"filter-highlight-all":{title:"Filter highlightAll",description:"Filters the elements the <code>highlightAll</code> and <code>highlightAllUnder</code> methods actually highlight.",owner:"RunDevelopment",noCSS:!0},treeview:{title:"Treeview",description:"A language with special styles to highlight file system tree structures.",owner:"Golmote"}}})},function(e,t,n){"use strict";var r=function(){var e=function(){};function t(e,t){Array.isArray(e)?e.forEach(t):null!=e&&t(e,0)}function n(e){for(var t={},n=0,r=e.length;n<r;n++)t[e[n]]=!0;return t}function r(e){var n={},r=[];function o(r,a){if(!(r in n)){a.push(r);var i=a.indexOf(r);if(i<a.length-1)throw new Error("Circular dependency: "+a.slice(i).join(" -> "));var l={},u=e[r];if(u){function s(t){if(!(t in e))throw new Error(r+" depends on an unknown component "+t);if(!(t in l))for(var i in o(t,a),l[t]=!0,n[t])l[i]=!0}t(u.require,s),t(u.optional,s),t(u.modify,s)}n[r]=l,a.pop()}}return function(e){var t=n[e];return t||(o(e,r),t=n[e]),t}}function o(e){for(var t in e)return!0;return!1}return function(a,i,l){var u=function(e){var t={};for(var n in e){var r=e[n];for(var o in r)if("meta"!=o){var a=r[o];t[o]="string"==typeof a?{title:a}:a}}return t}(a),s=function(e){var n;return function(r){if(r in e)return r;if(!n)for(var o in n={},e){var a=e[o];t(a&&a.alias,(function(t){if(t in n)throw new Error(t+" cannot be alias for both "+o+" and "+n[t]);if(t in e)throw new Error(t+" cannot be alias of "+o+" because it is a component.");n[t]=o}))}return n[r]||r}}(u);i=i.map(s),l=(l||[]).map(s);var c=n(i),d=n(l);i.forEach((function e(n){var r=u[n];t(r&&r.require,(function(t){t in d||(c[t]=!0,e(t))}))}));for(var f,p=r(u),m=c;o(m);){for(var h in f={},m){var g=u[h];t(g&&g.modify,(function(e){e in d&&(f[e]=!0)}))}for(var v in d)if(!(v in c))for(var y in p(v))if(y in c){f[v]=!0;break}for(var b in m=f)c[b]=!0}var w={getIds:function(){var e=[];return w.load((function(t){e.push(t)})),e},load:function(t,n){return function(t,n,r,o){const a=o?o.series:void 0,i=o?o.parallel:e;var l={},u={};function s(e){if(e in l)return l[e];u[e]=!0;var o,c=[];for(var d in t(e))d in n&&c.push(d);if(0===c.length)o=r(e);else{var f=i(c.map((function(e){var t=s(e);return delete u[e],t})));a?o=a(f,(function(){return r(e)})):r(e)}return l[e]=o}for(var c in n)s(c);var d=[];for(var f in u)d.push(l[f]);return i(d)}(p,c,t,n)}};return w}}();e.exports=r},,,function(e,t,n){"use strict";n.r(t);var r=n(0),o=n.n(r),a=n(25),i=n(13),l=n(17),u=n.n(l),s=function(e){var t=e.error,n=e.retry,r=e.pastDelay;return t?o.a.createElement("div",{style:{align:"center",color:"#fff",backgroundColor:"#fa383e",borderColor:"#fa383e",borderStyle:"solid",borderRadius:"0.25rem",borderWidth:"1px",boxSizing:"border-box",display:"block",padding:"1rem",flex:"0 0 50%",marginLeft:"25%",marginRight:"25%",marginTop:"5rem",maxWidth:"50%",width:"100%"}},o.a.createElement("p",null,t.message),o.a.createElement("div",null,o.a.createElement("button",{type:"button",onClick:n},"Retry"))):r?o.a.createElement("div",{style:{display:"flex",justifyContent:"center",alignItems:"center",height:"100vh"}},o.a.createElement("svg",{id:"loader",style:{width:128,height:110,position:"absolute",top:"calc(100vh - 64%)"},viewBox:"0 0 45 45",xmlns:"http://www.w3.org/2000/svg",stroke:"#61dafb"},o.a.createElement("g",{fill:"none",fillRule:"evenodd",transform:"translate(1 1)",strokeWidth:"2"},o.a.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},o.a.createElement("animate",{attributeName:"r",begin:"1.5s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-opacity",begin:"1.5s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-width",begin:"1.5s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),o.a.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},o.a.createElement("animate",{attributeName:"r",begin:"3s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-opacity",begin:"3s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-width",begin:"3s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),o.a.createElement("circle",{cx:"22",cy:"22",r:"8"},o.a.createElement("animate",{attributeName:"r",begin:"0s",dur:"1.5s",values:"6;1;2;3;4;5;6",calcMode:"linear",repeatCount:"indefinite"}))))):null},c=n(10),d={"001ca130":[function(){return n.e(3).then(n.bind(null,57))},"@site/versioned_docs/version-7.0.x/features/endpoints.md",57],"00691219":[function(){return n.e(4).then(n.bind(null,58))},"@site/versioned_docs/version-7.0.x/configuration/tls.md",58],"0721a2c0":[function(){return n.e(5).then(n.bind(null,59))},"@site/versioned_docs/version-7.0.x/installation.md",59],"0f425520":[function(){return n.e(6).then(n.bind(null,60))},"@site/docs/configuration/overview.md",60],17896441:[function(){return Promise.all([n.e(0),n.e(1),n.e(7)]).then(n.bind(null,94))},"@theme/DocItem",94],"1be78505":[function(){return Promise.all([n.e(0),n.e(1),n.e(2),n.e(39)]).then(n.bind(null,95))},"@theme/DocPage",95],"1f391b9e":[function(){return Promise.all([n.e(0),n.e(1),n.e(2),n.e(40)]).then(n.bind(null,64))},"@theme/MDXPage",64],"230aeb34":[function(){return n.e(8).then(n.t.bind(null,65,3))},"~docs/default/version-7-0-x-metadata-prop-4d1.json",65],"35234f08":[function(){return n.e(9).then(n.bind(null,66))},"@site/docs/community/security.md",66],"357fe94d":[function(){return n.e(10).then(n.bind(null,67))},"@site/docs/configuration/auth.md",67],"3b8c55ea":[function(){return n.e(11).then(n.bind(null,68))},"@site/docs/installation.md",68],"3def9002":[function(){return n.e(12).then(n.bind(null,69))},"@site/versioned_docs/version-6.1.x/configuration/auth.md",69],"3fa022c7":[function(){return n.e(13).then(n.bind(null,70))},"@site/versioned_docs/version-7.0.x/configuration/alpha_config.md",70],"42326c77":[function(){return n.e(14).then(n.bind(null,71))},"@site/versioned_docs/version-6.1.x/behaviour.md",71],"585bdad0":[function(){return n.e(15).then(n.bind(null,72))},"@site/docs/configuration/tls.md",72],"5a047177":[function(){return n.e(16).then(n.bind(null,73))},"@site/versioned_docs/version-7.0.x/behaviour.md",73],"6f497b56":[function(){return n.e(17).then(n.bind(null,74))},"@site/versioned_docs/version-6.1.x/features/request_signatures.md",74],"7b04b1d5":[function(){return n.e(18).then(n.bind(null,75))},"@site/versioned_docs/version-6.1.x/installation.md",75],"7dcecc8d":[function(){return n.e(19).then(n.bind(null,76))},"@site/versioned_docs/version-7.0.x/configuration/auth.md",76],"8c826f25":[function(){return n.e(20).then(n.bind(null,77))},"@site/versioned_docs/version-7.0.x/configuration/overview.md",77],"935f2afb":[function(){return n.e(21).then(n.t.bind(null,78,3))},"~docs/default/version-current-metadata-prop-751.json",78],94285305:[function(){return n.e(22).then(n.bind(null,79))},"@site/docs/behaviour.md",79],"9f61b932":[function(){return n.e(23).then(n.bind(null,80))},"@site/docs/configuration/sessions.md",80],a37c03cb:[function(){return n.e(24).then(n.bind(null,81))},"@site/versioned_docs/version-6.1.x/configuration/tls.md",81],a991188b:[function(){return n.e(25).then(n.bind(null,82))},"@site/versioned_docs/version-6.1.x/features/endpoints.md",82],ade45c9a:[function(){return n.e(26).then(n.bind(null,83))},"@site/versioned_docs/version-6.1.x/configuration/overview.md",83],b5649f1e:[function(){return n.e(27).then(n.bind(null,84))},"@site/docs/features/request_signatures.md",84],b89e1cb0:[function(){return n.e(28).then(n.bind(null,85))},"@site/versioned_docs/version-7.0.x/features/request_signatures.md",85],be200c4b:[function(){return n.e(29).then(n.t.bind(null,86,3))},"~docs/default/version-6-1-x-metadata-prop-625.json",86],cd4a49c1:[function(){return n.e(30).then(n.bind(null,87))},"@site/docs/configuration/alpha_config.md",87],ea7cbf6d:[function(){return n.e(31).then(n.bind(null,88))},"@site/versioned_docs/version-6.1.x/community/security.md",88],edfc6e1b:[function(){return n.e(32).then(n.bind(null,89))},"@site/versioned_docs/version-7.0.x/configuration/sessions.md",89],efc9be4b:[function(){return n.e(33).then(n.bind(null,90))},"@site/docs/features/endpoints.md",90],f3976560:[function(){return n.e(34).then(n.bind(null,91))},"@site/src/pages/index.md",91],f4c9d322:[function(){return n.e(35).then(n.bind(null,92))},"@site/versioned_docs/version-7.0.x/community/security.md",92],f5839aac:[function(){return n.e(36).then(n.bind(null,93))},"@site/versioned_docs/version-6.1.x/configuration/sessions.md",93]};var f=function(e){var t={};return function e(n,r){Object.keys(n).forEach((function(o){var a=n[o],i=r?r+"."+o:o;"object"===typeof a&&!!a&&Object.keys(a).length?e(a,i):t[i]=a}))}(e),t};var p=function(e,t){if("*"===e)return u()({loading:s,loader:function(){return Promise.all([n.e(0),n.e(1),n.e(2),n.e(41)]).then(n.bind(null,114))}});var r=c[e+"-"+t],a=[],i=[],l={},p=f(r);return Object.keys(p).forEach((function(e){var t=d[p[e]];t&&(l[e]=t[0],a.push(t[1]),i.push(t[2]))})),u.a.Map({loading:s,loader:l,modules:a,webpack:function(){return i},render:function(e,t){var n=JSON.parse(JSON.stringify(r));Object.keys(e).forEach((function(t){for(var r=n,o=t.split("."),a=0;a<o.length-1;a+=1)r=r[o[a]];r[o[o.length-1]]=e[t].default;var i=Object.keys(e[t]).filter((function(e){return"default"!==e}));i&&i.length&&i.forEach((function(n){r[o[o.length-1]][n]=e[t][n]}))}));var a=n.component;return delete n.component,o.a.createElement(a,Object.assign({},n,t))}})},m=[{path:"/oauth2-proxy/",component:p("/oauth2-proxy/","4c3"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x",component:p("/oauth2-proxy/docs/6.1.x","b03"),routes:[{path:"/oauth2-proxy/docs/6.1.x/",component:p("/oauth2-proxy/docs/6.1.x/","574"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/behaviour",component:p("/oauth2-proxy/docs/6.1.x/behaviour","bbe"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/community/security",component:p("/oauth2-proxy/docs/6.1.x/community/security","9f3"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider",component:p("/oauth2-proxy/docs/6.1.x/configuration/oauth_provider","a82"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/overview",component:p("/oauth2-proxy/docs/6.1.x/configuration/overview","e4e"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/session_storage",component:p("/oauth2-proxy/docs/6.1.x/configuration/session_storage","2f9"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/tls",component:p("/oauth2-proxy/docs/6.1.x/configuration/tls","ece"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/features/endpoints",component:p("/oauth2-proxy/docs/6.1.x/features/endpoints","c39"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/features/request_signatures",component:p("/oauth2-proxy/docs/6.1.x/features/request_signatures","d6c"),exact:!0}]},{path:"/oauth2-proxy/docs/next",component:p("/oauth2-proxy/docs/next","8fe"),routes:[{path:"/oauth2-proxy/docs/next/",component:p("/oauth2-proxy/docs/next/","9e9"),exact:!0},{path:"/oauth2-proxy/docs/next/behaviour",component:p("/oauth2-proxy/docs/next/behaviour","8be"),exact:!0},{path:"/oauth2-proxy/docs/next/community/security",component:p("/oauth2-proxy/docs/next/community/security","166"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/alpha-config",component:p("/oauth2-proxy/docs/next/configuration/alpha-config","85d"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/oauth_provider",component:p("/oauth2-proxy/docs/next/configuration/oauth_provider","2fc"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/overview",component:p("/oauth2-proxy/docs/next/configuration/overview","613"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/session_storage",component:p("/oauth2-proxy/docs/next/configuration/session_storage","683"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/tls",component:p("/oauth2-proxy/docs/next/configuration/tls","2d0"),exact:!0},{path:"/oauth2-proxy/docs/next/features/endpoints",component:p("/oauth2-proxy/docs/next/features/endpoints","e4a"),exact:!0},{path:"/oauth2-proxy/docs/next/features/request_signatures",component:p("/oauth2-proxy/docs/next/features/request_signatures","488"),exact:!0}]},{path:"/oauth2-proxy/docs",component:p("/oauth2-proxy/docs","5d5"),routes:[{path:"/oauth2-proxy/docs/",component:p("/oauth2-proxy/docs/","e44"),exact:!0},{path:"/oauth2-proxy/docs/behaviour",component:p("/oauth2-proxy/docs/behaviour","64e"),exact:!0},{path:"/oauth2-proxy/docs/community/security",component:p("/oauth2-proxy/docs/community/security","8ab"),exact:!0},{path:"/oauth2-proxy/docs/configuration/alpha-config",component:p("/oauth2-proxy/docs/configuration/alpha-config","0f1"),exact:!0},{path:"/oauth2-proxy/docs/configuration/oauth_provider",component:p("/oauth2-proxy/docs/configuration/oauth_provider","eca"),exact:!0},{path:"/oauth2-proxy/docs/configuration/overview",component:p("/oauth2-proxy/docs/configuration/overview","f23"),exact:!0},{path:"/oauth2-proxy/docs/configuration/session_storage",component:p("/oauth2-proxy/docs/configuration/session_storage","0fa"),exact:!0},{path:"/oauth2-proxy/docs/configuration/tls",component:p("/oauth2-proxy/docs/configuration/tls","44d"),exact:!0},{path:"/oauth2-proxy/docs/features/endpoints",component:p("/oauth2-proxy/docs/features/endpoints","8f1"),exact:!0},{path:"/oauth2-proxy/docs/features/request_signatures",component:p("/oauth2-proxy/docs/features/request_signatures","7a6"),exact:!0}]},{path:"*",component:p("*")}],h=n(9),g=n(11),v=n(26),y=n(27),b=n(22),w=n(24),x=n(3),k=n(1),E=n(12),S=n.n(E),T=[n(15),n(15),n(15),n(39),n(46),n(43)];function _(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];T.forEach((function(t){var r,o,a=null!==(o=null===(r=null==t?void 0:t.default)||void 0===r?void 0:r[e])&&void 0!==o?o:t[e];a&&a.apply(void 0,n)}))}var C={onRouteUpdate:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];_.apply(void 0,["onRouteUpdate"].concat(t))},onRouteUpdateDelayed:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];_.apply(void 0,["onRouteUpdateDelayed"].concat(t))}},O=n(8);function P(e,t){var n=Object(O.a)(e,t);return Promise.all(n.map((function(e){var t=e.route.component;if(t&&t.preload)return t.preload()})))}var R={};var A=function(e){if(R[e.pathname])return Object.assign(Object.assign({},e),{pathname:R[e.pathname]});var t=e.pathname||"/";return""===(t=t.trim().replace(/\/index\.html$/,""))&&(t="/"),R[e.pathname]=t,Object.assign(Object.assign({},e),{pathname:t})};n(44);S.a.configure({showSpinner:!1});var N=function(e){function t(t){var n;return(n=e.call(this,t)||this).previousLocation=null,n.progressBarTimeout=null,n.state={nextRouteHasLoaded:!0},n}Object(x.a)(t,e);var n=t.prototype;return n.shouldComponentUpdate=function(e,t){var n=this,r=e.location!==this.props.location,o=this.props,a=o.routes,i=o.delay,l=void 0===i?1e3:i;if(r){var u=A(e.location);return this.startProgressBar(l),this.previousLocation=A(this.props.location),this.setState({nextRouteHasLoaded:!1}),P(a,u.pathname).then((function(){C.onRouteUpdate({previousLocation:n.previousLocation,location:u}),n.previousLocation=null,n.setState({nextRouteHasLoaded:!0},n.stopProgressBar);var e=u.hash;if(e){var t=e.substring(1),r=document.getElementById(t);r&&r.scrollIntoView()}else window.scrollTo(0,0)})).catch((function(e){return console.warn(e)})),!1}return!!t.nextRouteHasLoaded},n.clearProgressBarTimeout=function(){this.progressBarTimeout&&(clearTimeout(this.progressBarTimeout),this.progressBarTimeout=null)},n.startProgressBar=function(e){var t=this;this.clearProgressBarTimeout(),this.progressBarTimeout=setTimeout((function(){C.onRouteUpdateDelayed({location:A(t.props.location)}),S.a.start()}),e)},n.stopProgressBar=function(){this.clearProgressBarTimeout(),S.a.done()},n.render=function(){var e=this.props,t=e.children,n=e.location;return o.a.createElement(k.d,{location:A(n),render:function(){return t}})},t}(o.a.Component),I=Object(k.o)(N);var L=function(){var e=Object(r.useState)(!1),t=e[0],n=e[1];return Object(r.useEffect)((function(){n(!0)}),[]),o.a.createElement(w.a.Provider,{value:{siteConfig:g.a,siteMetadata:y,globalData:v,isClient:t}},o.a.createElement(I,{routes:m},Object(b.a)(m)))};var D=function(e){if("undefined"==typeof document)return!1;var t=document.createElement("link");try{if(t.relList&&"function"==typeof t.relList.supports)return t.relList.supports(e)}catch(n){return!1}return!1}("prefetch")?function(e){return new Promise((function(t,n){if("undefined"!=typeof document){var r=document.createElement("link");r.setAttribute("rel","prefetch"),r.setAttribute("href",e),r.onload=t,r.onerror=n,(document.getElementsByTagName("head")[0]||document.getElementsByName("script")[0].parentNode).appendChild(r)}else n()}))}:function(e){return new Promise((function(t,n){var r=new XMLHttpRequest;r.open("GET",e,!0),r.withCredentials=!0,r.onload=function(){200===r.status?t():n()},r.send(null)}))},j={};var F=function(e){return new Promise((function(t){j[e]?t():D(e).then((function(){t(),j[e]=!0})).catch((function(){}))}))},M={},z={},U=function(){return!(!("connection"in navigator)||-1===(navigator.connection.effectiveType||"").indexOf("2g")||!navigator.connection.saveData)},$={prefetch:function(e){return!!function(e){return!U()&&!z[e]&&!M[e]}(e)&&(M[e]=!0,Object(O.a)(m,e).reduce((function(e,t){var n=c[t.route.path];if(!n)return e;var r=Object.values(f(n));return e.concat(r)}),[]).forEach((function(e){var t=n.gca(e);t&&!/undefined/.test(t)&&F(t)})),!0)},preload:function(e){return!!function(e){return!U()&&!z[e]}(e)&&(z[e]=!0,P(m,e),!0)}};if(h.a.canUseDOM){window.docusaurus=$;var B=a.hydrate;P(m,window.location.pathname).then((function(){B(o.a.createElement(i.a,null,o.a.createElement(L,null)),document.getElementById("__docusaurus"))}))}},function(e,t,n){"use strict";n.r(t);var r=n(20),o=n(9),a=n(11);(function(e){if(o.a.canUseDOM){var t=a.a.themeConfig.prism,r=(t=void 0===t?{}:t).additionalLanguages,i=void 0===r?[]:r;window.Prism=e,i.forEach((function(e){n(16)("./prism-"+e)})),delete window.Prism}})(r.a)}],[[30,38,0]]]);
\ No newline at end of file
diff --git a/main.ff464f14.js b/main.ff464f14.js
new file mode 100644
index 00000000..06624bd3
--- /dev/null
+++ b/main.ff464f14.js
@@ -0,0 +1,2 @@
+/*! For license information please see main.ff464f14.js.LICENSE.txt */
+(window.webpackJsonp=window.webpackJsonp||[]).push([[36],[function(e,t,n){"use strict";e.exports=n(31)},function(e,t,n){"use strict";n.d(t,"a",(function(){return y})),n.d(t,"b",(function(){return w})),n.d(t,"c",(function(){return S})),n.d(t,"d",(function(){return O})),n.d(t,"e",(function(){return v})),n.d(t,"f",(function(){return L})),n.d(t,"g",(function(){return D})),n.d(t,"h",(function(){return g})),n.d(t,"i",(function(){return E})),n.d(t,"j",(function(){return C})),n.d(t,"k",(function(){return M})),n.d(t,"l",(function(){return z})),n.d(t,"m",(function(){return U})),n.d(t,"n",(function(){return $})),n.d(t,"o",(function(){return j}));var r=n(3),o=n(0),a=n.n(o),i=(n(7),n(5)),l=n(18),u=n(4),s=n(2),c=n(19),d=n.n(c),f=(n(23),n(6)),p=n(28),m=n.n(p),h=function(e){var t=Object(l.a)();return t.displayName=e,t}("Router-History"),g=function(e){var t=Object(l.a)();return t.displayName=e,t}("Router"),v=function(e){function t(t){var n;return(n=e.call(this,t)||this).state={location:t.history.location},n._isMounted=!1,n._pendingLocation=null,t.staticContext||(n.unlisten=t.history.listen((function(e){n._isMounted?n.setState({location:e}):n._pendingLocation=e}))),n}Object(r.a)(t,e),t.computeRootMatch=function(e){return{path:"/",url:"/",params:{},isExact:"/"===e}};var n=t.prototype;return n.componentDidMount=function(){this._isMounted=!0,this._pendingLocation&&this.setState({location:this._pendingLocation})},n.componentWillUnmount=function(){this.unlisten&&this.unlisten()},n.render=function(){return a.a.createElement(g.Provider,{value:{history:this.props.history,location:this.state.location,match:t.computeRootMatch(this.state.location.pathname),staticContext:this.props.staticContext}},a.a.createElement(h.Provider,{children:this.props.children||null,value:this.props.history}))},t}(a.a.Component);var y=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).history=Object(i.d)(t.props),t}return Object(r.a)(t,e),t.prototype.render=function(){return a.a.createElement(v,{history:this.history,children:this.props.children})},t}(a.a.Component);var b=function(e){function t(){return e.apply(this,arguments)||this}Object(r.a)(t,e);var n=t.prototype;return n.componentDidMount=function(){this.props.onMount&&this.props.onMount.call(this,this)},n.componentDidUpdate=function(e){this.props.onUpdate&&this.props.onUpdate.call(this,this,e)},n.componentWillUnmount=function(){this.props.onUnmount&&this.props.onUnmount.call(this,this)},n.render=function(){return null},t}(a.a.Component);function w(e){var t=e.message,n=e.when,r=void 0===n||n;return a.a.createElement(g.Consumer,null,(function(e){if(e||Object(u.a)(!1),!r||e.staticContext)return null;var n=e.history.block;return a.a.createElement(b,{onMount:function(e){e.release=n(t)},onUpdate:function(e,r){r.message!==t&&(e.release(),e.release=n(t))},onUnmount:function(e){e.release()},message:t})}))}var x={},k=0;function E(e,t){return void 0===e&&(e="/"),void 0===t&&(t={}),"/"===e?e:function(e){if(x[e])return x[e];var t=d.a.compile(e);return k<1e4&&(x[e]=t,k++),t}(e)(t,{pretty:!0})}function S(e){var t=e.computedMatch,n=e.to,r=e.push,o=void 0!==r&&r;return a.a.createElement(g.Consumer,null,(function(e){e||Object(u.a)(!1);var r=e.history,l=e.staticContext,c=o?r.push:r.replace,d=Object(i.c)(t?"string"==typeof n?E(n,t.params):Object(s.a)({},n,{pathname:E(n.pathname,t.params)}):n);return l?(c(d),null):a.a.createElement(b,{onMount:function(){c(d)},onUpdate:function(e,t){var n=Object(i.c)(t.to);Object(i.f)(n,Object(s.a)({},d,{key:n.key}))||c(d)},to:n})}))}var T={},_=0;function C(e,t){void 0===t&&(t={}),("string"==typeof t||Array.isArray(t))&&(t={path:t});var n=t,r=n.path,o=n.exact,a=void 0!==o&&o,i=n.strict,l=void 0!==i&&i,u=n.sensitive,s=void 0!==u&&u;return[].concat(r).reduce((function(t,n){if(!n&&""!==n)return null;if(t)return t;var r=function(e,t){var n=""+t.end+t.strict+t.sensitive,r=T[n]||(T[n]={});if(r[e])return r[e];var o=[],a={regexp:d()(e,o,t),keys:o};return _<1e4&&(r[e]=a,_++),a}(n,{end:a,strict:l,sensitive:s}),o=r.regexp,i=r.keys,u=o.exec(e);if(!u)return null;var c=u[0],f=u.slice(1),p=e===c;return a&&!p?null:{path:n,url:"/"===n&&""===c?"/":c,isExact:p,params:i.reduce((function(e,t,n){return e[t.name]=f[n],e}),{})}}),null)}var O=function(e){function t(){return e.apply(this,arguments)||this}return Object(r.a)(t,e),t.prototype.render=function(){var e=this;return a.a.createElement(g.Consumer,null,(function(t){t||Object(u.a)(!1);var n=e.props.location||t.location,r=e.props.computedMatch?e.props.computedMatch:e.props.path?C(n.pathname,e.props):t.match,o=Object(s.a)({},t,{location:n,match:r}),i=e.props,l=i.children,c=i.component,d=i.render;return Array.isArray(l)&&0===l.length&&(l=null),a.a.createElement(g.Provider,{value:o},o.match?l?"function"==typeof l?l(o):l:c?a.a.createElement(c,o):d?d(o):null:"function"==typeof l?l(o):null)}))},t}(a.a.Component);function P(e){return"/"===e.charAt(0)?e:"/"+e}function R(e,t){if(!e)return t;var n=P(e);return 0!==t.pathname.indexOf(n)?t:Object(s.a)({},t,{pathname:t.pathname.substr(n.length)})}function A(e){return"string"==typeof e?e:Object(i.e)(e)}function N(e){return function(){Object(u.a)(!1)}}function I(){}var L=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).handlePush=function(e){return t.navigateTo(e,"PUSH")},t.handleReplace=function(e){return t.navigateTo(e,"REPLACE")},t.handleListen=function(){return I},t.handleBlock=function(){return I},t}Object(r.a)(t,e);var n=t.prototype;return n.navigateTo=function(e,t){var n=this.props,r=n.basename,o=void 0===r?"":r,a=n.context,l=void 0===a?{}:a;l.action=t,l.location=function(e,t){return e?Object(s.a)({},t,{pathname:P(e)+t.pathname}):t}(o,Object(i.c)(e)),l.url=A(l.location)},n.render=function(){var e=this.props,t=e.basename,n=void 0===t?"":t,r=e.context,o=void 0===r?{}:r,l=e.location,u=void 0===l?"/":l,c=Object(f.a)(e,["basename","context","location"]),d={createHref:function(e){return P(n+A(e))},action:"POP",location:R(n,Object(i.c)(u)),push:this.handlePush,replace:this.handleReplace,go:N(),goBack:N(),goForward:N(),listen:this.handleListen,block:this.handleBlock};return a.a.createElement(v,Object(s.a)({},c,{history:d,staticContext:o}))},t}(a.a.Component);var D=function(e){function t(){return e.apply(this,arguments)||this}return Object(r.a)(t,e),t.prototype.render=function(){var e=this;return a.a.createElement(g.Consumer,null,(function(t){t||Object(u.a)(!1);var n,r,o=e.props.location||t.location;return a.a.Children.forEach(e.props.children,(function(e){if(null==r&&a.a.isValidElement(e)){n=e;var i=e.props.path||e.props.from;r=i?C(o.pathname,Object(s.a)({},e.props,{path:i})):t.match}})),r?a.a.cloneElement(n,{location:o,computedMatch:r}):null}))},t}(a.a.Component);function j(e){var t="withRouter("+(e.displayName||e.name)+")",n=function(t){var n=t.wrappedComponentRef,r=Object(f.a)(t,["wrappedComponentRef"]);return a.a.createElement(g.Consumer,null,(function(t){return t||Object(u.a)(!1),a.a.createElement(e,Object(s.a)({},r,t,{ref:n}))}))};return n.displayName=t,n.WrappedComponent=e,m()(n,e)}var F=a.a.useContext;function M(){return F(h)}function z(){return F(g).location}function U(){var e=F(g).match;return e?e.params:{}}function $(e){var t=z(),n=F(g).match;return e?C(t.pathname,e):n}},function(e,t,n){"use strict";function r(){return(r=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e}).apply(this,arguments)}n.d(t,"a",(function(){return r}))},function(e,t,n){"use strict";function r(e,t){e.prototype=Object.create(t.prototype),e.prototype.constructor=e,e.__proto__=t}n.d(t,"a",(function(){return r}))},function(e,t,n){"use strict";var r="Invariant failed";t.a=function(e,t){if(!e)throw new Error(r)}},function(e,t,n){"use strict";n.d(t,"a",(function(){return E})),n.d(t,"b",(function(){return P})),n.d(t,"d",(function(){return A})),n.d(t,"c",(function(){return h})),n.d(t,"f",(function(){return g})),n.d(t,"e",(function(){return m}));var r=n(2);function o(e){return"/"===e.charAt(0)}function a(e,t){for(var n=t,r=n+1,o=e.length;r<o;n+=1,r+=1)e[n]=e[r];e.pop()}var i=function(e,t){void 0===t&&(t="");var n,r=e&&e.split("/")||[],i=t&&t.split("/")||[],l=e&&o(e),u=t&&o(t),s=l||u;if(e&&o(e)?i=r:r.length&&(i.pop(),i=i.concat(r)),!i.length)return"/";if(i.length){var c=i[i.length-1];n="."===c||".."===c||""===c}else n=!1;for(var d=0,f=i.length;f>=0;f--){var p=i[f];"."===p?a(i,f):".."===p?(a(i,f),d++):d&&(a(i,f),d--)}if(!s)for(;d--;d)i.unshift("..");!s||""===i[0]||i[0]&&o(i[0])||i.unshift("");var m=i.join("/");return n&&"/"!==m.substr(-1)&&(m+="/"),m};function l(e){return e.valueOf?e.valueOf():Object.prototype.valueOf.call(e)}var u=function e(t,n){if(t===n)return!0;if(null==t||null==n)return!1;if(Array.isArray(t))return Array.isArray(n)&&t.length===n.length&&t.every((function(t,r){return e(t,n[r])}));if("object"==typeof t||"object"==typeof n){var r=l(t),o=l(n);return r!==t||o!==n?e(r,o):Object.keys(Object.assign({},t,n)).every((function(r){return e(t[r],n[r])}))}return!1},s=n(4);function c(e){return"/"===e.charAt(0)?e:"/"+e}function d(e){return"/"===e.charAt(0)?e.substr(1):e}function f(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function p(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function m(e){var t=e.pathname,n=e.search,r=e.hash,o=t||"/";return n&&"?"!==n&&(o+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(o+="#"===r.charAt(0)?r:"#"+r),o}function h(e,t,n,o){var a;"string"==typeof e?(a=function(e){var t=e||"/",n="",r="",o=t.indexOf("#");-1!==o&&(r=t.substr(o),t=t.substr(0,o));var a=t.indexOf("?");return-1!==a&&(n=t.substr(a),t=t.substr(0,a)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e)).state=t:(void 0===(a=Object(r.a)({},e)).pathname&&(a.pathname=""),a.search?"?"!==a.search.charAt(0)&&(a.search="?"+a.search):a.search="",a.hash?"#"!==a.hash.charAt(0)&&(a.hash="#"+a.hash):a.hash="",void 0!==t&&void 0===a.state&&(a.state=t));try{a.pathname=decodeURI(a.pathname)}catch(l){throw l instanceof URIError?new URIError('Pathname "'+a.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):l}return n&&(a.key=n),o?a.pathname?"/"!==a.pathname.charAt(0)&&(a.pathname=i(a.pathname,o.pathname)):a.pathname=o.pathname:a.pathname||(a.pathname="/"),a}function g(e,t){return e.pathname===t.pathname&&e.search===t.search&&e.hash===t.hash&&e.key===t.key&&u(e.state,t.state)}function v(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,o){if(null!=e){var a="function"==typeof e?e(t,n):e;"string"==typeof a?"function"==typeof r?r(a,o):o(!0):o(!1!==a)}else o(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;r<e;r++)n[r]=arguments[r];t.forEach((function(e){return e.apply(void 0,n)}))}}}var y=!("undefined"==typeof window||!window.document||!window.document.createElement);function b(e,t){t(window.confirm(e))}var w="popstate",x="hashchange";function k(){try{return window.history.state||{}}catch(e){return{}}}function E(e){void 0===e&&(e={}),y||Object(s.a)(!1);var t,n=window.history,o=(-1===(t=window.navigator.userAgent).indexOf("Android 2.")&&-1===t.indexOf("Android 4.0")||-1===t.indexOf("Mobile Safari")||-1!==t.indexOf("Chrome")||-1!==t.indexOf("Windows Phone"))&&window.history&&"pushState"in window.history,a=!(-1===window.navigator.userAgent.indexOf("Trident")),i=e,l=i.forceRefresh,u=void 0!==l&&l,d=i.getUserConfirmation,g=void 0===d?b:d,E=i.keyLength,S=void 0===E?6:E,T=e.basename?p(c(e.basename)):"";function _(e){var t=e||{},n=t.key,r=t.state,o=window.location,a=o.pathname+o.search+o.hash;return T&&(a=f(a,T)),h(a,r,n)}function C(){return Math.random().toString(36).substr(2,S)}var O=v();function P(e){Object(r.a)($,e),$.length=n.length,O.notifyListeners($.location,$.action)}function R(e){(function(e){return void 0===e.state&&-1===navigator.userAgent.indexOf("CriOS")})(e)||I(_(e.state))}function A(){I(_(k()))}var N=!1;function I(e){if(N)N=!1,P();else{O.confirmTransitionTo(e,"POP",g,(function(t){t?P({action:"POP",location:e}):function(e){var t=$.location,n=D.indexOf(t.key);-1===n&&(n=0);var r=D.indexOf(e.key);-1===r&&(r=0);var o=n-r;o&&(N=!0,F(o))}(e)}))}}var L=_(k()),D=[L.key];function j(e){return T+m(e)}function F(e){n.go(e)}var M=0;function z(e){1===(M+=e)&&1===e?(window.addEventListener(w,R),a&&window.addEventListener(x,A)):0===M&&(window.removeEventListener(w,R),a&&window.removeEventListener(x,A))}var U=!1;var $={length:n.length,action:"POP",location:L,createHref:j,push:function(e,t){var r="PUSH",a=h(e,t,C(),$.location);O.confirmTransitionTo(a,r,g,(function(e){if(e){var t=j(a),i=a.key,l=a.state;if(o)if(n.pushState({key:i,state:l},null,t),u)window.location.href=t;else{var s=D.indexOf($.location.key),c=D.slice(0,s+1);c.push(a.key),D=c,P({action:r,location:a})}else window.location.href=t}}))},replace:function(e,t){var r="REPLACE",a=h(e,t,C(),$.location);O.confirmTransitionTo(a,r,g,(function(e){if(e){var t=j(a),i=a.key,l=a.state;if(o)if(n.replaceState({key:i,state:l},null,t),u)window.location.replace(t);else{var s=D.indexOf($.location.key);-1!==s&&(D[s]=a.key),P({action:r,location:a})}else window.location.replace(t)}}))},go:F,goBack:function(){F(-1)},goForward:function(){F(1)},block:function(e){void 0===e&&(e=!1);var t=O.setPrompt(e);return U||(z(1),U=!0),function(){return U&&(U=!1,z(-1)),t()}},listen:function(e){var t=O.appendListener(e);return z(1),function(){z(-1),t()}}};return $}var S="hashchange",T={hashbang:{encodePath:function(e){return"!"===e.charAt(0)?e:"!/"+d(e)},decodePath:function(e){return"!"===e.charAt(0)?e.substr(1):e}},noslash:{encodePath:d,decodePath:c},slash:{encodePath:c,decodePath:c}};function _(e){var t=e.indexOf("#");return-1===t?e:e.slice(0,t)}function C(){var e=window.location.href,t=e.indexOf("#");return-1===t?"":e.substring(t+1)}function O(e){window.location.replace(_(window.location.href)+"#"+e)}function P(e){void 0===e&&(e={}),y||Object(s.a)(!1);var t=window.history,n=(window.navigator.userAgent.indexOf("Firefox"),e),o=n.getUserConfirmation,a=void 0===o?b:o,i=n.hashType,l=void 0===i?"slash":i,u=e.basename?p(c(e.basename)):"",d=T[l],g=d.encodePath,w=d.decodePath;function x(){var e=w(C());return u&&(e=f(e,u)),h(e)}var k=v();function E(e){Object(r.a)(U,e),U.length=t.length,k.notifyListeners(U.location,U.action)}var P=!1,R=null;function A(){var e,t,n=C(),r=g(n);if(n!==r)O(r);else{var o=x(),i=U.location;if(!P&&(t=o,(e=i).pathname===t.pathname&&e.search===t.search&&e.hash===t.hash))return;if(R===m(o))return;R=null,function(e){if(P)P=!1,E();else{var t="POP";k.confirmTransitionTo(e,t,a,(function(n){n?E({action:t,location:e}):function(e){var t=U.location,n=D.lastIndexOf(m(t));-1===n&&(n=0);var r=D.lastIndexOf(m(e));-1===r&&(r=0);var o=n-r;o&&(P=!0,j(o))}(e)}))}}(o)}}var N=C(),I=g(N);N!==I&&O(I);var L=x(),D=[m(L)];function j(e){t.go(e)}var F=0;function M(e){1===(F+=e)&&1===e?window.addEventListener(S,A):0===F&&window.removeEventListener(S,A)}var z=!1;var U={length:t.length,action:"POP",location:L,createHref:function(e){var t=document.querySelector("base"),n="";return t&&t.getAttribute("href")&&(n=_(window.location.href)),n+"#"+g(u+m(e))},push:function(e,t){var n="PUSH",r=h(e,void 0,void 0,U.location);k.confirmTransitionTo(r,n,a,(function(e){if(e){var t=m(r),o=g(u+t);if(C()!==o){R=t,function(e){window.location.hash=e}(o);var a=D.lastIndexOf(m(U.location)),i=D.slice(0,a+1);i.push(t),D=i,E({action:n,location:r})}else E()}}))},replace:function(e,t){var n="REPLACE",r=h(e,void 0,void 0,U.location);k.confirmTransitionTo(r,n,a,(function(e){if(e){var t=m(r),o=g(u+t);C()!==o&&(R=t,O(o));var a=D.indexOf(m(U.location));-1!==a&&(D[a]=t),E({action:n,location:r})}}))},go:j,goBack:function(){j(-1)},goForward:function(){j(1)},block:function(e){void 0===e&&(e=!1);var t=k.setPrompt(e);return z||(M(1),z=!0),function(){return z&&(z=!1,M(-1)),t()}},listen:function(e){var t=k.appendListener(e);return M(1),function(){M(-1),t()}}};return U}function R(e,t,n){return Math.min(Math.max(e,t),n)}function A(e){void 0===e&&(e={});var t=e,n=t.getUserConfirmation,o=t.initialEntries,a=void 0===o?["/"]:o,i=t.initialIndex,l=void 0===i?0:i,u=t.keyLength,s=void 0===u?6:u,c=v();function d(e){Object(r.a)(w,e),w.length=w.entries.length,c.notifyListeners(w.location,w.action)}function f(){return Math.random().toString(36).substr(2,s)}var p=R(l,0,a.length-1),g=a.map((function(e){return h(e,void 0,"string"==typeof e?f():e.key||f())})),y=m;function b(e){var t=R(w.index+e,0,w.entries.length-1),r=w.entries[t];c.confirmTransitionTo(r,"POP",n,(function(e){e?d({action:"POP",location:r,index:t}):d()}))}var w={length:g.length,action:"POP",location:g[p],index:p,entries:g,createHref:y,push:function(e,t){var r="PUSH",o=h(e,t,f(),w.location);c.confirmTransitionTo(o,r,n,(function(e){if(e){var t=w.index+1,n=w.entries.slice(0);n.length>t?n.splice(t,n.length-t,o):n.push(o),d({action:r,location:o,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",o=h(e,t,f(),w.location);c.confirmTransitionTo(o,r,n,(function(e){e&&(w.entries[w.index]=o,d({action:r,location:o}))}))},go:b,goBack:function(){b(-1)},goForward:function(){b(1)},canGo:function(e){var t=w.index+e;return t>=0&&t<w.entries.length},block:function(e){return void 0===e&&(e=!1),c.setPrompt(e)},listen:function(e){return c.appendListener(e)}};return w}},function(e,t,n){"use strict";function r(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}n.d(t,"a",(function(){return r}))},function(e,t,n){e.exports=n(35)()},function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return u}));var r=n(1),o=n(2),a=n(0),i=n.n(a);function l(e,t,n){return void 0===n&&(n=[]),e.some((function(e){var o=e.path?Object(r.j)(t,e):n.length?n[n.length-1].match:r.e.computeRootMatch(t);return o&&(n.push({route:e,match:o}),e.routes&&l(e.routes,t,n)),o})),n}function u(e,t,n){return void 0===t&&(t={}),void 0===n&&(n={}),e?i.a.createElement(r.g,n,e.map((function(e,n){return i.a.createElement(r.d,{key:e.key||n,path:e.path,exact:e.exact,strict:e.strict,render:function(n){return e.render?e.render(Object(o.a)({},n,{},t,{route:e})):i.a.createElement(e.component,Object(o.a)({},n,t,{route:e}))}})}))):null}},function(e,t,n){"use strict";var r=!("undefined"==typeof window||!window.document||!window.document.createElement),o={canUseDOM:r,canUseEventListeners:r&&!(!window.addEventListener&&!window.attachEvent),canUseIntersectionObserver:r&&"IntersectionObserver"in window,canUseViewport:r&&!!window.screen};t.a=o},function(e){e.exports=JSON.parse('{"/oauth2-proxy/-4c3":{"component":"1f391b9e","content":"f3976560"},"/oauth2-proxy/docs/6.1.x-b03":{"component":"1be78505","versionMetadata":"be200c4b"},"/oauth2-proxy/docs/6.1.x/-574":{"component":"17896441","content":"7b04b1d5"},"/oauth2-proxy/docs/6.1.x/behaviour-bbe":{"component":"17896441","content":"42326c77"},"/oauth2-proxy/docs/6.1.x/community/security-9f3":{"component":"17896441","content":"ea7cbf6d"},"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider-a82":{"component":"17896441","content":"3def9002"},"/oauth2-proxy/docs/6.1.x/configuration/overview-e4e":{"component":"17896441","content":"ade45c9a"},"/oauth2-proxy/docs/6.1.x/configuration/session_storage-2f9":{"component":"17896441","content":"f5839aac"},"/oauth2-proxy/docs/6.1.x/configuration/tls-ece":{"component":"17896441","content":"a37c03cb"},"/oauth2-proxy/docs/6.1.x/features/endpoints-c39":{"component":"17896441","content":"a991188b"},"/oauth2-proxy/docs/6.1.x/features/request_signatures-d6c":{"component":"17896441","content":"6f497b56"},"/oauth2-proxy/docs/next-434":{"component":"1be78505","versionMetadata":"935f2afb"},"/oauth2-proxy/docs/next/-9e9":{"component":"17896441","content":"3b8c55ea"},"/oauth2-proxy/docs/next/behaviour-8be":{"component":"17896441","content":"94285305"},"/oauth2-proxy/docs/next/community/security-166":{"component":"17896441","content":"35234f08"},"/oauth2-proxy/docs/next/configuration/alpha-config-85d":{"component":"17896441","content":"cd4a49c1"},"/oauth2-proxy/docs/next/configuration/oauth_provider-2fc":{"component":"17896441","content":"357fe94d"},"/oauth2-proxy/docs/next/configuration/overview-613":{"component":"17896441","content":"0f425520"},"/oauth2-proxy/docs/next/configuration/session_storage-683":{"component":"17896441","content":"9f61b932"},"/oauth2-proxy/docs/next/configuration/tls-2d0":{"component":"17896441","content":"585bdad0"},"/oauth2-proxy/docs/next/features/endpoints-e4a":{"component":"17896441","content":"efc9be4b"},"/oauth2-proxy/docs-5d5":{"component":"1be78505","versionMetadata":"230aeb34"},"/oauth2-proxy/docs/-e44":{"component":"17896441","content":"0721a2c0"},"/oauth2-proxy/docs/behaviour-64e":{"component":"17896441","content":"5a047177"},"/oauth2-proxy/docs/community/security-8ab":{"component":"17896441","content":"f4c9d322"},"/oauth2-proxy/docs/configuration/alpha-config-0f1":{"component":"17896441","content":"3fa022c7"},"/oauth2-proxy/docs/configuration/oauth_provider-eca":{"component":"17896441","content":"7dcecc8d"},"/oauth2-proxy/docs/configuration/overview-f23":{"component":"17896441","content":"8c826f25"},"/oauth2-proxy/docs/configuration/session_storage-0fa":{"component":"17896441","content":"edfc6e1b"},"/oauth2-proxy/docs/configuration/tls-44d":{"component":"17896441","content":"00691219"},"/oauth2-proxy/docs/features/endpoints-8f1":{"component":"17896441","content":"001ca130"},"/oauth2-proxy/docs/features/request_signatures-7a6":{"component":"17896441","content":"b89e1cb0"}}')},function(e,t,n){"use strict";t.a={title:"OAuth2 Proxy",tagline:"A lightweight authentication proxy written in Go",url:"https://oauth2-proxy.github.io",baseUrl:"/oauth2-proxy/",onBrokenLinks:"throw",favicon:"img/logos/OAuth2_Proxy_icon.svg",organizationName:"oauth2-proxy",projectName:"oauth2-proxy",themeConfig:{navbar:{title:"OAuth2 Proxy",logo:{alt:"OAuth2 Proxy",src:"img/logos/OAuth2_Proxy_icon.svg"},items:[{to:"docs/",activeBasePath:"docs",label:"Docs",position:"left"},{type:"docsVersionDropdown",position:"right",dropdownActiveClassDisabled:!0,dropdownItemsBefore:[],dropdownItemsAfter:[]},{href:"https://github.com/oauth2-proxy/oauth2-proxy",label:"GitHub",position:"right"}],hideOnScroll:!1},footer:{style:"dark",copyright:"Copyright \xa9 2021 OAuth2 Proxy.",links:[]},colorMode:{defaultMode:"light",disableSwitch:!1,respectPrefersColorScheme:!1,switchConfig:{darkIcon:"\ud83c\udf1c",darkIconStyle:{},lightIcon:"\ud83c\udf1e",lightIconStyle:{}}},docs:{versionPersistence:"localStorage"},metadatas:[],prism:{additionalLanguages:[]}},presets:[["@docusaurus/preset-classic",{docs:{sidebarPath:"/home/runner/work/oauth2-proxy/oauth2-proxy/docs/sidebars.js",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/"},theme:{customCss:"/home/runner/work/oauth2-proxy/oauth2-proxy/docs/src/css/custom.css"}}]],onDuplicateRoutes:"warn",customFields:{},plugins:[],themes:[],titleDelimiter:"|",noIndex:!1}},function(e,t,n){var r,o;void 0===(o="function"==typeof(r=function(){var e,t,n={version:"0.2.0"},r=n.settings={minimum:.08,easing:"ease",positionUsing:"",speed:200,trickle:!0,trickleRate:.02,trickleSpeed:800,showSpinner:!0,barSelector:'[role="bar"]',spinnerSelector:'[role="spinner"]',parent:"body",template:'<div class="bar" role="bar"><div class="peg"></div></div><div class="spinner" role="spinner"><div class="spinner-icon"></div></div>'};function o(e,t,n){return e<t?t:e>n?n:e}function a(e){return 100*(-1+e)}function i(e,t,n){var o;return(o="translate3d"===r.positionUsing?{transform:"translate3d("+a(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+a(e)+"%,0)"}:{"margin-left":a(e)+"%"}).transition="all "+t+"ms "+n,o}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=o(e,r.minimum,1),n.status=1===e?null:e;var a=n.render(!t),s=a.querySelector(r.barSelector),c=r.speed,d=r.easing;return a.offsetWidth,l((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),u(s,i(e,c,d)),1===e?(u(a,{transition:"none",opacity:1}),a.offsetWidth,setTimeout((function(){u(a,{transition:"all "+c+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),c)}),c)):setTimeout(t,c)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*o(Math.random()*t,.1,.95)),t=o(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");c(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var o,i=t.querySelector(r.barSelector),l=e?"-100":a(n.status||0),s=document.querySelector(r.parent);return u(i,{transition:"all 0 linear",transform:"translate3d("+l+"%,0,0)"}),r.showSpinner||(o=t.querySelector(r.spinnerSelector))&&p(o),s!=document.body&&c(s,"nprogress-custom-parent"),s.appendChild(t),t},n.remove=function(){d(document.documentElement,"nprogress-busy"),d(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&p(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var l=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),u=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,o=e.length,a=t.charAt(0).toUpperCase()+t.slice(1);o--;)if((r=e[o]+a)in n)return r;return t}function o(e){return e=n(e),t[e]||(t[e]=r(e))}function a(e,t,n){t=o(t),e.style[t]=n}return function(e,t){var n,r,o=arguments;if(2==o.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&a(e,n,r);else a(e,o[1],o[2])}}();function s(e,t){return("string"==typeof e?e:f(e)).indexOf(" "+t+" ")>=0}function c(e,t){var n=f(e),r=n+t;s(n,t)||(e.className=r.substring(1))}function d(e,t){var n,r=f(e);s(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function f(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function p(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n})?r.call(t,n,t,e):r)||(e.exports=o)},function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return f})),n.d(t,"c",(function(){return y})),n.d(t,"e",(function(){return x}));var r=n(1);n.d(t,"d",(function(){return r.a})),n.d(t,"f",(function(){return r.b})),n.d(t,"g",(function(){return r.c})),n.d(t,"h",(function(){return r.d})),n.d(t,"i",(function(){return r.e})),n.d(t,"j",(function(){return r.f})),n.d(t,"k",(function(){return r.g})),n.d(t,"l",(function(){return r.i})),n.d(t,"m",(function(){return r.j})),n.d(t,"n",(function(){return r.k})),n.d(t,"o",(function(){return r.l})),n.d(t,"p",(function(){return r.m})),n.d(t,"q",(function(){return r.n})),n.d(t,"r",(function(){return r.o}));var o=n(3),a=n(0),i=n.n(a),l=n(5),u=(n(7),n(2)),s=n(6),c=n(4),d=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).history=Object(l.a)(t.props),t}return Object(o.a)(t,e),t.prototype.render=function(){return i.a.createElement(r.e,{history:this.history,children:this.props.children})},t}(i.a.Component);var f=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),o=0;o<n;o++)r[o]=arguments[o];return(t=e.call.apply(e,[this].concat(r))||this).history=Object(l.b)(t.props),t}return Object(o.a)(t,e),t.prototype.render=function(){return i.a.createElement(r.e,{history:this.history,children:this.props.children})},t}(i.a.Component);var p=function(e,t){return"function"==typeof e?e(t):e},m=function(e,t){return"string"==typeof e?Object(l.c)(e,null,null,t):e},h=function(e){return e},g=i.a.forwardRef;void 0===g&&(g=h);var v=g((function(e,t){var n=e.innerRef,r=e.navigate,o=e.onClick,a=Object(s.a)(e,["innerRef","navigate","onClick"]),l=a.target,c=Object(u.a)({},a,{onClick:function(e){try{o&&o(e)}catch(t){throw e.preventDefault(),t}e.defaultPrevented||0!==e.button||l&&"_self"!==l||function(e){return!!(e.metaKey||e.altKey||e.ctrlKey||e.shiftKey)}(e)||(e.preventDefault(),r())}});return c.ref=h!==g&&t||n,i.a.createElement("a",c)}));var y=g((function(e,t){var n=e.component,o=void 0===n?v:n,a=e.replace,l=e.to,d=e.innerRef,f=Object(s.a)(e,["component","replace","to","innerRef"]);return i.a.createElement(r.h.Consumer,null,(function(e){e||Object(c.a)(!1);var n=e.history,r=m(p(l,e.location),e.location),s=r?n.createHref(r):"",v=Object(u.a)({},f,{href:s,navigate:function(){var t=p(l,e.location);(a?n.replace:n.push)(t)}});return h!==g?v.ref=t||d:v.innerRef=d,i.a.createElement(o,v)}))})),b=function(e){return e},w=i.a.forwardRef;void 0===w&&(w=b);var x=w((function(e,t){var n=e["aria-current"],o=void 0===n?"page":n,a=e.activeClassName,l=void 0===a?"active":a,d=e.activeStyle,f=e.className,h=e.exact,g=e.isActive,v=e.location,x=e.sensitive,k=e.strict,E=e.style,S=e.to,T=e.innerRef,_=Object(s.a)(e,["aria-current","activeClassName","activeStyle","className","exact","isActive","location","sensitive","strict","style","to","innerRef"]);return i.a.createElement(r.h.Consumer,null,(function(e){e||Object(c.a)(!1);var n=v||e.location,a=m(p(S,n),n),s=a.pathname,C=s&&s.replace(/([.+*?=^!:${}()[\]|/\\])/g,"\\$1"),O=C?Object(r.j)(n.pathname,{path:C,exact:h,sensitive:x,strict:k}):null,P=!!(g?g(O,n):O),R=P?function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return t.filter((function(e){return e})).join(" ")}(f,l):f,A=P?Object(u.a)({},E,{},d):E,N=Object(u.a)({"aria-current":P&&o||null,className:R,style:A,to:a},_);return b!==w?N.ref=t||T:N.innerRef=T,i.a.createElement(y,N)}))}))},,,function(e,t,n){var r={"./":40};function o(e){var t=a(e);return n(t)}function a(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=a,e.exports=o,o.id=16},function(e,t,n){"use strict";var r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e};function o(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function a(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t}function i(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}var l=n(0),u=n(7),s=[],c=[];function d(e){var t=e(),n={loading:!0,loaded:null,error:null};return n.promise=t.then((function(e){return n.loading=!1,n.loaded=e,e})).catch((function(e){throw n.loading=!1,n.error=e,e})),n}function f(e){var t={loading:!1,loaded:{},error:null},n=[];try{Object.keys(e).forEach((function(r){var o=d(e[r]);o.loading?t.loading=!0:(t.loaded[r]=o.loaded,t.error=o.error),n.push(o.promise),o.promise.then((function(e){t.loaded[r]=e})).catch((function(e){t.error=e}))}))}catch(r){t.error=r}return t.promise=Promise.all(n).then((function(e){return t.loading=!1,e})).catch((function(e){throw t.loading=!1,e})),t}function p(e,t){return l.createElement((n=e)&&n.__esModule?n.default:n,t);var n}function m(e,t){var d,f;if(!t.loading)throw new Error("react-loadable requires a `loading` component");var m=Object.assign({loader:null,loading:null,delay:200,timeout:null,render:p,webpack:null,modules:null},t),h=null;function g(){return h||(h=e(m.loader)),h.promise}return s.push(g),"function"==typeof m.webpack&&c.push((function(){if(e=m.webpack,"object"===r(n.m)&&e().every((function(e){return void 0!==e&&void 0!==n.m[e]})))return g();var e})),f=d=function(t){function n(r){o(this,n);var i=a(this,t.call(this,r));return i.retry=function(){i.setState({error:null,loading:!0,timedOut:!1}),h=e(m.loader),i._loadModule()},g(),i.state={error:h.error,pastDelay:!1,timedOut:!1,loading:h.loading,loaded:h.loaded},i}return i(n,t),n.preload=function(){return g()},n.prototype.componentWillMount=function(){this._mounted=!0,this._loadModule()},n.prototype._loadModule=function(){var e=this;if(this.context.loadable&&Array.isArray(m.modules)&&m.modules.forEach((function(t){e.context.loadable.report(t)})),h.loading){"number"==typeof m.delay&&(0===m.delay?this.setState({pastDelay:!0}):this._delay=setTimeout((function(){e.setState({pastDelay:!0})}),m.delay)),"number"==typeof m.timeout&&(this._timeout=setTimeout((function(){e.setState({timedOut:!0})}),m.timeout));var t=function(){e._mounted&&(e.setState({error:h.error,loaded:h.loaded,loading:h.loading}),e._clearTimeouts())};h.promise.then((function(){t()})).catch((function(e){t()}))}},n.prototype.componentWillUnmount=function(){this._mounted=!1,this._clearTimeouts()},n.prototype._clearTimeouts=function(){clearTimeout(this._delay),clearTimeout(this._timeout)},n.prototype.render=function(){return this.state.loading||this.state.error?l.createElement(m.loading,{isLoading:this.state.loading,pastDelay:this.state.pastDelay,timedOut:this.state.timedOut,error:this.state.error,retry:this.retry}):this.state.loaded?m.render(this.state.loaded,this.props):null},n}(l.Component),d.contextTypes={loadable:u.shape({report:u.func.isRequired})},f}function h(e){return m(d,e)}h.Map=function(e){if("function"!=typeof e.render)throw new Error("LoadableMap requires a `render(loaded, props)` function");return m(f,e)};var g=function(e){function t(){return o(this,t),a(this,e.apply(this,arguments))}return i(t,e),t.prototype.getChildContext=function(){return{loadable:{report:this.props.report}}},t.prototype.render=function(){return l.Children.only(this.props.children)},t}(l.Component);function v(e){for(var t=[];e.length;){var n=e.pop();t.push(n())}return Promise.all(t).then((function(){if(e.length)return v(e)}))}g.propTypes={report:u.func.isRequired},g.childContextTypes={loadable:u.shape({report:u.func.isRequired}).isRequired},h.Capture=g,h.preloadAll=function(){return new Promise((function(e,t){v(s).then(e,t)}))},h.preloadReady=function(){return new Promise((function(e,t){v(c).then(e,e)}))},e.exports=h},function(e,t,n){"use strict";(function(e){var r=n(0),o=n.n(r),a=n(3),i=n(7),l=n.n(i),u=1073741823,s="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:void 0!==e?e:{};function c(e){var t=[];return{on:function(e){t.push(e)},off:function(e){t=t.filter((function(t){return t!==e}))},get:function(){return e},set:function(n,r){e=n,t.forEach((function(t){return t(e,r)}))}}}var d=o.a.createContext||function(e,t){var n,o,i,d="__create-react-context-"+((s[i="__global_unique_id__"]=(s[i]||0)+1)+"__"),f=function(e){function n(){var t;return(t=e.apply(this,arguments)||this).emitter=c(t.props.value),t}Object(a.a)(n,e);var r=n.prototype;return r.getChildContext=function(){var e;return(e={})[d]=this.emitter,e},r.componentWillReceiveProps=function(e){if(this.props.value!==e.value){var n,r=this.props.value,o=e.value;((a=r)===(i=o)?0!==a||1/a==1/i:a!=a&&i!=i)?n=0:(n="function"==typeof t?t(r,o):u,0!==(n|=0)&&this.emitter.set(e.value,n))}var a,i},r.render=function(){return this.props.children},n}(r.Component);f.childContextTypes=((n={})[d]=l.a.object.isRequired,n);var p=function(t){function n(){var e;return(e=t.apply(this,arguments)||this).state={value:e.getValue()},e.onUpdate=function(t,n){0!=((0|e.observedBits)&n)&&e.setState({value:e.getValue()})},e}Object(a.a)(n,t);var r=n.prototype;return r.componentWillReceiveProps=function(e){var t=e.observedBits;this.observedBits=null==t?u:t},r.componentDidMount=function(){this.context[d]&&this.context[d].on(this.onUpdate);var e=this.props.observedBits;this.observedBits=null==e?u:e},r.componentWillUnmount=function(){this.context[d]&&this.context[d].off(this.onUpdate)},r.getValue=function(){return this.context[d]?this.context[d].get():e},r.render=function(){return(e=this.props.children,Array.isArray(e)?e[0]:e)(this.state.value);var e},n}(r.Component);return p.contextTypes=((o={})[d]=l.a.object,o),{Provider:f,Consumer:p}};t.a=d}).call(this,n(29))},function(e,t,n){var r=n(37);e.exports=p,e.exports.parse=a,e.exports.compile=function(e,t){return l(a(e,t),t)},e.exports.tokensToFunction=l,e.exports.tokensToRegExp=f;var o=new RegExp(["(\\\\.)","([\\/.])?(?:(?:\\:(\\w+)(?:\\(((?:\\\\.|[^\\\\()])+)\\))?|\\(((?:\\\\.|[^\\\\()])+)\\))([+*?])?|(\\*))"].join("|"),"g");function a(e,t){for(var n,r=[],a=0,i=0,l="",c=t&&t.delimiter||"/";null!=(n=o.exec(e));){var d=n[0],f=n[1],p=n.index;if(l+=e.slice(i,p),i=p+d.length,f)l+=f[1];else{var m=e[i],h=n[2],g=n[3],v=n[4],y=n[5],b=n[6],w=n[7];l&&(r.push(l),l="");var x=null!=h&&null!=m&&m!==h,k="+"===b||"*"===b,E="?"===b||"*"===b,S=n[2]||c,T=v||y;r.push({name:g||a++,prefix:h||"",delimiter:S,optional:E,repeat:k,partial:x,asterisk:!!w,pattern:T?s(T):w?".*":"[^"+u(S)+"]+?"})}}return i<e.length&&(l+=e.substr(i)),l&&r.push(l),r}function i(e){return encodeURI(e).replace(/[\/?#]/g,(function(e){return"%"+e.charCodeAt(0).toString(16).toUpperCase()}))}function l(e,t){for(var n=new Array(e.length),o=0;o<e.length;o++)"object"==typeof e[o]&&(n[o]=new RegExp("^(?:"+e[o].pattern+")$",d(t)));return function(t,o){for(var a="",l=t||{},u=(o||{}).pretty?i:encodeURIComponent,s=0;s<e.length;s++){var c=e[s];if("string"!=typeof c){var d,f=l[c.name];if(null==f){if(c.optional){c.partial&&(a+=c.prefix);continue}throw new TypeError('Expected "'+c.name+'" to be defined')}if(r(f)){if(!c.repeat)throw new TypeError('Expected "'+c.name+'" to not repeat, but received `'+JSON.stringify(f)+"`");if(0===f.length){if(c.optional)continue;throw new TypeError('Expected "'+c.name+'" to not be empty')}for(var p=0;p<f.length;p++){if(d=u(f[p]),!n[s].test(d))throw new TypeError('Expected all "'+c.name+'" to match "'+c.pattern+'", but received `'+JSON.stringify(d)+"`");a+=(0===p?c.prefix:c.delimiter)+d}}else{if(d=c.asterisk?encodeURI(f).replace(/[?#]/g,(function(e){return"%"+e.charCodeAt(0).toString(16).toUpperCase()})):u(f),!n[s].test(d))throw new TypeError('Expected "'+c.name+'" to match "'+c.pattern+'", but received "'+d+'"');a+=c.prefix+d}}else a+=c}return a}}function u(e){return e.replace(/([.+*?=^!:${}()[\]|\/\\])/g,"\\$1")}function s(e){return e.replace(/([=!:$\/()])/g,"\\$1")}function c(e,t){return e.keys=t,e}function d(e){return e&&e.sensitive?"":"i"}function f(e,t,n){r(t)||(n=t||n,t=[]);for(var o=(n=n||{}).strict,a=!1!==n.end,i="",l=0;l<e.length;l++){var s=e[l];if("string"==typeof s)i+=u(s);else{var f=u(s.prefix),p="(?:"+s.pattern+")";t.push(s),s.repeat&&(p+="(?:"+f+p+")*"),i+=p=s.optional?s.partial?f+"("+p+")?":"(?:"+f+"("+p+"))?":f+"("+p+")"}}var m=u(n.delimiter||"/"),h=i.slice(-m.length)===m;return o||(i=(h?i.slice(0,-m.length):i)+"(?:"+m+"(?=$))?"),i+=a?"$":o&&h?"":"(?="+m+"|$)",c(new RegExp("^"+i,d(n)),t)}function p(e,t,n){return r(t)||(n=t||n,t=[]),n=n||{},e instanceof RegExp?function(e,t){var n=e.source.match(/\((?!\?)/g);if(n)for(var r=0;r<n.length;r++)t.push({name:r,prefix:null,delimiter:null,optional:!1,repeat:!1,partial:!1,asterisk:!1,pattern:null});return c(e,t)}(e,t):r(e)?function(e,t,n){for(var r=[],o=0;o<e.length;o++)r.push(p(e[o],t,n).source);return c(new RegExp("(?:"+r.join("|")+")",d(n)),t)}(e,t,n):function(e,t,n){return f(a(e,n),t,n)}(e,t,n)}},function(e,t,n){"use strict";var r,o,a,i=(r=0,o={util:{encode:function(e){return e instanceof a?new a(e.type,o.util.encode(e.content),e.alias):"Array"===o.util.type(e)?e.map(o.util.encode):e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/\u00a0/g," ")},type:function(e){return Object.prototype.toString.call(e).match(/\[object (\w+)\]/)[1]},objId:function(e){return e.__id||Object.defineProperty(e,"__id",{value:++r}),e.__id},clone:function(e,t){var n=o.util.type(e);switch(t=t||{},n){case"Object":if(t[o.util.objId(e)])return t[o.util.objId(e)];var r={};for(var a in t[o.util.objId(e)]=r,e)e.hasOwnProperty(a)&&(r[a]=o.util.clone(e[a],t));return r;case"Array":return t[o.util.objId(e)]?t[o.util.objId(e)]:(r=[],t[o.util.objId(e)]=r,e.forEach((function(e,n){r[n]=o.util.clone(e,t)})),r)}return e}},languages:{extend:function(e,t){var n=o.util.clone(o.languages[e]);for(var r in t)n[r]=t[r];return n},insertBefore:function(e,t,n,r){var a=(r=r||o.languages)[e];if(2==arguments.length){for(var i in n=arguments[1])n.hasOwnProperty(i)&&(a[i]=n[i]);return a}var l={};for(var u in a)if(a.hasOwnProperty(u)){if(u==t)for(var i in n)n.hasOwnProperty(i)&&(l[i]=n[i]);l[u]=a[u]}return o.languages.DFS(o.languages,(function(t,n){n===r[e]&&t!=e&&(this[t]=l)})),r[e]=l},DFS:function(e,t,n,r){for(var a in r=r||{},e)e.hasOwnProperty(a)&&(t.call(e,a,e[a],n||a),"Object"!==o.util.type(e[a])||r[o.util.objId(e[a])]?"Array"!==o.util.type(e[a])||r[o.util.objId(e[a])]||(r[o.util.objId(e[a])]=!0,o.languages.DFS(e[a],t,a,r)):(r[o.util.objId(e[a])]=!0,o.languages.DFS(e[a],t,null,r)))}},plugins:{},highlight:function(e,t,n){var r={code:e,grammar:t,language:n};return r.tokens=o.tokenize(r.code,r.grammar),a.stringify(o.util.encode(r.tokens),r.language)},matchGrammar:function(e,t,n,r,a,i,l){var u=o.Token;for(var s in n)if(n.hasOwnProperty(s)&&n[s]){if(s==l)return;var c=n[s];c="Array"===o.util.type(c)?c:[c];for(var d=0;d<c.length;++d){var f=c[d],p=f.inside,m=!!f.lookbehind,h=!!f.greedy,g=0,v=f.alias;if(h&&!f.pattern.global){var y=f.pattern.toString().match(/[imuy]*$/)[0];f.pattern=RegExp(f.pattern.source,y+"g")}f=f.pattern||f;for(var b=r,w=a;b<t.length;w+=t[b].length,++b){var x=t[b];if(t.length>e.length)return;if(!(x instanceof u)){if(h&&b!=t.length-1){if(f.lastIndex=w,!(C=f.exec(e)))break;for(var k=C.index+(m?C[1].length:0),E=C.index+C[0].length,S=b,T=w,_=t.length;S<_&&(T<E||!t[S].type&&!t[S-1].greedy);++S)k>=(T+=t[S].length)&&(++b,w=T);if(t[b]instanceof u)continue;O=S-b,x=e.slice(w,T),C.index-=w}else{f.lastIndex=0;var C=f.exec(x),O=1}if(C){m&&(g=C[1]?C[1].length:0),E=(k=C.index+g)+(C=C[0].slice(g)).length;var P=x.slice(0,k),R=x.slice(E),A=[b,O];P&&(++b,w+=P.length,A.push(P));var N=new u(s,p?o.tokenize(C,p):C,v,C,h);if(A.push(N),R&&A.push(R),Array.prototype.splice.apply(t,A),1!=O&&o.matchGrammar(e,t,n,b,w,!0,s),i)break}else if(i)break}}}}},hooks:{add:function(){}},tokenize:function(e,t,n){var r=[e],a=t.rest;if(a){for(var i in a)t[i]=a[i];delete t.rest}return o.matchGrammar(e,r,t,0,0,!1),r}},(a=o.Token=function(e,t,n,r,o){this.type=e,this.content=t,this.alias=n,this.length=0|(r||"").length,this.greedy=!!o}).stringify=function(e,t,n){if("string"==typeof e)return e;if("Array"===o.util.type(e))return e.map((function(n){return a.stringify(n,t,e)})).join("");var r={type:e.type,content:a.stringify(e.content,t,n),tag:"span",classes:["token",e.type],attributes:{},language:t,parent:n};if(e.alias){var i="Array"===o.util.type(e.alias)?e.alias:[e.alias];Array.prototype.push.apply(r.classes,i)}var l=Object.keys(r.attributes).map((function(e){return e+'="'+(r.attributes[e]||"").replace(/"/g,"&quot;")+'"'})).join(" ");return"<"+r.tag+' class="'+r.classes.join(" ")+'"'+(l?" "+l:"")+">"+r.content+"</"+r.tag+">"},o);i.languages.markup={comment:/<!--[\s\S]*?-->/,prolog:/<\?[\s\S]+?\?>/,doctype:/<!DOCTYPE[\s\S]+?>/i,cdata:/<!\[CDATA\[[\s\S]*?]]>/i,tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s(?:\s*[^\s>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))|(?=[\s/>])))+)?\s*\/?>/i,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/i,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+)/i,inside:{punctuation:[/^=/,{pattern:/^(\s*)["']|["']$/,lookbehind:!0}]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:/&#?[\da-z]{1,8};/i},i.languages.markup.tag.inside["attr-value"].inside.entity=i.languages.markup.entity,i.hooks.add("wrap",(function(e){"entity"===e.type&&(e.attributes.title=e.content.replace(/&amp;/,"&"))})),Object.defineProperty(i.languages.markup.tag,"addInlined",{value:function(e,t){var n={};n["language-"+t]={pattern:/(^<!\[CDATA\[)[\s\S]+?(?=\]\]>$)/i,lookbehind:!0,inside:i.languages[t]},n.cdata=/^<!\[CDATA\[|\]\]>$/i;var r={"included-cdata":{pattern:/<!\[CDATA\[[\s\S]*?\]\]>/i,inside:n}};r["language-"+t]={pattern:/[\s\S]+/,inside:i.languages[t]};var o={};o[e]={pattern:RegExp(/(<__[\s\S]*?>)(?:<!\[CDATA\[[\s\S]*?\]\]>\s*|[\s\S])*?(?=<\/__>)/.source.replace(/__/g,e),"i"),lookbehind:!0,greedy:!0,inside:r},i.languages.insertBefore("markup","cdata",o)}}),i.languages.xml=i.languages.extend("markup",{}),i.languages.html=i.languages.markup,i.languages.mathml=i.languages.markup,i.languages.svg=i.languages.markup,function(e){var t="\\b(?:BASH|BASHOPTS|BASH_ALIASES|BASH_ARGC|BASH_ARGV|BASH_CMDS|BASH_COMPLETION_COMPAT_DIR|BASH_LINENO|BASH_REMATCH|BASH_SOURCE|BASH_VERSINFO|BASH_VERSION|COLORTERM|COLUMNS|COMP_WORDBREAKS|DBUS_SESSION_BUS_ADDRESS|DEFAULTS_PATH|DESKTOP_SESSION|DIRSTACK|DISPLAY|EUID|GDMSESSION|GDM_LANG|GNOME_KEYRING_CONTROL|GNOME_KEYRING_PID|GPG_AGENT_INFO|GROUPS|HISTCONTROL|HISTFILE|HISTFILESIZE|HISTSIZE|HOME|HOSTNAME|HOSTTYPE|IFS|INSTANCE|JOB|LANG|LANGUAGE|LC_ADDRESS|LC_ALL|LC_IDENTIFICATION|LC_MEASUREMENT|LC_MONETARY|LC_NAME|LC_NUMERIC|LC_PAPER|LC_TELEPHONE|LC_TIME|LESSCLOSE|LESSOPEN|LINES|LOGNAME|LS_COLORS|MACHTYPE|MAILCHECK|MANDATORY_PATH|NO_AT_BRIDGE|OLDPWD|OPTERR|OPTIND|ORBIT_SOCKETDIR|OSTYPE|PAPERSIZE|PATH|PIPESTATUS|PPID|PS1|PS2|PS3|PS4|PWD|RANDOM|REPLY|SECONDS|SELINUX_INIT|SESSION|SESSIONTYPE|SESSION_MANAGER|SHELL|SHELLOPTS|SHLVL|SSH_AUTH_SOCK|TERM|UID|UPSTART_EVENTS|UPSTART_INSTANCE|UPSTART_JOB|UPSTART_SESSION|USER|WINDOWID|XAUTHORITY|XDG_CONFIG_DIRS|XDG_CURRENT_DESKTOP|XDG_DATA_DIRS|XDG_GREETER_DATA_DIR|XDG_MENU_PREFIX|XDG_RUNTIME_DIR|XDG_SEAT|XDG_SEAT_PATH|XDG_SESSION_DESKTOP|XDG_SESSION_ID|XDG_SESSION_PATH|XDG_SESSION_TYPE|XDG_VTNR|XMODIFIERS)\\b",n={environment:{pattern:RegExp("\\$"+t),alias:"constant"},variable:[{pattern:/\$?\(\([\s\S]+?\)\)/,greedy:!0,inside:{variable:[{pattern:/(^\$\(\([\s\S]+)\)\)/,lookbehind:!0},/^\$\(\(/],number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/--?|-=|\+\+?|\+=|!=?|~|\*\*?|\*=|\/=?|%=?|<<=?|>>=?|<=?|>=?|==?|&&?|&=|\^=?|\|\|?|\|=|\?|:/,punctuation:/\(\(?|\)\)?|,|;/}},{pattern:/\$\((?:\([^)]+\)|[^()])+\)|`[^`]+`/,greedy:!0,inside:{variable:/^\$\(|^`|\)$|`$/}},{pattern:/\$\{[^}]+\}/,greedy:!0,inside:{operator:/:[-=?+]?|[!\/]|##?|%%?|\^\^?|,,?/,punctuation:/[\[\]]/,environment:{pattern:RegExp("(\\{)"+t),lookbehind:!0,alias:"constant"}}},/\$(?:\w+|[#?*!@$])/],entity:/\\(?:[abceEfnrtv\\"]|O?[0-7]{1,3}|x[0-9a-fA-F]{1,2}|u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8})/};e.languages.bash={shebang:{pattern:/^#!\s*\/.*/,alias:"important"},comment:{pattern:/(^|[^"{\\$])#.*/,lookbehind:!0},"function-name":[{pattern:/(\bfunction\s+)\w+(?=(?:\s*\(?:\s*\))?\s*\{)/,lookbehind:!0,alias:"function"},{pattern:/\b\w+(?=\s*\(\s*\)\s*\{)/,alias:"function"}],"for-or-select":{pattern:/(\b(?:for|select)\s+)\w+(?=\s+in\s)/,alias:"variable",lookbehind:!0},"assign-left":{pattern:/(^|[\s;|&]|[<>]\()\w+(?=\+?=)/,inside:{environment:{pattern:RegExp("(^|[\\s;|&]|[<>]\\()"+t),lookbehind:!0,alias:"constant"}},alias:"variable",lookbehind:!0},string:[{pattern:/((?:^|[^<])<<-?\s*)(\w+?)\s*(?:\r?\n|\r)(?:[\s\S])*?(?:\r?\n|\r)\2/,lookbehind:!0,greedy:!0,inside:n},{pattern:/((?:^|[^<])<<-?\s*)(["'])(\w+)\2\s*(?:\r?\n|\r)(?:[\s\S])*?(?:\r?\n|\r)\3/,lookbehind:!0,greedy:!0},{pattern:/(["'])(?:\\[\s\S]|\$\([^)]+\)|`[^`]+`|(?!\1)[^\\])*\1/,greedy:!0,inside:n}],environment:{pattern:RegExp("\\$?"+t),alias:"constant"},variable:n.variable,function:{pattern:/(^|[\s;|&]|[<>]\()(?:add|apropos|apt|aptitude|apt-cache|apt-get|aspell|automysqlbackup|awk|basename|bash|bc|bconsole|bg|bzip2|cal|cat|cfdisk|chgrp|chkconfig|chmod|chown|chroot|cksum|clear|cmp|column|comm|cp|cron|crontab|csplit|curl|cut|date|dc|dd|ddrescue|debootstrap|df|diff|diff3|dig|dir|dircolors|dirname|dirs|dmesg|du|egrep|eject|env|ethtool|expand|expect|expr|fdformat|fdisk|fg|fgrep|file|find|fmt|fold|format|free|fsck|ftp|fuser|gawk|git|gparted|grep|groupadd|groupdel|groupmod|groups|grub-mkconfig|gzip|halt|head|hg|history|host|hostname|htop|iconv|id|ifconfig|ifdown|ifup|import|install|ip|jobs|join|kill|killall|less|link|ln|locate|logname|logrotate|look|lpc|lpr|lprint|lprintd|lprintq|lprm|ls|lsof|lynx|make|man|mc|mdadm|mkconfig|mkdir|mke2fs|mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh|shellcheck|shuf|shutdown|sleep|slocate|sort|split|ssh|stat|strace|su|sudo|sum|suspend|swapon|sync|tac|tail|tar|tee|time|timeout|top|touch|tr|traceroute|tsort|tty|umount|uname|unexpand|uniq|units|unrar|unshar|unzip|update-grub|uptime|useradd|userdel|usermod|users|uudecode|uuencode|v|vdir|vi|vim|virsh|vmstat|wait|watch|wc|wget|whereis|which|who|whoami|write|xargs|xdg-open|yarn|yes|zenity|zip|zsh|zypper)(?=$|[)\s;|&])/,lookbehind:!0},keyword:{pattern:/(^|[\s;|&]|[<>]\()(?:if|then|else|elif|fi|for|while|in|case|esac|function|select|do|done|until)(?=$|[)\s;|&])/,lookbehind:!0},builtin:{pattern:/(^|[\s;|&]|[<>]\()(?:\.|:|break|cd|continue|eval|exec|exit|export|getopts|hash|pwd|readonly|return|shift|test|times|trap|umask|unset|alias|bind|builtin|caller|command|declare|echo|enable|help|let|local|logout|mapfile|printf|read|readarray|source|type|typeset|ulimit|unalias|set|shopt)(?=$|[)\s;|&])/,lookbehind:!0,alias:"class-name"},boolean:{pattern:/(^|[\s;|&]|[<>]\()(?:true|false)(?=$|[)\s;|&])/,lookbehind:!0},"file-descriptor":{pattern:/\B&\d\b/,alias:"important"},operator:{pattern:/\d?<>|>\||\+=|==?|!=?|=~|<<[<-]?|[&\d]?>>|\d?[<>]&?|&[>&]?|\|[&|]?|<=?|>=?/,inside:{"file-descriptor":{pattern:/^\d/,alias:"important"}}},punctuation:/\$?\(\(?|\)\)?|\.\.|[{}[\];\\]/,number:{pattern:/(^|\s)(?:[1-9]\d*|0)(?:[.,]\d+)?\b/,lookbehind:!0}};for(var r=["comment","function-name","for-or-select","assign-left","string","environment","function","keyword","builtin","boolean","file-descriptor","operator","punctuation","number"],o=n.variable[1].inside,a=0;a<r.length;a++)o[r[a]]=e.languages.bash[r[a]];e.languages.shell=e.languages.bash}(i),i.languages.clike={comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},"class-name":{pattern:/((?:\b(?:class|interface|extends|implements|trait|instanceof|new)\s+)|(?:catch\s+\())[\w.\\]+/i,lookbehind:!0,inside:{punctuation:/[.\\]/}},keyword:/\b(?:if|else|while|do|for|return|in|instanceof|function|new|try|throw|catch|finally|null|break|continue)\b/,boolean:/\b(?:true|false)\b/,function:/\w+(?=\()/,number:/\b0x[\da-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:e[+-]?\d+)?/i,operator:/--?|\+\+?|!=?=?|<=?|>=?|==?=?|&&?|\|\|?|\?|\*|\/|~|\^|%/,punctuation:/[{}[\];(),.:]/},i.languages.c=i.languages.extend("clike",{"class-name":{pattern:/(\b(?:enum|struct)\s+)\w+/,lookbehind:!0},keyword:/\b(?:_Alignas|_Alignof|_Atomic|_Bool|_Complex|_Generic|_Imaginary|_Noreturn|_Static_assert|_Thread_local|asm|typeof|inline|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|union|unsigned|void|volatile|while)\b/,operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?/,number:/(?:\b0x(?:[\da-f]+\.?[\da-f]*|\.[\da-f]+)(?:p[+-]?\d+)?|(?:\b\d+\.?\d*|\B\.\d+)(?:e[+-]?\d+)?)[ful]*/i}),i.languages.insertBefore("c","string",{macro:{pattern:/(^\s*)#\s*[a-z]+(?:[^\r\n\\]|\\(?:\r\n|[\s\S]))*/im,lookbehind:!0,alias:"property",inside:{string:{pattern:/(#\s*include\s*)(?:<.+?>|("|')(?:\\?.)+?\2)/,lookbehind:!0},directive:{pattern:/(#\s*)\b(?:define|defined|elif|else|endif|error|ifdef|ifndef|if|import|include|line|pragma|undef|using)\b/,lookbehind:!0,alias:"keyword"}}},constant:/\b(?:__FILE__|__LINE__|__DATE__|__TIME__|__TIMESTAMP__|__func__|EOF|NULL|SEEK_CUR|SEEK_END|SEEK_SET|stdin|stdout|stderr)\b/}),delete i.languages.c.boolean,i.languages.cpp=i.languages.extend("c",{"class-name":{pattern:/(\b(?:class|enum|struct)\s+)\w+/,lookbehind:!0},keyword:/\b(?:alignas|alignof|asm|auto|bool|break|case|catch|char|char16_t|char32_t|class|compl|const|constexpr|const_cast|continue|decltype|default|delete|do|double|dynamic_cast|else|enum|explicit|export|extern|float|for|friend|goto|if|inline|int|int8_t|int16_t|int32_t|int64_t|uint8_t|uint16_t|uint32_t|uint64_t|long|mutable|namespace|new|noexcept|nullptr|operator|private|protected|public|register|reinterpret_cast|return|short|signed|sizeof|static|static_assert|static_cast|struct|switch|template|this|thread_local|throw|try|typedef|typeid|typename|union|unsigned|using|virtual|void|volatile|wchar_t|while)\b/,number:{pattern:/(?:\b0b[01']+|\b0x(?:[\da-f']+\.?[\da-f']*|\.[\da-f']+)(?:p[+-]?[\d']+)?|(?:\b[\d']+\.?[\d']*|\B\.[\d']+)(?:e[+-]?[\d']+)?)[ful]*/i,greedy:!0},operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?|\b(?:and|and_eq|bitand|bitor|not|not_eq|or|or_eq|xor|xor_eq)\b/,boolean:/\b(?:true|false)\b/}),i.languages.insertBefore("cpp","string",{"raw-string":{pattern:/R"([^()\\ ]{0,16})\([\s\S]*?\)\1"/,alias:"string",greedy:!0}}),function(e){var t=/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/;e.languages.css={comment:/\/\*[\s\S]*?\*\//,atrule:{pattern:/@[\w-]+[\s\S]*?(?:;|(?=\s*\{))/,inside:{rule:/@[\w-]+/}},url:{pattern:RegExp("url\\((?:"+t.source+"|[^\n\r()]*)\\)","i"),inside:{function:/^url/i,punctuation:/^\(|\)$/}},selector:RegExp("[^{}\\s](?:[^{};\"']|"+t.source+")*?(?=\\s*\\{)"),string:{pattern:t,greedy:!0},property:/[-_a-z\xA0-\uFFFF][-\w\xA0-\uFFFF]*(?=\s*:)/i,important:/!important\b/i,function:/[-a-z0-9]+(?=\()/i,punctuation:/[(){};:,]/},e.languages.css.atrule.inside.rest=e.languages.css;var n=e.languages.markup;n&&(n.tag.addInlined("style","css"),e.languages.insertBefore("inside","attr-value",{"style-attr":{pattern:/\s*style=("|')(?:\\[\s\S]|(?!\1)[^\\])*\1/i,inside:{"attr-name":{pattern:/^\s*style/i,inside:n.tag.inside},punctuation:/^\s*=\s*['"]|['"]\s*$/,"attr-value":{pattern:/.+/i,inside:e.languages.css}},alias:"language-css"}},n.tag))}(i),i.languages.css.selector={pattern:i.languages.css.selector,inside:{"pseudo-element":/:(?:after|before|first-letter|first-line|selection)|::[-\w]+/,"pseudo-class":/:[-\w]+/,class:/\.[-:.\w]+/,id:/#[-:.\w]+/,attribute:{pattern:/\[(?:[^[\]"']|("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1)*\]/,greedy:!0,inside:{punctuation:/^\[|\]$/,"case-sensitivity":{pattern:/(\s)[si]$/i,lookbehind:!0,alias:"keyword"},namespace:{pattern:/^(\s*)[-*\w\xA0-\uFFFF]*\|(?!=)/,lookbehind:!0,inside:{punctuation:/\|$/}},attribute:{pattern:/^(\s*)[-\w\xA0-\uFFFF]+/,lookbehind:!0},value:[/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,{pattern:/(=\s*)[-\w\xA0-\uFFFF]+(?=\s*$)/,lookbehind:!0}],operator:/[|~*^$]?=/}},"n-th":[{pattern:/(\(\s*)[+-]?\d*[\dn](?:\s*[+-]\s*\d+)?(?=\s*\))/,lookbehind:!0,inside:{number:/[\dn]+/,operator:/[+-]/}},{pattern:/(\(\s*)(?:even|odd)(?=\s*\))/i,lookbehind:!0}],punctuation:/[()]/}},i.languages.insertBefore("css","property",{variable:{pattern:/(^|[^-\w\xA0-\uFFFF])--[-_a-z\xA0-\uFFFF][-\w\xA0-\uFFFF]*/i,lookbehind:!0}}),i.languages.insertBefore("css","function",{operator:{pattern:/(\s)[+\-*\/](?=\s)/,lookbehind:!0},hexcode:/#[\da-f]{3,8}/i,entity:/\\[\da-f]{1,8}/i,unit:{pattern:/(\d)(?:%|[a-z]+)/,lookbehind:!0},number:/-?[\d.]+/}),i.languages.javascript=i.languages.extend("clike",{"class-name":[i.languages.clike["class-name"],{pattern:/(^|[^$\w\xA0-\uFFFF])[_$A-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\.(?:prototype|constructor))/,lookbehind:!0}],keyword:[{pattern:/((?:^|})\s*)(?:catch|finally)\b/,lookbehind:!0},{pattern:/(^|[^.])\b(?:as|async(?=\s*(?:function\b|\(|[$\w\xA0-\uFFFF]|$))|await|break|case|class|const|continue|debugger|default|delete|do|else|enum|export|extends|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)\b/,lookbehind:!0}],number:/\b(?:(?:0[xX](?:[\dA-Fa-f](?:_[\dA-Fa-f])?)+|0[bB](?:[01](?:_[01])?)+|0[oO](?:[0-7](?:_[0-7])?)+)n?|(?:\d(?:_\d)?)+n|NaN|Infinity)\b|(?:\b(?:\d(?:_\d)?)+\.?(?:\d(?:_\d)?)*|\B\.(?:\d(?:_\d)?)+)(?:[Ee][+-]?(?:\d(?:_\d)?)+)?/,function:/#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*(?:\.\s*(?:apply|bind|call)\s*)?\()/,operator:/-[-=]?|\+[+=]?|!=?=?|<<?=?|>>?>?=?|=(?:==?|>)?|&[&=]?|\|[|=]?|\*\*?=?|\/=?|~|\^=?|%=?|\?|\.{3}/}),i.languages.javascript["class-name"][0].pattern=/(\b(?:class|interface|extends|implements|instanceof|new)\s+)[\w.\\]+/,i.languages.insertBefore("javascript","keyword",{regex:{pattern:/((?:^|[^$\w\xA0-\uFFFF."'\])\s])\s*)\/(\[(?:[^\]\\\r\n]|\\.)*]|\\.|[^/\\\[\r\n])+\/[gimyus]{0,6}(?=\s*($|[\r\n,.;})\]]))/,lookbehind:!0,greedy:!0},"function-variable":{pattern:/#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*[=:]\s*(?:async\s*)?(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)\s*=>))/,alias:"function"},parameter:[{pattern:/(function(?:\s+[_$A-Za-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)?\s*\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\))/,lookbehind:!0,inside:i.languages.javascript},{pattern:/[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*=>)/i,inside:i.languages.javascript},{pattern:/(\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\)\s*=>)/,lookbehind:!0,inside:i.languages.javascript},{pattern:/((?:\b|\s|^)(?!(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)(?![$\w\xA0-\uFFFF]))(?:[_$A-Za-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*\s*)\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\)\s*\{)/,lookbehind:!0,inside:i.languages.javascript}],constant:/\b[A-Z](?:[A-Z_]|\dx?)*\b/}),i.languages.insertBefore("javascript","string",{"template-string":{pattern:/`(?:\\[\s\S]|\${(?:[^{}]|{(?:[^{}]|{[^}]*})*})+}|(?!\${)[^\\`])*`/,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\${(?:[^{}]|{(?:[^{}]|{[^}]*})*})+}/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\${|}$/,alias:"punctuation"},rest:i.languages.javascript}},string:/[\s\S]+/}}}),i.languages.markup&&i.languages.markup.tag.addInlined("script","javascript"),i.languages.js=i.languages.javascript,function(e){var t=e.util.clone(e.languages.javascript);e.languages.jsx=e.languages.extend("markup",t),e.languages.jsx.tag.pattern=/<\/?(?:[\w.:-]+\s*(?:\s+(?:[\w.:-]+(?:=(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s{'">=]+|\{(?:\{(?:\{[^}]*\}|[^{}])*\}|[^{}])+\}))?|\{\.{3}[a-z_$][\w$]*(?:\.[a-z_$][\w$]*)*\}))*\s*\/?)?>/i,e.languages.jsx.tag.inside.tag.pattern=/^<\/?[^\s>\/]*/i,e.languages.jsx.tag.inside["attr-value"].pattern=/=(?!\{)(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s'">]+)/i,e.languages.jsx.tag.inside.tag.inside["class-name"]=/^[A-Z]\w*(?:\.[A-Z]\w*)*$/,e.languages.insertBefore("inside","attr-name",{spread:{pattern:/\{\.{3}[a-z_$][\w$]*(?:\.[a-z_$][\w$]*)*\}/,inside:{punctuation:/\.{3}|[{}.]/,"attr-value":/\w+/}}},e.languages.jsx.tag),e.languages.insertBefore("inside","attr-value",{script:{pattern:/=(\{(?:\{(?:\{[^}]*\}|[^}])*\}|[^}])+\})/i,inside:{"script-punctuation":{pattern:/^=(?={)/,alias:"punctuation"},rest:e.languages.jsx},alias:"language-javascript"}},e.languages.jsx.tag);var n=function(e){return e?"string"==typeof e?e:"string"==typeof e.content?e.content:e.content.map(n).join(""):""},r=function(t){for(var o=[],a=0;a<t.length;a++){var i=t[a],l=!1;if("string"!=typeof i&&("tag"===i.type&&i.content[0]&&"tag"===i.content[0].type?"</"===i.content[0].content[0].content?o.length>0&&o[o.length-1].tagName===n(i.content[0].content[1])&&o.pop():"/>"===i.content[i.content.length-1].content||o.push({tagName:n(i.content[0].content[1]),openedBraces:0}):o.length>0&&"punctuation"===i.type&&"{"===i.content?o[o.length-1].openedBraces++:o.length>0&&o[o.length-1].openedBraces>0&&"punctuation"===i.type&&"}"===i.content?o[o.length-1].openedBraces--:l=!0),(l||"string"==typeof i)&&o.length>0&&0===o[o.length-1].openedBraces){var u=n(i);a<t.length-1&&("string"==typeof t[a+1]||"plain-text"===t[a+1].type)&&(u+=n(t[a+1]),t.splice(a+1,1)),a>0&&("string"==typeof t[a-1]||"plain-text"===t[a-1].type)&&(u=n(t[a-1])+u,t.splice(a-1,1),a--),t[a]=new e.Token("plain-text",u,null,u)}i.content&&"string"!=typeof i.content&&r(i.content)}};e.hooks.add("after-tokenize",(function(e){"jsx"!==e.language&&"tsx"!==e.language||r(e.tokens)}))}(i),function(e){var t=e.languages.javadoclike={parameter:{pattern:/(^\s*(?:\/{3}|\*|\/\*\*)\s*@(?:param|arg|arguments)\s+)\w+/m,lookbehind:!0},keyword:{pattern:/(^\s*(?:\/{3}|\*|\/\*\*)\s*|\{)@[a-z][a-zA-Z-]+\b/m,lookbehind:!0},punctuation:/[{}]/};Object.defineProperty(t,"addSupport",{value:function(t,n){"string"==typeof t&&(t=[t]),t.forEach((function(t){!function(t,n){var r="doc-comment",o=e.languages[t];if(o){var a=o[r];if(!a){var i={"doc-comment":{pattern:/(^|[^\\])\/\*\*[^/][\s\S]*?(?:\*\/|$)/,alias:"comment"}};a=(o=e.languages.insertBefore(t,"comment",i))[r]}if(a instanceof RegExp&&(a=o[r]={pattern:a}),Array.isArray(a))for(var l=0,u=a.length;l<u;l++)a[l]instanceof RegExp&&(a[l]={pattern:a[l]}),n(a[l]);else n(a)}}(t,(function(e){e.inside||(e.inside={}),e.inside.rest=n}))}))}}),t.addSupport(["java","javascript","php"],t)}(i),function(e){var t=/\b(?:abstract|continue|for|new|switch|assert|default|goto|package|synchronized|boolean|do|if|private|this|break|double|implements|protected|throw|byte|else|import|public|throws|case|enum|instanceof|return|transient|catch|extends|int|short|try|char|final|interface|static|void|class|finally|long|strictfp|volatile|const|float|native|super|while|var|null|exports|module|open|opens|provides|requires|to|transitive|uses|with)\b/,n=/\b[A-Z](?:\w*[a-z]\w*)?\b/;e.languages.java=e.languages.extend("clike",{"class-name":[n,/\b[A-Z]\w*(?=\s+\w+\s*[;,=())])/],keyword:t,function:[e.languages.clike.function,{pattern:/(\:\:)[a-z_]\w*/,lookbehind:!0}],number:/\b0b[01][01_]*L?\b|\b0x[\da-f_]*\.?[\da-f_p+-]+\b|(?:\b\d[\d_]*\.?[\d_]*|\B\.\d[\d_]*)(?:e[+-]?\d[\d_]*)?[dfl]?/i,operator:{pattern:/(^|[^.])(?:<<=?|>>>?=?|->|([-+&|])\2|[?:~]|[-+*/%&|^!=<>]=?)/m,lookbehind:!0}}),e.languages.insertBefore("java","class-name",{annotation:{alias:"punctuation",pattern:/(^|[^.])@\w+/,lookbehind:!0},namespace:{pattern:/(\b(?:exports|import(?:\s+static)?|module|open|opens|package|provides|requires|to|transitive|uses|with)\s+)[a-z]\w*(\.[a-z]\w*)+/,lookbehind:!0,inside:{punctuation:/\./}},generics:{pattern:/<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<[\w\s,.&?]*>)*>)*>)*>/,inside:{"class-name":n,keyword:t,punctuation:/[<>(),.:]/,operator:/[?&|]/}}})}(i),function(e){function t(e,t){return"___"+e.toUpperCase()+t+"___"}Object.defineProperties(e.languages["markup-templating"]={},{buildPlaceholders:{value:function(n,r,o,a){if(n.language===r){var i=n.tokenStack=[];n.code=n.code.replace(o,(function(e){if("function"==typeof a&&!a(e))return e;for(var o,l=i.length;-1!==n.code.indexOf(o=t(r,l));)++l;return i[l]=e,o})),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language===r&&n.tokenStack){n.grammar=e.languages[r];var o=0,a=Object.keys(n.tokenStack);!function i(l){for(var u=0;u<l.length&&!(o>=a.length);u++){var s=l[u];if("string"==typeof s||s.content&&"string"==typeof s.content){var c=a[o],d=n.tokenStack[c],f="string"==typeof s?s:s.content,p=t(r,c),m=f.indexOf(p);if(m>-1){++o;var h=f.substring(0,m),g=new e.Token(r,e.tokenize(d,n.grammar),"language-"+r,d),v=f.substring(m+p.length),y=[];h&&y.push.apply(y,i([h])),y.push(g),v&&y.push.apply(y,i([v])),"string"==typeof s?l.splice.apply(l,[u,1].concat(y)):s.content=y}}else s.content&&i(s.content)}return l}(n.tokens)}}}})}(i),function(e){e.languages.php=e.languages.extend("clike",{keyword:/\b(?:__halt_compiler|abstract|and|array|as|break|callable|case|catch|class|clone|const|continue|declare|default|die|do|echo|else|elseif|empty|enddeclare|endfor|endforeach|endif|endswitch|endwhile|eval|exit|extends|final|finally|for|foreach|function|global|goto|if|implements|include|include_once|instanceof|insteadof|interface|isset|list|namespace|new|or|parent|print|private|protected|public|require|require_once|return|static|switch|throw|trait|try|unset|use|var|while|xor|yield)\b/i,boolean:{pattern:/\b(?:false|true)\b/i,alias:"constant"},constant:[/\b[A-Z_][A-Z0-9_]*\b/,/\b(?:null)\b/i],comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0}}),e.languages.insertBefore("php","string",{"shell-comment":{pattern:/(^|[^\\])#.*/,lookbehind:!0,alias:"comment"}}),e.languages.insertBefore("php","comment",{delimiter:{pattern:/\?>$|^<\?(?:php(?=\s)|=)?/i,alias:"important"}}),e.languages.insertBefore("php","keyword",{variable:/\$+(?:\w+\b|(?={))/i,package:{pattern:/(\\|namespace\s+|use\s+)[\w\\]+/,lookbehind:!0,inside:{punctuation:/\\/}}}),e.languages.insertBefore("php","operator",{property:{pattern:/(->)[\w]+/,lookbehind:!0}});var t={pattern:/{\$(?:{(?:{[^{}]+}|[^{}]+)}|[^{}])+}|(^|[^\\{])\$+(?:\w+(?:\[.+?]|->\w+)*)/,lookbehind:!0,inside:{rest:e.languages.php}};e.languages.insertBefore("php","string",{"nowdoc-string":{pattern:/<<<'([^']+)'(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;/,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<'[^']+'|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<'?|[';]$/}}}},"heredoc-string":{pattern:/<<<(?:"([^"]+)"(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;|([a-z_]\w*)(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\2;)/i,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<(?:"[^"]+"|[a-z_]\w*)|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<"?|[";]$/}},interpolation:t}},"single-quoted-string":{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0,alias:"string"},"double-quoted-string":{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,alias:"string",inside:{interpolation:t}}}),delete e.languages.php.string,e.hooks.add("before-tokenize",(function(t){if(/<\?/.test(t.code)){e.languages["markup-templating"].buildPlaceholders(t,"php",/<\?(?:[^"'/#]|\/(?![*/])|("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|(?:\/\/|#)(?:[^?\n\r]|\?(?!>))*|\/\*[\s\S]*?(?:\*\/|$))*?(?:\?>|$)/gi)}})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"php")}))}(i),function(e){var t=e.languages.javascript,n=/{(?:[^{}]|{(?:[^{}]|{[^{}]*})*})+}/.source,r="(@(?:param|arg|argument|property)\\s+(?:"+n+"\\s+)?)";e.languages.jsdoc=e.languages.extend("javadoclike",{parameter:{pattern:RegExp(r+/[$\w\xA0-\uFFFF.]+(?=\s|$)/.source),lookbehind:!0,inside:{punctuation:/\./}}}),e.languages.insertBefore("jsdoc","keyword",{"optional-parameter":{pattern:RegExp(r+/\[[$\w\xA0-\uFFFF.]+(?:=[^[\]]+)?\](?=\s|$)/.source),lookbehind:!0,inside:{parameter:{pattern:/(^\[)[$\w\xA0-\uFFFF\.]+/,lookbehind:!0,inside:{punctuation:/\./}},code:{pattern:/(=)[\s\S]*(?=\]$)/,lookbehind:!0,inside:t,alias:"language-javascript"},punctuation:/[=[\]]/}},"class-name":[{pattern:RegExp("(@[a-z]+\\s+)"+n),lookbehind:!0,inside:{punctuation:/[.,:?=<>|{}()[\]]/}},{pattern:/(@(?:augments|extends|class|interface|memberof!?|this)\s+)[A-Z]\w*(?:\.[A-Z]\w*)*/,lookbehind:!0,inside:{punctuation:/\./}}],example:{pattern:/(@example\s+)[^@]+?(?=\s*(?:\*\s*)?(?:@\w|\*\/))/,lookbehind:!0,inside:{code:{pattern:/^(\s*(?:\*\s*)?).+$/m,lookbehind:!0,inside:t,alias:"language-javascript"}}}}),e.languages.javadoclike.addSupport("javascript",e.languages.jsdoc)}(i),i.languages.actionscript=i.languages.extend("javascript",{keyword:/\b(?:as|break|case|catch|class|const|default|delete|do|else|extends|finally|for|function|if|implements|import|in|instanceof|interface|internal|is|native|new|null|package|private|protected|public|return|super|switch|this|throw|try|typeof|use|var|void|while|with|dynamic|each|final|get|include|namespace|native|override|set|static)\b/,operator:/\+\+|--|(?:[+\-*\/%^]|&&?|\|\|?|<<?|>>?>?|[!=]=?)=?|[~?@]/}),i.languages.actionscript["class-name"].alias="function",i.languages.markup&&i.languages.insertBefore("actionscript","string",{xml:{pattern:/(^|[^.])<\/?\w+(?:\s+[^\s>\/=]+=("|')(?:\\[\s\S]|(?!\2)[^\\])*\2)*\s*\/?>/,lookbehind:!0,inside:{rest:i.languages.markup}}}),function(e){var t=/#(?!\{).+/,n={pattern:/#\{[^}]+\}/,alias:"variable"};e.languages.coffeescript=e.languages.extend("javascript",{comment:t,string:[{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0},{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,inside:{interpolation:n}}],keyword:/\b(?:and|break|by|catch|class|continue|debugger|delete|do|each|else|extend|extends|false|finally|for|if|in|instanceof|is|isnt|let|loop|namespace|new|no|not|null|of|off|on|or|own|return|super|switch|then|this|throw|true|try|typeof|undefined|unless|until|when|while|window|with|yes|yield)\b/,"class-member":{pattern:/@(?!\d)\w+/,alias:"variable"}}),e.languages.insertBefore("coffeescript","comment",{"multiline-comment":{pattern:/###[\s\S]+?###/,alias:"comment"},"block-regex":{pattern:/\/{3}[\s\S]*?\/{3}/,alias:"regex",inside:{comment:t,interpolation:n}}}),e.languages.insertBefore("coffeescript","string",{"inline-javascript":{pattern:/`(?:\\[\s\S]|[^\\`])*`/,inside:{delimiter:{pattern:/^`|`$/,alias:"punctuation"},rest:e.languages.javascript}},"multiline-string":[{pattern:/'''[\s\S]*?'''/,greedy:!0,alias:"string"},{pattern:/"""[\s\S]*?"""/,greedy:!0,alias:"string",inside:{interpolation:n}}]}),e.languages.insertBefore("coffeescript","keyword",{property:/(?!\d)\w+(?=\s*:(?!:))/}),delete e.languages.coffeescript["template-string"],e.languages.coffee=e.languages.coffeescript}(i),function(e){e.languages.insertBefore("javascript","function-variable",{"method-variable":{pattern:RegExp("(\\.\\s*)"+e.languages.javascript["function-variable"].pattern.source),lookbehind:!0,alias:["function-variable","method","function","property-access"]}}),e.languages.insertBefore("javascript","function",{method:{pattern:RegExp("(\\.\\s*)"+e.languages.javascript.function.source),lookbehind:!0,alias:["function","property-access"]}}),e.languages.insertBefore("javascript","constant",{"known-class-name":[{pattern:/\b(?:(?:(?:Uint|Int)(?:8|16|32)|Uint8Clamped|Float(?:32|64))?Array|ArrayBuffer|BigInt|Boolean|DataView|Date|Error|Function|Intl|JSON|Math|Number|Object|Promise|Proxy|Reflect|RegExp|String|Symbol|(?:Weak)?(?:Set|Map)|WebAssembly)\b/,alias:"class-name"},{pattern:/\b(?:[A-Z]\w*)Error\b/,alias:"class-name"}]}),e.languages.javascript.keyword.unshift({pattern:/\b(?:as|default|export|from|import)\b/,alias:"module"},{pattern:/\bnull\b/,alias:["null","nil"]},{pattern:/\bundefined\b/,alias:"nil"}),e.languages.insertBefore("javascript","operator",{spread:{pattern:/\.{3}/,alias:"operator"},arrow:{pattern:/=>/,alias:"operator"}}),e.languages.insertBefore("javascript","punctuation",{"property-access":{pattern:/(\.\s*)#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*/,lookbehind:!0},"maybe-class-name":{pattern:/(^|[^$\w\xA0-\uFFFF])[A-Z][$\w\xA0-\uFFFF]+/,lookbehind:!0},dom:{pattern:/\b(?:document|location|navigator|performance|(?:local|session)Storage|window)\b/,alias:"variable"},console:{pattern:/\bconsole(?=\s*\.)/,alias:"class-name"}});for(var t=["function","function-variable","method","method-variable","property-access"],n=0;n<t.length;n++){var r=t[n],o=e.languages.javascript[r];"RegExp"===e.util.type(o)&&(o=e.languages.javascript[r]={pattern:o});var a=o.inside||{};o.inside=a,a["maybe-class-name"]=/^[A-Z][\s\S]*/}}(i),function(e){e.languages.flow=e.languages.extend("javascript",{}),e.languages.insertBefore("flow","keyword",{type:[{pattern:/\b(?:[Nn]umber|[Ss]tring|[Bb]oolean|Function|any|mixed|null|void)\b/,alias:"tag"}]}),e.languages.flow["function-variable"].pattern=/[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*=\s*(?:function\b|(?:\([^()]*\)(?:\s*:\s*\w+)?|[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)\s*=>))/i,delete e.languages.flow.parameter,e.languages.insertBefore("flow","operator",{"flow-punctuation":{pattern:/\{\||\|\}/,alias:"punctuation"}}),Array.isArray(e.languages.flow.keyword)||(e.languages.flow.keyword=[e.languages.flow.keyword]),e.languages.flow.keyword.unshift({pattern:/(^|[^$]\b)(?:type|opaque|declare|Class)\b(?!\$)/,lookbehind:!0},{pattern:/(^|[^$]\B)\$(?:await|Diff|Exact|Keys|ObjMap|PropertyType|Shape|Record|Supertype|Subtype|Enum)\b(?!\$)/,lookbehind:!0})}(i),i.languages.n4js=i.languages.extend("javascript",{keyword:/\b(?:any|Array|boolean|break|case|catch|class|const|constructor|continue|debugger|declare|default|delete|do|else|enum|export|extends|false|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|module|new|null|number|package|private|protected|public|return|set|static|string|super|switch|this|throw|true|try|typeof|var|void|while|with|yield)\b/}),i.languages.insertBefore("n4js","constant",{annotation:{pattern:/@+\w+/,alias:"operator"}}),i.languages.n4jsd=i.languages.n4js,i.languages.typescript=i.languages.extend("javascript",{keyword:/\b(?:abstract|as|async|await|break|case|catch|class|const|constructor|continue|debugger|declare|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|is|keyof|let|module|namespace|new|null|of|package|private|protected|public|readonly|return|require|set|static|super|switch|this|throw|try|type|typeof|var|void|while|with|yield)\b/,builtin:/\b(?:string|Function|any|number|boolean|Array|symbol|console|Promise|unknown|never)\b/}),i.languages.ts=i.languages.typescript,function(e){var t=e.languages.javascript["template-string"],n=t.pattern.source,r=t.inside.interpolation,o=r.inside["interpolation-punctuation"],a=r.pattern.source;function i(t,r){if(e.languages[t])return{pattern:RegExp("((?:"+r+")\\s*)"+n),lookbehind:!0,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},"embedded-code":{pattern:/[\s\S]+/,alias:t}}}}function l(e,t){return"___"+t.toUpperCase()+"_"+e+"___"}function u(t,n,r){var o={code:t,grammar:n,language:r};return e.hooks.run("before-tokenize",o),o.tokens=e.tokenize(o.code,o.grammar),e.hooks.run("after-tokenize",o),o.tokens}function s(t){var n={};n["interpolation-punctuation"]=o;var a=e.tokenize(t,n);if(3===a.length){var i=[1,1];i.push.apply(i,u(a[1],e.languages.javascript,"javascript")),a.splice.apply(a,i)}return new e.Token("interpolation",a,r.alias,t)}function c(t,n,r){var o=e.tokenize(t,{interpolation:{pattern:RegExp(a),lookbehind:!0}}),i=0,c={},d=u(o.map((function(e){if("string"==typeof e)return e;for(var n,o=e.content;-1!==t.indexOf(n=l(i++,r)););return c[n]=o,n})).join(""),n,r),f=Object.keys(c);return i=0,function e(t){for(var n=0;n<t.length;n++){if(i>=f.length)return;var r=t[n];if("string"==typeof r||"string"==typeof r.content){var o=f[i],a="string"==typeof r?r:r.content,l=a.indexOf(o);if(-1!==l){++i;var u=a.substring(0,l),d=s(c[o]),p=a.substring(l+o.length),m=[];if(u&&m.push(u),m.push(d),p){var h=[p];e(h),m.push.apply(m,h)}"string"==typeof r?(t.splice.apply(t,[n,1].concat(m)),n+=m.length-1):r.content=m}}else{var g=r.content;Array.isArray(g)?e(g):e([g])}}}(d),new e.Token(r,d,"language-"+r,t)}e.languages.javascript["template-string"]=[i("css",/\b(?:styled(?:\([^)]*\))?(?:\s*\.\s*\w+(?:\([^)]*\))*)*|css(?:\s*\.\s*(?:global|resolve))?|createGlobalStyle|keyframes)/.source),i("html",/\bhtml|\.\s*(?:inner|outer)HTML\s*\+?=/.source),i("svg",/\bsvg/.source),i("markdown",/\b(?:md|markdown)/.source),i("graphql",/\b(?:gql|graphql(?:\s*\.\s*experimental)?)/.source),t].filter(Boolean);var d={javascript:!0,js:!0,typescript:!0,ts:!0,jsx:!0,tsx:!0};function f(e){return"string"==typeof e?e:Array.isArray(e)?e.map(f).join(""):f(e.content)}e.hooks.add("after-tokenize",(function(t){t.language in d&&function t(n){for(var r=0,o=n.length;r<o;r++){var a=n[r];if("string"!=typeof a){var i=a.content;if(Array.isArray(i))if("template-string"===a.type){var l=i[1];if(3===i.length&&"string"!=typeof l&&"embedded-code"===l.type){var u=f(l),s=l.alias,d=Array.isArray(s)?s[0]:s,p=e.languages[d];if(!p)continue;i[1]=c(u,p,d)}}else t(i);else"string"!=typeof i&&t([i])}}}(t.tokens)}))}(i),i.languages.graphql={comment:/#.*/,string:{pattern:/"(?:\\.|[^\\"\r\n])*"/,greedy:!0},number:/(?:\B-|\b)\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,boolean:/\b(?:true|false)\b/,variable:/\$[a-z_]\w*/i,directive:{pattern:/@[a-z_]\w*/i,alias:"function"},"attr-name":{pattern:/[a-z_]\w*(?=\s*(?:\((?:[^()"]|"(?:\\.|[^\\"\r\n])*")*\))?:)/i,greedy:!0},"class-name":{pattern:/(\b(?:enum|implements|interface|on|scalar|type|union)\s+)[a-zA-Z_]\w*/,lookbehind:!0},fragment:{pattern:/(\bfragment\s+|\.{3}\s*(?!on\b))[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},keyword:/\b(?:enum|fragment|implements|input|interface|mutation|on|query|scalar|schema|type|union)\b/,operator:/[!=|]|\.{3}/,punctuation:/[!(){}\[\]:=,]/,constant:/\b(?!ID\b)[A-Z][A-Z_\d]*\b/},function(e){var t=/(?:\\.|[^\\\n\r]|(?:\r?\n|\r)(?!\r?\n|\r))/.source;function n(e,n){return e=e.replace(/<inner>/g,t),n&&(e=e+"|"+e.replace(/_/g,"\\*")),RegExp(/((?:^|[^\\])(?:\\{2})*)/.source+"(?:"+e+")")}var r=/(?:\\.|``.+?``|`[^`\r\n]+`|[^\\|\r\n`])+/.source,o=/\|?__(?:\|__)+\|?(?:(?:\r?\n|\r)|$)/.source.replace(/__/g,r),a=/\|?[ \t]*:?-{3,}:?[ \t]*(?:\|[ \t]*:?-{3,}:?[ \t]*)+\|?(?:\r?\n|\r)/.source;e.languages.markdown=e.languages.extend("markup",{}),e.languages.insertBefore("markdown","prolog",{blockquote:{pattern:/^>(?:[\t ]*>)*/m,alias:"punctuation"},table:{pattern:RegExp("^"+o+a+"(?:"+o+")*","m"),inside:{"table-data-rows":{pattern:RegExp("^("+o+a+")(?:"+o+")*$"),lookbehind:!0,inside:{"table-data":{pattern:RegExp(r),inside:e.languages.markdown},punctuation:/\|/}},"table-line":{pattern:RegExp("^("+o+")"+a+"$"),lookbehind:!0,inside:{punctuation:/\||:?-{3,}:?/}},"table-header-row":{pattern:RegExp("^"+o+"$"),inside:{"table-header":{pattern:RegExp(r),alias:"important",inside:e.languages.markdown},punctuation:/\|/}}}},code:[{pattern:/(^[ \t]*(?:\r?\n|\r))(?: {4}|\t).+(?:(?:\r?\n|\r)(?: {4}|\t).+)*/m,lookbehind:!0,alias:"keyword"},{pattern:/``.+?``|`[^`\r\n]+`/,alias:"keyword"},{pattern:/^```[\s\S]*?^```$/m,greedy:!0,inside:{"code-block":{pattern:/^(```.*(?:\r?\n|\r))[\s\S]+?(?=(?:\r?\n|\r)^```$)/m,lookbehind:!0},"code-language":{pattern:/^(```).+/,lookbehind:!0},punctuation:/```/}}],title:[{pattern:/\S.*(?:\r?\n|\r)(?:==+|--+)(?=[ \t]*$)/m,alias:"important",inside:{punctuation:/==+$|--+$/}},{pattern:/(^\s*)#+.+/m,lookbehind:!0,alias:"important",inside:{punctuation:/^#+|#+$/}}],hr:{pattern:/(^\s*)([*-])(?:[\t ]*\2){2,}(?=\s*$)/m,lookbehind:!0,alias:"punctuation"},list:{pattern:/(^\s*)(?:[*+-]|\d+\.)(?=[\t ].)/m,lookbehind:!0,alias:"punctuation"},"url-reference":{pattern:/!?\[[^\]]+\]:[\t ]+(?:\S+|<(?:\\.|[^>\\])+>)(?:[\t ]+(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\)))?/,inside:{variable:{pattern:/^(!?\[)[^\]]+/,lookbehind:!0},string:/(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\))$/,punctuation:/^[\[\]!:]|[<>]/},alias:"url"},bold:{pattern:n(/__(?:(?!_)<inner>|_(?:(?!_)<inner>)+_)+__/.source,!0),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^..)[\s\S]+(?=..$)/,lookbehind:!0,inside:{}},punctuation:/\*\*|__/}},italic:{pattern:n(/_(?:(?!_)<inner>|__(?:(?!_)<inner>)+__)+_/.source,!0),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^.)[\s\S]+(?=.$)/,lookbehind:!0,inside:{}},punctuation:/[*_]/}},strike:{pattern:n(/(~~?)(?:(?!~)<inner>)+?\2/.source,!1),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^~~?)[\s\S]+(?=\1$)/,lookbehind:!0,inside:{}},punctuation:/~~?/}},url:{pattern:n(/!?\[(?:(?!\])<inner>)+\](?:\([^\s)]+(?:[\t ]+"(?:\\.|[^"\\])*")?\)| ?\[(?:(?!\])<inner>)+\])/.source,!1),lookbehind:!0,greedy:!0,inside:{variable:{pattern:/(\[)[^\]]+(?=\]$)/,lookbehind:!0},content:{pattern:/(^!?\[)[^\]]+(?=\])/,lookbehind:!0,inside:{}},string:{pattern:/"(?:\\.|[^"\\])*"(?=\)$)/}}}}),["url","bold","italic","strike"].forEach((function(t){["url","bold","italic","strike"].forEach((function(n){t!==n&&(e.languages.markdown[t].inside.content.inside[n]=e.languages.markdown[n])}))})),e.hooks.add("after-tokenize",(function(e){"markdown"!==e.language&&"md"!==e.language||function e(t){if(t&&"string"!=typeof t)for(var n=0,r=t.length;n<r;n++){var o=t[n];if("code"===o.type){var a=o.content[1],i=o.content[3];if(a&&i&&"code-language"===a.type&&"code-block"===i.type&&"string"==typeof a.content){var l="language-"+a.content.trim().split(/\s+/)[0].toLowerCase();i.alias?"string"==typeof i.alias?i.alias=[i.alias,l]:i.alias.push(l):i.alias=[l]}}else e(o.content)}}(e.tokens)})),e.hooks.add("wrap",(function(t){if("code-block"===t.type){for(var n="",r=0,o=t.classes.length;r<o;r++){var a=t.classes[r],i=/language-(.+)/.exec(a);if(i){n=i[1];break}}var l=e.languages[n];if(l){var u=t.content.replace(/&lt;/g,"<").replace(/&amp;/g,"&");t.content=e.highlight(u,l,n)}else if(n&&"none"!==n&&e.plugins.autoloader){var s="md-"+(new Date).valueOf()+"-"+Math.floor(1e16*Math.random());t.attributes.id=s,e.plugins.autoloader.loadLanguages(n,(function(){var t=document.getElementById(s);t&&(t.innerHTML=e.highlight(t.textContent,e.languages[n],n))}))}}})),e.languages.md=e.languages.markdown}(i),function(e){e.languages.diff={coord:[/^(?:\*{3}|-{3}|\+{3}).*$/m,/^@@.*@@$/m,/^\d+.*$/m]};var t={"deleted-sign":"-","deleted-arrow":"<","inserted-sign":"+","inserted-arrow":">",unchanged:" ",diff:"!"};Object.keys(t).forEach((function(n){var r=t[n],o=[];/^\w+$/.test(n)||o.push(/\w+/.exec(n)[0]),"diff"===n&&o.push("bold"),e.languages.diff[n]={pattern:RegExp("^(?:["+r+"].*(?:\r\n?|\n|(?![\\s\\S])))+","m"),alias:o}})),Object.defineProperty(e.languages.diff,"PREFIXES",{value:t})}(i),i.languages.git={comment:/^#.*/m,deleted:/^[-\u2013].*/m,inserted:/^\+.*/m,string:/("|')(?:\\.|(?!\1)[^\\\r\n])*\1/m,command:{pattern:/^.*\$ git .*$/m,inside:{parameter:/\s--?\w+/m}},coord:/^@@.*@@$/m,commit_sha1:/^commit \w{40}$/m},i.languages.go=i.languages.extend("clike",{keyword:/\b(?:break|case|chan|const|continue|default|defer|else|fallthrough|for|func|go(?:to)?|if|import|interface|map|package|range|return|select|struct|switch|type|var)\b/,builtin:/\b(?:bool|byte|complex(?:64|128)|error|float(?:32|64)|rune|string|u?int(?:8|16|32|64)?|uintptr|append|cap|close|complex|copy|delete|imag|len|make|new|panic|print(?:ln)?|real|recover)\b/,boolean:/\b(?:_|iota|nil|true|false)\b/,operator:/[*\/%^!=]=?|\+[=+]?|-[=-]?|\|[=|]?|&(?:=|&|\^=?)?|>(?:>=?|=)?|<(?:<=?|=|-)?|:=|\.\.\./,number:/(?:\b0x[a-f\d]+|(?:\b\d+\.?\d*|\B\.\d+)(?:e[-+]?\d+)?)i?/i,string:{pattern:/(["'`])(\\[\s\S]|(?!\1)[^\\])*\1/,greedy:!0}}),delete i.languages.go["class-name"],function(e){e.languages.handlebars={comment:/\{\{![\s\S]*?\}\}/,delimiter:{pattern:/^\{\{\{?|\}\}\}?$/i,alias:"punctuation"},string:/(["'])(?:\\.|(?!\1)[^\\\r\n])*\1/,number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:[Ee][+-]?\d+)?/,boolean:/\b(?:true|false)\b/,block:{pattern:/^(\s*~?\s*)[#\/]\S+?(?=\s*~?\s*$|\s)/i,lookbehind:!0,alias:"keyword"},brackets:{pattern:/\[[^\]]+\]/,inside:{punctuation:/\[|\]/,variable:/[\s\S]+/}},punctuation:/[!"#%&'()*+,.\/;<=>@\[\\\]^`{|}~]/,variable:/[^!"#%&'()*+,.\/;<=>@\[\\\]^`{|}~\s]+/},e.hooks.add("before-tokenize",(function(t){e.languages["markup-templating"].buildPlaceholders(t,"handlebars",/\{\{\{[\s\S]+?\}\}\}|\{\{[\s\S]+?\}\}/g)})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"handlebars")}))}(i),i.languages.json={property:{pattern:/"(?:\\.|[^\\"\r\n])*"(?=\s*:)/,greedy:!0},string:{pattern:/"(?:\\.|[^\\"\r\n])*"(?!\s*:)/,greedy:!0},comment:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,number:/-?\d+\.?\d*(e[+-]?\d+)?/i,punctuation:/[{}[\],]/,operator:/:/,boolean:/\b(?:true|false)\b/,null:{pattern:/\bnull\b/,alias:"keyword"}},i.languages.less=i.languages.extend("css",{comment:[/\/\*[\s\S]*?\*\//,{pattern:/(^|[^\\])\/\/.*/,lookbehind:!0}],atrule:{pattern:/@[\w-]+?(?:\([^{}]+\)|[^(){};])*?(?=\s*\{)/i,inside:{punctuation:/[:()]/}},selector:{pattern:/(?:@\{[\w-]+\}|[^{};\s@])(?:@\{[\w-]+\}|\([^{}]*\)|[^{};@])*?(?=\s*\{)/,inside:{variable:/@+[\w-]+/}},property:/(?:@\{[\w-]+\}|[\w-])+(?:\+_?)?(?=\s*:)/i,operator:/[+\-*\/]/}),i.languages.insertBefore("less","property",{variable:[{pattern:/@[\w-]+\s*:/,inside:{punctuation:/:/}},/@@?[\w-]+/],"mixin-usage":{pattern:/([{;]\s*)[.#](?!\d)[\w-]+.*?(?=[(;])/,lookbehind:!0,alias:"function"}}),i.languages.makefile={comment:{pattern:/(^|[^\\])#(?:\\(?:\r\n|[\s\S])|[^\\\r\n])*/,lookbehind:!0},string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},builtin:/\.[A-Z][^:#=\s]+(?=\s*:(?!=))/,symbol:{pattern:/^[^:=\r\n]+(?=\s*:(?!=))/m,inside:{variable:/\$+(?:[^(){}:#=\s]+|(?=[({]))/}},variable:/\$+(?:[^(){}:#=\s]+|\([@*%<^+?][DF]\)|(?=[({]))/,keyword:[/-include\b|\b(?:define|else|endef|endif|export|ifn?def|ifn?eq|include|override|private|sinclude|undefine|unexport|vpath)\b/,{pattern:/(\()(?:addsuffix|abspath|and|basename|call|dir|error|eval|file|filter(?:-out)?|findstring|firstword|flavor|foreach|guile|if|info|join|lastword|load|notdir|or|origin|patsubst|realpath|shell|sort|strip|subst|suffix|value|warning|wildcard|word(?:s|list)?)(?=[ \t])/,lookbehind:!0}],operator:/(?:::|[?:+!])?=|[|@]/,punctuation:/[:;(){}]/},i.languages.objectivec=i.languages.extend("c",{keyword:/\b(?:asm|typeof|inline|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|union|unsigned|void|volatile|while|in|self|super)\b|(?:@interface|@end|@implementation|@protocol|@class|@public|@protected|@private|@property|@try|@catch|@finally|@throw|@synthesize|@dynamic|@selector)\b/,string:/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1|@"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,operator:/-[->]?|\+\+?|!=?|<<?=?|>>?=?|==?|&&?|\|\|?|[~^%?*\/@]/}),delete i.languages.objectivec["class-name"],i.languages.ocaml={comment:/\(\*[\s\S]*?\*\)/,string:[{pattern:/"(?:\\.|[^\\\r\n"])*"/,greedy:!0},{pattern:/(['`])(?:\\(?:\d+|x[\da-f]+|.)|(?!\1)[^\\\r\n])\1/i,greedy:!0}],number:/\b(?:0x[\da-f][\da-f_]+|(?:0[bo])?\d[\d_]*\.?[\d_]*(?:e[+-]?[\d_]+)?)/i,type:{pattern:/\B['`]\w*/,alias:"variable"},directive:{pattern:/\B#\w+/,alias:"function"},keyword:/\b(?:as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|match|method|module|mutable|new|object|of|open|prefix|private|rec|then|sig|struct|to|try|type|val|value|virtual|where|while|with)\b/,boolean:/\b(?:false|true)\b/,operator:/:=|[=<>@^|&+\-*\/$%!?~][!$%&*+\-.\/:<=>?@^|~]*|\b(?:and|asr|land|lor|lxor|lsl|lsr|mod|nor|or)\b/,punctuation:/[(){}\[\]|_.,:;]/},i.languages.python={comment:{pattern:/(^|[^\\])#.*/,lookbehind:!0},"string-interpolation":{pattern:/(?:f|rf|fr)(?:("""|''')[\s\S]+?\1|("|')(?:\\.|(?!\2)[^\\\r\n])*\2)/i,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^{])(?:{{)*){(?!{)(?:[^{}]|{(?!{)(?:[^{}]|{(?!{)(?:[^{}])+})+})+}/,lookbehind:!0,inside:{"format-spec":{pattern:/(:)[^:(){}]+(?=}$)/,lookbehind:!0},"conversion-option":{pattern:/![sra](?=[:}]$)/,alias:"punctuation"},rest:null}},string:/[\s\S]+/}},"triple-quoted-string":{pattern:/(?:[rub]|rb|br)?("""|''')[\s\S]+?\1/i,greedy:!0,alias:"string"},string:{pattern:/(?:[rub]|rb|br)?("|')(?:\\.|(?!\1)[^\\\r\n])*\1/i,greedy:!0},function:{pattern:/((?:^|\s)def[ \t]+)[a-zA-Z_]\w*(?=\s*\()/g,lookbehind:!0},"class-name":{pattern:/(\bclass\s+)\w+/i,lookbehind:!0},decorator:{pattern:/(^\s*)@\w+(?:\.\w+)*/i,lookbehind:!0,alias:["annotation","punctuation"],inside:{punctuation:/\./}},keyword:/\b(?:and|as|assert|async|await|break|class|continue|def|del|elif|else|except|exec|finally|for|from|global|if|import|in|is|lambda|nonlocal|not|or|pass|print|raise|return|try|while|with|yield)\b/,builtin:/\b(?:__import__|abs|all|any|apply|ascii|basestring|bin|bool|buffer|bytearray|bytes|callable|chr|classmethod|cmp|coerce|compile|complex|delattr|dict|dir|divmod|enumerate|eval|execfile|file|filter|float|format|frozenset|getattr|globals|hasattr|hash|help|hex|id|input|int|intern|isinstance|issubclass|iter|len|list|locals|long|map|max|memoryview|min|next|object|oct|open|ord|pow|property|range|raw_input|reduce|reload|repr|reversed|round|set|setattr|slice|sorted|staticmethod|str|sum|super|tuple|type|unichr|unicode|vars|xrange|zip)\b/,boolean:/\b(?:True|False|None)\b/,number:/(?:\b(?=\d)|\B(?=\.))(?:0[bo])?(?:(?:\d|0x[\da-f])[\da-f]*\.?\d*|\.\d+)(?:e[+-]?\d+)?j?\b/i,operator:/[-+%=]=?|!=|\*\*?=?|\/\/?=?|<[<=>]?|>[=>]?|[&|^~]/,punctuation:/[{}[\];(),.:]/},i.languages.python["string-interpolation"].inside.interpolation.inside.rest=i.languages.python,i.languages.py=i.languages.python,i.languages.reason=i.languages.extend("clike",{comment:{pattern:/(^|[^\\])\/\*[\s\S]*?\*\//,lookbehind:!0},string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^\\\r\n"])*"/,greedy:!0},"class-name":/\b[A-Z]\w*/,keyword:/\b(?:and|as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|method|module|mutable|new|nonrec|object|of|open|or|private|rec|sig|struct|switch|then|to|try|type|val|virtual|when|while|with)\b/,operator:/\.{3}|:[:=]|\|>|->|=(?:==?|>)?|<=?|>=?|[|^?'#!~`]|[+\-*\/]\.?|\b(?:mod|land|lor|lxor|lsl|lsr|asr)\b/}),i.languages.insertBefore("reason","class-name",{character:{pattern:/'(?:\\x[\da-f]{2}|\\o[0-3][0-7][0-7]|\\\d{3}|\\.|[^'\\\r\n])'/,alias:"string"},constructor:{pattern:/\b[A-Z]\w*\b(?!\s*\.)/,alias:"variable"},label:{pattern:/\b[a-z]\w*(?=::)/,alias:"symbol"}}),delete i.languages.reason.function,function(e){e.languages.sass=e.languages.extend("css",{comment:{pattern:/^([ \t]*)\/[\/*].*(?:(?:\r?\n|\r)\1[ \t]+.+)*/m,lookbehind:!0}}),e.languages.insertBefore("sass","atrule",{"atrule-line":{pattern:/^(?:[ \t]*)[@+=].+/m,inside:{atrule:/(?:@[\w-]+|[+=])/m}}}),delete e.languages.sass.atrule;var t=/\$[-\w]+|#\{\$[-\w]+\}/,n=[/[+*\/%]|[=!]=|<=?|>=?|\b(?:and|or|not)\b/,{pattern:/(\s+)-(?=\s)/,lookbehind:!0}];e.languages.insertBefore("sass","property",{"variable-line":{pattern:/^[ \t]*\$.+/m,inside:{punctuation:/:/,variable:t,operator:n}},"property-line":{pattern:/^[ \t]*(?:[^:\s]+ *:.*|:[^:\s]+.*)/m,inside:{property:[/[^:\s]+(?=\s*:)/,{pattern:/(:)[^:\s]+/,lookbehind:!0}],punctuation:/:/,variable:t,operator:n,important:e.languages.sass.important}}}),delete e.languages.sass.property,delete e.languages.sass.important,e.languages.insertBefore("sass","punctuation",{selector:{pattern:/([ \t]*)\S(?:,?[^,\r\n]+)*(?:,(?:\r?\n|\r)\1[ \t]+\S(?:,?[^,\r\n]+)*)*/,lookbehind:!0}})}(i),i.languages.scss=i.languages.extend("css",{comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},atrule:{pattern:/@[\w-]+(?:\([^()]+\)|[^(])*?(?=\s+[{;])/,inside:{rule:/@[\w-]+/}},url:/(?:[-a-z]+-)?url(?=\()/i,selector:{pattern:/(?=\S)[^@;{}()]?(?:[^@;{}()]|#\{\$[-\w]+\})+(?=\s*\{(?:\}|\s|[^}]+[:{][^}]+))/m,inside:{parent:{pattern:/&/,alias:"important"},placeholder:/%[-\w]+/,variable:/\$[-\w]+|#\{\$[-\w]+\}/}},property:{pattern:/(?:[\w-]|\$[-\w]+|#\{\$[-\w]+\})+(?=\s*:)/,inside:{variable:/\$[-\w]+|#\{\$[-\w]+\}/}}}),i.languages.insertBefore("scss","atrule",{keyword:[/@(?:if|else(?: if)?|for|each|while|import|extend|debug|warn|mixin|include|function|return|content)/i,{pattern:/( +)(?:from|through)(?= )/,lookbehind:!0}]}),i.languages.insertBefore("scss","important",{variable:/\$[-\w]+|#\{\$[-\w]+\}/}),i.languages.insertBefore("scss","function",{placeholder:{pattern:/%[-\w]+/,alias:"selector"},statement:{pattern:/\B!(?:default|optional)\b/i,alias:"keyword"},boolean:/\b(?:true|false)\b/,null:{pattern:/\bnull\b/,alias:"keyword"},operator:{pattern:/(\s)(?:[-+*\/%]|[=!]=|<=?|>=?|and|or|not)(?=\s)/,lookbehind:!0}}),i.languages.scss.atrule.inside.rest=i.languages.scss,i.languages.sql={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/|#).*)/,lookbehind:!0},variable:[{pattern:/@(["'`])(?:\\[\s\S]|(?!\1)[^\\])+\1/,greedy:!0},/@[\w.$]+/],string:{pattern:/(^|[^@\\])("|')(?:\\[\s\S]|(?!\2)[^\\]|\2\2)*\2/,greedy:!0,lookbehind:!0},function:/\b(?:AVG|COUNT|FIRST|FORMAT|LAST|LCASE|LEN|MAX|MID|MIN|MOD|NOW|ROUND|SUM|UCASE)(?=\s*\()/i,keyword:/\b(?:ACTION|ADD|AFTER|ALGORITHM|ALL|ALTER|ANALYZE|ANY|APPLY|AS|ASC|AUTHORIZATION|AUTO_INCREMENT|BACKUP|BDB|BEGIN|BERKELEYDB|BIGINT|BINARY|BIT|BLOB|BOOL|BOOLEAN|BREAK|BROWSE|BTREE|BULK|BY|CALL|CASCADED?|CASE|CHAIN|CHAR(?:ACTER|SET)?|CHECK(?:POINT)?|CLOSE|CLUSTERED|COALESCE|COLLATE|COLUMNS?|COMMENT|COMMIT(?:TED)?|COMPUTE|CONNECT|CONSISTENT|CONSTRAINT|CONTAINS(?:TABLE)?|CONTINUE|CONVERT|CREATE|CROSS|CURRENT(?:_DATE|_TIME|_TIMESTAMP|_USER)?|CURSOR|CYCLE|DATA(?:BASES?)?|DATE(?:TIME)?|DAY|DBCC|DEALLOCATE|DEC|DECIMAL|DECLARE|DEFAULT|DEFINER|DELAYED|DELETE|DELIMITERS?|DENY|DESC|DESCRIBE|DETERMINISTIC|DISABLE|DISCARD|DISK|DISTINCT|DISTINCTROW|DISTRIBUTED|DO|DOUBLE|DROP|DUMMY|DUMP(?:FILE)?|DUPLICATE|ELSE(?:IF)?|ENABLE|ENCLOSED|END|ENGINE|ENUM|ERRLVL|ERRORS|ESCAPED?|EXCEPT|EXEC(?:UTE)?|EXISTS|EXIT|EXPLAIN|EXTENDED|FETCH|FIELDS|FILE|FILLFACTOR|FIRST|FIXED|FLOAT|FOLLOWING|FOR(?: EACH ROW)?|FORCE|FOREIGN|FREETEXT(?:TABLE)?|FROM|FULL|FUNCTION|GEOMETRY(?:COLLECTION)?|GLOBAL|GOTO|GRANT|GROUP|HANDLER|HASH|HAVING|HOLDLOCK|HOUR|IDENTITY(?:_INSERT|COL)?|IF|IGNORE|IMPORT|INDEX|INFILE|INNER|INNODB|INOUT|INSERT|INT|INTEGER|INTERSECT|INTERVAL|INTO|INVOKER|ISOLATION|ITERATE|JOIN|KEYS?|KILL|LANGUAGE|LAST|LEAVE|LEFT|LEVEL|LIMIT|LINENO|LINES|LINESTRING|LOAD|LOCAL|LOCK|LONG(?:BLOB|TEXT)|LOOP|MATCH(?:ED)?|MEDIUM(?:BLOB|INT|TEXT)|MERGE|MIDDLEINT|MINUTE|MODE|MODIFIES|MODIFY|MONTH|MULTI(?:LINESTRING|POINT|POLYGON)|NATIONAL|NATURAL|NCHAR|NEXT|NO|NONCLUSTERED|NULLIF|NUMERIC|OFF?|OFFSETS?|ON|OPEN(?:DATASOURCE|QUERY|ROWSET)?|OPTIMIZE|OPTION(?:ALLY)?|ORDER|OUT(?:ER|FILE)?|OVER|PARTIAL|PARTITION|PERCENT|PIVOT|PLAN|POINT|POLYGON|PRECEDING|PRECISION|PREPARE|PREV|PRIMARY|PRINT|PRIVILEGES|PROC(?:EDURE)?|PUBLIC|PURGE|QUICK|RAISERROR|READS?|REAL|RECONFIGURE|REFERENCES|RELEASE|RENAME|REPEAT(?:ABLE)?|REPLACE|REPLICATION|REQUIRE|RESIGNAL|RESTORE|RESTRICT|RETURNS?|REVOKE|RIGHT|ROLLBACK|ROUTINE|ROW(?:COUNT|GUIDCOL|S)?|RTREE|RULE|SAVE(?:POINT)?|SCHEMA|SECOND|SELECT|SERIAL(?:IZABLE)?|SESSION(?:_USER)?|SET(?:USER)?|SHARE|SHOW|SHUTDOWN|SIMPLE|SMALLINT|SNAPSHOT|SOME|SONAME|SQL|START(?:ING)?|STATISTICS|STATUS|STRIPED|SYSTEM_USER|TABLES?|TABLESPACE|TEMP(?:ORARY|TABLE)?|TERMINATED|TEXT(?:SIZE)?|THEN|TIME(?:STAMP)?|TINY(?:BLOB|INT|TEXT)|TOP?|TRAN(?:SACTIONS?)?|TRIGGER|TRUNCATE|TSEQUAL|TYPES?|UNBOUNDED|UNCOMMITTED|UNDEFINED|UNION|UNIQUE|UNLOCK|UNPIVOT|UNSIGNED|UPDATE(?:TEXT)?|USAGE|USE|USER|USING|VALUES?|VAR(?:BINARY|CHAR|CHARACTER|YING)|VIEW|WAITFOR|WARNINGS|WHEN|WHERE|WHILE|WITH(?: ROLLUP|IN)?|WORK|WRITE(?:TEXT)?|YEAR)\b/i,boolean:/\b(?:TRUE|FALSE|NULL)\b/i,number:/\b0x[\da-f]+\b|\b\d+\.?\d*|\B\.\d+\b/i,operator:/[-+*\/=%^~]|&&?|\|\|?|!=?|<(?:=>?|<|>)?|>[>=]?|\b(?:AND|BETWEEN|IN|LIKE|NOT|OR|IS|DIV|REGEXP|RLIKE|SOUNDS LIKE|XOR)\b/i,punctuation:/[;[\]()`,.]/},function(e){var t={url:/url\((["']?).*?\1\)/i,string:{pattern:/("|')(?:(?!\1)[^\\\r\n]|\\(?:\r\n|[\s\S]))*\1/,greedy:!0},interpolation:null,func:null,important:/\B!(?:important|optional)\b/i,keyword:{pattern:/(^|\s+)(?:(?:if|else|for|return|unless)(?=\s+|$)|@[\w-]+)/,lookbehind:!0},hexcode:/#[\da-f]{3,6}/i,number:/\b\d+(?:\.\d+)?%?/,boolean:/\b(?:true|false)\b/,operator:[/~|[+!\/%<>?=]=?|[-:]=|\*[*=]?|\.+|&&|\|\||\B-\B|\b(?:and|in|is(?: a| defined| not|nt)?|not|or)\b/],punctuation:/[{}()\[\];:,]/};t.interpolation={pattern:/\{[^\r\n}:]+\}/,alias:"variable",inside:{delimiter:{pattern:/^{|}$/,alias:"punctuation"},rest:t}},t.func={pattern:/[\w-]+\([^)]*\).*/,inside:{function:/^[^(]+/,rest:t}},e.languages.stylus={comment:{pattern:/(^|[^\\])(\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},"atrule-declaration":{pattern:/(^\s*)@.+/m,lookbehind:!0,inside:{atrule:/^@[\w-]+/,rest:t}},"variable-declaration":{pattern:/(^[ \t]*)[\w$-]+\s*.?=[ \t]*(?:(?:\{[^}]*\}|.+)|$)/m,lookbehind:!0,inside:{variable:/^\S+/,rest:t}},statement:{pattern:/(^[ \t]*)(?:if|else|for|return|unless)[ \t]+.+/m,lookbehind:!0,inside:{keyword:/^\S+/,rest:t}},"property-declaration":{pattern:/((?:^|\{)([ \t]*))(?:[\w-]|\{[^}\r\n]+\})+(?:\s*:\s*|[ \t]+)[^{\r\n]*(?:;|[^{\r\n,](?=$)(?!(\r?\n|\r)(?:\{|\2[ \t]+)))/m,lookbehind:!0,inside:{property:{pattern:/^[^\s:]+/,inside:{interpolation:t.interpolation}},rest:t}},selector:{pattern:/(^[ \t]*)(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\))?|\{[^}\r\n]+\})+)(?:(?:\r?\n|\r)(?:\1(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\))?|\{[^}\r\n]+\})+)))*(?:,$|\{|(?=(?:\r?\n|\r)(?:\{|\1[ \t]+)))/m,lookbehind:!0,inside:{interpolation:t.interpolation,punctuation:/[{},]/}},func:t.func,string:t.string,interpolation:t.interpolation,punctuation:/[{}()\[\];:.]/}}(i);var l=i.util.clone(i.languages.typescript);i.languages.tsx=i.languages.extend("jsx",l),i.languages.wasm={comment:[/\(;[\s\S]*?;\)/,{pattern:/;;.*/,greedy:!0}],string:{pattern:/"(?:\\[\s\S]|[^"\\])*"/,greedy:!0},keyword:[{pattern:/\b(?:align|offset)=/,inside:{operator:/=/}},{pattern:/\b(?:(?:f32|f64|i32|i64)(?:\.(?:abs|add|and|ceil|clz|const|convert_[su]\/i(?:32|64)|copysign|ctz|demote\/f64|div(?:_[su])?|eqz?|extend_[su]\/i32|floor|ge(?:_[su])?|gt(?:_[su])?|le(?:_[su])?|load(?:(?:8|16|32)_[su])?|lt(?:_[su])?|max|min|mul|nearest|neg?|or|popcnt|promote\/f32|reinterpret\/[fi](?:32|64)|rem_[su]|rot[lr]|shl|shr_[su]|store(?:8|16|32)?|sqrt|sub|trunc(?:_[su]\/f(?:32|64))?|wrap\/i64|xor))?|memory\.(?:grow|size))\b/,inside:{punctuation:/\./}},/\b(?:anyfunc|block|br(?:_if|_table)?|call(?:_indirect)?|data|drop|elem|else|end|export|func|get_(?:global|local)|global|if|import|local|loop|memory|module|mut|nop|offset|param|result|return|select|set_(?:global|local)|start|table|tee_local|then|type|unreachable)\b/],variable:/\$[\w!#$%&'*+\-./:<=>?@\\^_`|~]+/i,number:/[+-]?\b(?:\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:[eE][+-]?\d(?:_?\d)*)?|0x[\da-fA-F](?:_?[\da-fA-F])*(?:\.[\da-fA-F](?:_?[\da-fA-D])*)?(?:[pP][+-]?\d(?:_?\d)*)?)\b|\binf\b|\bnan(?::0x[\da-fA-F](?:_?[\da-fA-D])*)?\b/,punctuation:/[()]/},i.languages.yaml={scalar:{pattern:/([\-:]\s*(?:![^\s]+)?[ \t]*[|>])[ \t]*(?:((?:\r?\n|\r)[ \t]+)[^\r\n]+(?:\2[^\r\n]+)*)/,lookbehind:!0,alias:"string"},comment:/#.*/,key:{pattern:/(\s*(?:^|[:\-,[{\r\n?])[ \t]*(?:![^\s]+)?[ \t]*)[^\r\n{[\]},#\s]+?(?=\s*:\s)/,lookbehind:!0,alias:"atrule"},directive:{pattern:/(^[ \t]*)%.+/m,lookbehind:!0,alias:"important"},datetime:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:\d{4}-\d\d?-\d\d?(?:[tT]|[ \t]+)\d\d?:\d{2}:\d{2}(?:\.\d*)?[ \t]*(?:Z|[-+]\d\d?(?::\d{2})?)?|\d{4}-\d{2}-\d{2}|\d\d?:\d{2}(?::\d{2}(?:\.\d*)?)?)(?=[ \t]*(?:$|,|]|}))/m,lookbehind:!0,alias:"number"},boolean:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:true|false)[ \t]*(?=$|,|]|})/im,lookbehind:!0,alias:"important"},null:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:null|~)[ \t]*(?=$|,|]|})/im,lookbehind:!0,alias:"important"},string:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)("|')(?:(?!\2)[^\\\r\n]|\\.)*\2(?=[ \t]*(?:$|,|]|}|\s*#))/m,lookbehind:!0,greedy:!0},number:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)[+-]?(?:0x[\da-f]+|0o[0-7]+|(?:\d+\.?\d*|\.?\d+)(?:e[+-]?\d+)?|\.inf|\.nan)[ \t]*(?=$|,|]|})/im,lookbehind:!0},tag:/![^\s]+/,important:/[&*][\w]+/,punctuation:/---|[:[\]{}\-,|>?]|\.\.\./},i.languages.yml=i.languages.yaml,t.a=i},function(e,t,n){"use strict";var r=Object.getOwnPropertySymbols,o=Object.prototype.hasOwnProperty,a=Object.prototype.propertyIsEnumerable;function i(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(o){return!1}}()?Object.assign:function(e,t){for(var n,l,u=i(e),s=1;s<arguments.length;s++){for(var c in n=Object(arguments[s]))o.call(n,c)&&(u[c]=n[c]);if(r){l=r(n);for(var d=0;d<l.length;d++)a.call(n,l[d])&&(u[l[d]]=n[l[d]])}}return u}},function(e,t,n){"use strict";var r=n(8);t.a=r.b},function(e,t,n){"use strict";e.exports=n(38)},function(e,t,n){"use strict";var r=n(0),o=n.n(r);t.a=o.a.createContext(null)},function(e,t,n){"use strict";!function e(){if("undefined"!=typeof __REACT_DEVTOOLS_GLOBAL_HOOK__&&"function"==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE)try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(t){console.error(t)}}(),e.exports=n(32)},function(e){e.exports=JSON.parse('{"docusaurus-plugin-content-docs":{"default":{"path":"/oauth2-proxy/docs","versions":[{"name":"current","label":"Next","isLast":false,"path":"/oauth2-proxy/docs/next","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/next/behaviour","sidebar":"docs"},{"id":"community/security","path":"/oauth2-proxy/docs/next/community/security","sidebar":"docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/next/configuration/alpha-config","sidebar":"docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/next/configuration/oauth_provider","sidebar":"docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/next/configuration/overview","sidebar":"docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/next/configuration/session_storage","sidebar":"docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/next/configuration/tls","sidebar":"docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/next/features/endpoints","sidebar":"docs"},{"id":"installation","path":"/oauth2-proxy/docs/next/","sidebar":"docs"}]},{"name":"7.0.x","label":"7.0.x","isLast":true,"path":"/oauth2-proxy/docs","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/behaviour","sidebar":"version-7.0.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/community/security","sidebar":"version-7.0.x/docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/configuration/alpha-config","sidebar":"version-7.0.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/configuration/oauth_provider","sidebar":"version-7.0.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/configuration/overview","sidebar":"version-7.0.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/configuration/session_storage","sidebar":"version-7.0.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/configuration/tls","sidebar":"version-7.0.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/features/endpoints","sidebar":"version-7.0.x/docs"},{"id":"features/request_signatures","path":"/oauth2-proxy/docs/features/request_signatures","sidebar":"version-7.0.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/","sidebar":"version-7.0.x/docs"}]},{"name":"6.1.x","label":"6.1.x","isLast":false,"path":"/oauth2-proxy/docs/6.1.x","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/6.1.x/behaviour","sidebar":"version-6.1.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/6.1.x/community/security","sidebar":"version-6.1.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider","sidebar":"version-6.1.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/6.1.x/configuration/overview","sidebar":"version-6.1.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/6.1.x/configuration/session_storage","sidebar":"version-6.1.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/6.1.x/configuration/tls","sidebar":"version-6.1.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/6.1.x/features/endpoints","sidebar":"version-6.1.x/docs"},{"id":"features/request_signatures","path":"/oauth2-proxy/docs/6.1.x/features/request_signatures","sidebar":"version-6.1.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/6.1.x/","sidebar":"version-6.1.x/docs"}]}]}}}')},function(e){e.exports=JSON.parse('{"docusaurusVersion":"2.0.0-alpha.66","siteVersion":"0.0.0","pluginVersions":{"docusaurus-plugin-content-docs":{"type":"package","name":"@docusaurus/plugin-content-docs","version":"2.0.0-alpha.66"},"docusaurus-plugin-content-blog":{"type":"package","name":"@docusaurus/plugin-content-blog","version":"2.0.0-alpha.66"},"docusaurus-plugin-content-pages":{"type":"package","name":"@docusaurus/plugin-content-pages","version":"2.0.0-alpha.66"},"docusaurus-plugin-sitemap":{"type":"package","name":"@docusaurus/plugin-sitemap","version":"2.0.0-alpha.66"},"docusaurus-theme-classic":{"type":"package","name":"@docusaurus/theme-classic","version":"2.0.0-alpha.66"}}}')},function(e,t,n){"use strict";var r=n(23),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},a={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},i={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},l={};function u(e){return r.isMemo(e)?i:l[e.$$typeof]||o}l[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},l[r.Memo]=i;var s=Object.defineProperty,c=Object.getOwnPropertyNames,d=Object.getOwnPropertySymbols,f=Object.getOwnPropertyDescriptor,p=Object.getPrototypeOf,m=Object.prototype;e.exports=function e(t,n,r){if("string"!=typeof n){if(m){var o=p(n);o&&o!==m&&e(t,o,r)}var i=c(n);d&&(i=i.concat(d(n)));for(var l=u(t),h=u(n),g=0;g<i.length;++g){var v=i[g];if(!(a[v]||r&&r[v]||h&&h[v]||l&&l[v])){var y=f(n,v);try{s(t,v,y)}catch(b){}}}}return t}},function(e,t){var n;n=function(){return this}();try{n=n||new Function("return this")()}catch(r){"object"==typeof window&&(n=window)}e.exports=n},function(e,t,n){e.exports=n(45)},function(e,t,n){"use strict";var r=n(21),o="function"==typeof Symbol&&Symbol.for,a=o?Symbol.for("react.element"):60103,i=o?Symbol.for("react.portal"):60106,l=o?Symbol.for("react.fragment"):60107,u=o?Symbol.for("react.strict_mode"):60108,s=o?Symbol.for("react.profiler"):60114,c=o?Symbol.for("react.provider"):60109,d=o?Symbol.for("react.context"):60110,f=o?Symbol.for("react.forward_ref"):60112,p=o?Symbol.for("react.suspense"):60113,m=o?Symbol.for("react.memo"):60115,h=o?Symbol.for("react.lazy"):60116,g="function"==typeof Symbol&&Symbol.iterator;function v(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n]);return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var y={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},b={};function w(e,t,n){this.props=e,this.context=t,this.refs=b,this.updater=n||y}function x(){}function k(e,t,n){this.props=e,this.context=t,this.refs=b,this.updater=n||y}w.prototype.isReactComponent={},w.prototype.setState=function(e,t){if("object"!=typeof e&&"function"!=typeof e&&null!=e)throw Error(v(85));this.updater.enqueueSetState(this,e,t,"setState")},w.prototype.forceUpdate=function(e){this.updater.enqueueForceUpdate(this,e,"forceUpdate")},x.prototype=w.prototype;var E=k.prototype=new x;E.constructor=k,r(E,w.prototype),E.isPureReactComponent=!0;var S={current:null},T=Object.prototype.hasOwnProperty,_={key:!0,ref:!0,__self:!0,__source:!0};function C(e,t,n){var r,o={},i=null,l=null;if(null!=t)for(r in void 0!==t.ref&&(l=t.ref),void 0!==t.key&&(i=""+t.key),t)T.call(t,r)&&!_.hasOwnProperty(r)&&(o[r]=t[r]);var u=arguments.length-2;if(1===u)o.children=n;else if(1<u){for(var s=Array(u),c=0;c<u;c++)s[c]=arguments[c+2];o.children=s}if(e&&e.defaultProps)for(r in u=e.defaultProps)void 0===o[r]&&(o[r]=u[r]);return{$$typeof:a,type:e,key:i,ref:l,props:o,_owner:S.current}}function O(e){return"object"==typeof e&&null!==e&&e.$$typeof===a}var P=/\/+/g,R=[];function A(e,t,n,r){if(R.length){var o=R.pop();return o.result=e,o.keyPrefix=t,o.func=n,o.context=r,o.count=0,o}return{result:e,keyPrefix:t,func:n,context:r,count:0}}function N(e){e.result=null,e.keyPrefix=null,e.func=null,e.context=null,e.count=0,10>R.length&&R.push(e)}function I(e,t,n,r){var o=typeof e;"undefined"!==o&&"boolean"!==o||(e=null);var l=!1;if(null===e)l=!0;else switch(o){case"string":case"number":l=!0;break;case"object":switch(e.$$typeof){case a:case i:l=!0}}if(l)return n(r,e,""===t?"."+D(e,0):t),1;if(l=0,t=""===t?".":t+":",Array.isArray(e))for(var u=0;u<e.length;u++){var s=t+D(o=e[u],u);l+=I(o,s,n,r)}else if(null===e||"object"!=typeof e?s=null:s="function"==typeof(s=g&&e[g]||e["@@iterator"])?s:null,"function"==typeof s)for(e=s.call(e),u=0;!(o=e.next()).done;)l+=I(o=o.value,s=t+D(o,u++),n,r);else if("object"===o)throw n=""+e,Error(v(31,"[object Object]"===n?"object with keys {"+Object.keys(e).join(", ")+"}":n,""));return l}function L(e,t,n){return null==e?0:I(e,"",t,n)}function D(e,t){return"object"==typeof e&&null!==e&&null!=e.key?function(e){var t={"=":"=0",":":"=2"};return"$"+(""+e).replace(/[=:]/g,(function(e){return t[e]}))}(e.key):t.toString(36)}function j(e,t){e.func.call(e.context,t,e.count++)}function F(e,t,n){var r=e.result,o=e.keyPrefix;e=e.func.call(e.context,t,e.count++),Array.isArray(e)?M(e,r,n,(function(e){return e})):null!=e&&(O(e)&&(e=function(e,t){return{$$typeof:a,type:e.type,key:t,ref:e.ref,props:e.props,_owner:e._owner}}(e,o+(!e.key||t&&t.key===e.key?"":(""+e.key).replace(P,"$&/")+"/")+n)),r.push(e))}function M(e,t,n,r,o){var a="";null!=n&&(a=(""+n).replace(P,"$&/")+"/"),L(e,F,t=A(t,a,r,o)),N(t)}var z={current:null};function U(){var e=z.current;if(null===e)throw Error(v(321));return e}var $={ReactCurrentDispatcher:z,ReactCurrentBatchConfig:{suspense:null},ReactCurrentOwner:S,IsSomeRendererActing:{current:!1},assign:r};t.Children={map:function(e,t,n){if(null==e)return e;var r=[];return M(e,r,null,t,n),r},forEach:function(e,t,n){if(null==e)return e;L(e,j,t=A(null,null,t,n)),N(t)},count:function(e){return L(e,(function(){return null}),null)},toArray:function(e){var t=[];return M(e,t,null,(function(e){return e})),t},only:function(e){if(!O(e))throw Error(v(143));return e}},t.Component=w,t.Fragment=l,t.Profiler=s,t.PureComponent=k,t.StrictMode=u,t.Suspense=p,t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=$,t.cloneElement=function(e,t,n){if(null==e)throw Error(v(267,e));var o=r({},e.props),i=e.key,l=e.ref,u=e._owner;if(null!=t){if(void 0!==t.ref&&(l=t.ref,u=S.current),void 0!==t.key&&(i=""+t.key),e.type&&e.type.defaultProps)var s=e.type.defaultProps;for(c in t)T.call(t,c)&&!_.hasOwnProperty(c)&&(o[c]=void 0===t[c]&&void 0!==s?s[c]:t[c])}var c=arguments.length-2;if(1===c)o.children=n;else if(1<c){s=Array(c);for(var d=0;d<c;d++)s[d]=arguments[d+2];o.children=s}return{$$typeof:a,type:e.type,key:i,ref:l,props:o,_owner:u}},t.createContext=function(e,t){return void 0===t&&(t=null),(e={$$typeof:d,_calculateChangedBits:t,_currentValue:e,_currentValue2:e,_threadCount:0,Provider:null,Consumer:null}).Provider={$$typeof:c,_context:e},e.Consumer=e},t.createElement=C,t.createFactory=function(e){var t=C.bind(null,e);return t.type=e,t},t.createRef=function(){return{current:null}},t.forwardRef=function(e){return{$$typeof:f,render:e}},t.isValidElement=O,t.lazy=function(e){return{$$typeof:h,_ctor:e,_status:-1,_result:null}},t.memo=function(e,t){return{$$typeof:m,type:e,compare:void 0===t?null:t}},t.useCallback=function(e,t){return U().useCallback(e,t)},t.useContext=function(e,t){return U().useContext(e,t)},t.useDebugValue=function(){},t.useEffect=function(e,t){return U().useEffect(e,t)},t.useImperativeHandle=function(e,t,n){return U().useImperativeHandle(e,t,n)},t.useLayoutEffect=function(e,t){return U().useLayoutEffect(e,t)},t.useMemo=function(e,t){return U().useMemo(e,t)},t.useReducer=function(e,t,n){return U().useReducer(e,t,n)},t.useRef=function(e){return U().useRef(e)},t.useState=function(e){return U().useState(e)},t.version="16.14.0"},function(e,t,n){"use strict";var r=n(0),o=n(21),a=n(33);function i(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n]);return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}if(!r)throw Error(i(227));function l(e,t,n,r,o,a,i,l,u){var s=Array.prototype.slice.call(arguments,3);try{t.apply(n,s)}catch(c){this.onError(c)}}var u=!1,s=null,c=!1,d=null,f={onError:function(e){u=!0,s=e}};function p(e,t,n,r,o,a,i,c,d){u=!1,s=null,l.apply(f,arguments)}var m=null,h=null,g=null;function v(e,t,n){var r=e.type||"unknown-event";e.currentTarget=g(n),function(e,t,n,r,o,a,l,f,m){if(p.apply(this,arguments),u){if(!u)throw Error(i(198));var h=s;u=!1,s=null,c||(c=!0,d=h)}}(r,t,void 0,e),e.currentTarget=null}var y=null,b={};function w(){if(y)for(var e in b){var t=b[e],n=y.indexOf(e);if(!(-1<n))throw Error(i(96,e));if(!k[n]){if(!t.extractEvents)throw Error(i(97,e));for(var r in k[n]=t,n=t.eventTypes){var o=void 0,a=n[r],l=t,u=r;if(E.hasOwnProperty(u))throw Error(i(99,u));E[u]=a;var s=a.phasedRegistrationNames;if(s){for(o in s)s.hasOwnProperty(o)&&x(s[o],l,u);o=!0}else a.registrationName?(x(a.registrationName,l,u),o=!0):o=!1;if(!o)throw Error(i(98,r,e))}}}}function x(e,t,n){if(S[e])throw Error(i(100,e));S[e]=t,T[e]=t.eventTypes[n].dependencies}var k=[],E={},S={},T={};function _(e){var t,n=!1;for(t in e)if(e.hasOwnProperty(t)){var r=e[t];if(!b.hasOwnProperty(t)||b[t]!==r){if(b[t])throw Error(i(102,t));b[t]=r,n=!0}}n&&w()}var C=!("undefined"==typeof window||void 0===window.document||void 0===window.document.createElement),O=null,P=null,R=null;function A(e){if(e=h(e)){if("function"!=typeof O)throw Error(i(280));var t=e.stateNode;t&&(t=m(t),O(e.stateNode,e.type,t))}}function N(e){P?R?R.push(e):R=[e]:P=e}function I(){if(P){var e=P,t=R;if(R=P=null,A(e),t)for(e=0;e<t.length;e++)A(t[e])}}function L(e,t){return e(t)}function D(e,t,n,r,o){return e(t,n,r,o)}function j(){}var F=L,M=!1,z=!1;function U(){null===P&&null===R||(j(),I())}function $(e,t,n){if(z)return e(t,n);z=!0;try{return F(e,t,n)}finally{z=!1,U()}}var B=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\-.0-9\u00B7\u0300-\u036F\u203F-\u2040]*$/,q=Object.prototype.hasOwnProperty,G={},H={};function V(e,t,n,r,o,a){this.acceptsBooleans=2===t||3===t||4===t,this.attributeName=r,this.attributeNamespace=o,this.mustUseProperty=n,this.propertyName=e,this.type=t,this.sanitizeURL=a}var W={};"children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style".split(" ").forEach((function(e){W[e]=new V(e,0,!1,e,null,!1)})),[["acceptCharset","accept-charset"],["className","class"],["htmlFor","for"],["httpEquiv","http-equiv"]].forEach((function(e){var t=e[0];W[t]=new V(t,1,!1,e[1],null,!1)})),["contentEditable","draggable","spellCheck","value"].forEach((function(e){W[e]=new V(e,2,!1,e.toLowerCase(),null,!1)})),["autoReverse","externalResourcesRequired","focusable","preserveAlpha"].forEach((function(e){W[e]=new V(e,2,!1,e,null,!1)})),"allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope".split(" ").forEach((function(e){W[e]=new V(e,3,!1,e.toLowerCase(),null,!1)})),["checked","multiple","muted","selected"].forEach((function(e){W[e]=new V(e,3,!0,e,null,!1)})),["capture","download"].forEach((function(e){W[e]=new V(e,4,!1,e,null,!1)})),["cols","rows","size","span"].forEach((function(e){W[e]=new V(e,6,!1,e,null,!1)})),["rowSpan","start"].forEach((function(e){W[e]=new V(e,5,!1,e.toLowerCase(),null,!1)}));var Q=/[\-:]([a-z])/g;function K(e){return e[1].toUpperCase()}"accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-name glyph-orientation-horizontal glyph-orientation-vertical horiz-adv-x horiz-origin-x image-rendering letter-spacing lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematical vector-effect vert-adv-y vert-origin-x vert-origin-y word-spacing writing-mode xmlns:xlink x-height".split(" ").forEach((function(e){var t=e.replace(Q,K);W[t]=new V(t,1,!1,e,null,!1)})),"xlink:actuate xlink:arcrole xlink:role xlink:show xlink:title xlink:type".split(" ").forEach((function(e){var t=e.replace(Q,K);W[t]=new V(t,1,!1,e,"http://www.w3.org/1999/xlink",!1)})),["xml:base","xml:lang","xml:space"].forEach((function(e){var t=e.replace(Q,K);W[t]=new V(t,1,!1,e,"http://www.w3.org/XML/1998/namespace",!1)})),["tabIndex","crossOrigin"].forEach((function(e){W[e]=new V(e,1,!1,e.toLowerCase(),null,!1)})),W.xlinkHref=new V("xlinkHref",1,!1,"xlink:href","http://www.w3.org/1999/xlink",!0),["src","href","action","formAction"].forEach((function(e){W[e]=new V(e,1,!1,e.toLowerCase(),null,!0)}));var X=r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;function Y(e,t,n,r){var o=W.hasOwnProperty(t)?W[t]:null;(null!==o?0===o.type:!r&&(2<t.length&&("o"===t[0]||"O"===t[0])&&("n"===t[1]||"N"===t[1])))||(function(e,t,n,r){if(null==t||function(e,t,n,r){if(null!==n&&0===n.type)return!1;switch(typeof t){case"function":case"symbol":return!0;case"boolean":return!r&&(null!==n?!n.acceptsBooleans:"data-"!==(e=e.toLowerCase().slice(0,5))&&"aria-"!==e);default:return!1}}(e,t,n,r))return!0;if(r)return!1;if(null!==n)switch(n.type){case 3:return!t;case 4:return!1===t;case 5:return isNaN(t);case 6:return isNaN(t)||1>t}return!1}(t,n,o,r)&&(n=null),r||null===o?function(e){return!!q.call(H,e)||!q.call(G,e)&&(B.test(e)?H[e]=!0:(G[e]=!0,!1))}(t)&&(null===n?e.removeAttribute(t):e.setAttribute(t,""+n)):o.mustUseProperty?e[o.propertyName]=null===n?3!==o.type&&"":n:(t=o.attributeName,r=o.attributeNamespace,null===n?e.removeAttribute(t):(n=3===(o=o.type)||4===o&&!0===n?"":""+n,r?e.setAttributeNS(r,t,n):e.setAttribute(t,n))))}X.hasOwnProperty("ReactCurrentDispatcher")||(X.ReactCurrentDispatcher={current:null}),X.hasOwnProperty("ReactCurrentBatchConfig")||(X.ReactCurrentBatchConfig={suspense:null});var Z=/^(.*)[\\\/]/,J="function"==typeof Symbol&&Symbol.for,ee=J?Symbol.for("react.element"):60103,te=J?Symbol.for("react.portal"):60106,ne=J?Symbol.for("react.fragment"):60107,re=J?Symbol.for("react.strict_mode"):60108,oe=J?Symbol.for("react.profiler"):60114,ae=J?Symbol.for("react.provider"):60109,ie=J?Symbol.for("react.context"):60110,le=J?Symbol.for("react.concurrent_mode"):60111,ue=J?Symbol.for("react.forward_ref"):60112,se=J?Symbol.for("react.suspense"):60113,ce=J?Symbol.for("react.suspense_list"):60120,de=J?Symbol.for("react.memo"):60115,fe=J?Symbol.for("react.lazy"):60116,pe=J?Symbol.for("react.block"):60121,me="function"==typeof Symbol&&Symbol.iterator;function he(e){return null===e||"object"!=typeof e?null:"function"==typeof(e=me&&e[me]||e["@@iterator"])?e:null}function ge(e){if(null==e)return null;if("function"==typeof e)return e.displayName||e.name||null;if("string"==typeof e)return e;switch(e){case ne:return"Fragment";case te:return"Portal";case oe:return"Profiler";case re:return"StrictMode";case se:return"Suspense";case ce:return"SuspenseList"}if("object"==typeof e)switch(e.$$typeof){case ie:return"Context.Consumer";case ae:return"Context.Provider";case ue:var t=e.render;return t=t.displayName||t.name||"",e.displayName||(""!==t?"ForwardRef("+t+")":"ForwardRef");case de:return ge(e.type);case pe:return ge(e.render);case fe:if(e=1===e._status?e._result:null)return ge(e)}return null}function ve(e){var t="";do{e:switch(e.tag){case 3:case 4:case 6:case 7:case 10:case 9:var n="";break e;default:var r=e._debugOwner,o=e._debugSource,a=ge(e.type);n=null,r&&(n=ge(r.type)),r=a,a="",o?a=" (at "+o.fileName.replace(Z,"")+":"+o.lineNumber+")":n&&(a=" (created by "+n+")"),n="\n    in "+(r||"Unknown")+a}t+=n,e=e.return}while(e);return t}function ye(e){switch(typeof e){case"boolean":case"number":case"object":case"string":case"undefined":return e;default:return""}}function be(e){var t=e.type;return(e=e.nodeName)&&"input"===e.toLowerCase()&&("checkbox"===t||"radio"===t)}function we(e){e._valueTracker||(e._valueTracker=function(e){var t=be(e)?"checked":"value",n=Object.getOwnPropertyDescriptor(e.constructor.prototype,t),r=""+e[t];if(!e.hasOwnProperty(t)&&void 0!==n&&"function"==typeof n.get&&"function"==typeof n.set){var o=n.get,a=n.set;return Object.defineProperty(e,t,{configurable:!0,get:function(){return o.call(this)},set:function(e){r=""+e,a.call(this,e)}}),Object.defineProperty(e,t,{enumerable:n.enumerable}),{getValue:function(){return r},setValue:function(e){r=""+e},stopTracking:function(){e._valueTracker=null,delete e[t]}}}}(e))}function xe(e){if(!e)return!1;var t=e._valueTracker;if(!t)return!0;var n=t.getValue(),r="";return e&&(r=be(e)?e.checked?"true":"false":e.value),(e=r)!==n&&(t.setValue(e),!0)}function ke(e,t){var n=t.checked;return o({},t,{defaultChecked:void 0,defaultValue:void 0,value:void 0,checked:null!=n?n:e._wrapperState.initialChecked})}function Ee(e,t){var n=null==t.defaultValue?"":t.defaultValue,r=null!=t.checked?t.checked:t.defaultChecked;n=ye(null!=t.value?t.value:n),e._wrapperState={initialChecked:r,initialValue:n,controlled:"checkbox"===t.type||"radio"===t.type?null!=t.checked:null!=t.value}}function Se(e,t){null!=(t=t.checked)&&Y(e,"checked",t,!1)}function Te(e,t){Se(e,t);var n=ye(t.value),r=t.type;if(null!=n)"number"===r?(0===n&&""===e.value||e.value!=n)&&(e.value=""+n):e.value!==""+n&&(e.value=""+n);else if("submit"===r||"reset"===r)return void e.removeAttribute("value");t.hasOwnProperty("value")?Ce(e,t.type,n):t.hasOwnProperty("defaultValue")&&Ce(e,t.type,ye(t.defaultValue)),null==t.checked&&null!=t.defaultChecked&&(e.defaultChecked=!!t.defaultChecked)}function _e(e,t,n){if(t.hasOwnProperty("value")||t.hasOwnProperty("defaultValue")){var r=t.type;if(!("submit"!==r&&"reset"!==r||void 0!==t.value&&null!==t.value))return;t=""+e._wrapperState.initialValue,n||t===e.value||(e.value=t),e.defaultValue=t}""!==(n=e.name)&&(e.name=""),e.defaultChecked=!!e._wrapperState.initialChecked,""!==n&&(e.name=n)}function Ce(e,t,n){"number"===t&&e.ownerDocument.activeElement===e||(null==n?e.defaultValue=""+e._wrapperState.initialValue:e.defaultValue!==""+n&&(e.defaultValue=""+n))}function Oe(e,t){return e=o({children:void 0},t),(t=function(e){var t="";return r.Children.forEach(e,(function(e){null!=e&&(t+=e)})),t}(t.children))&&(e.children=t),e}function Pe(e,t,n,r){if(e=e.options,t){t={};for(var o=0;o<n.length;o++)t["$"+n[o]]=!0;for(n=0;n<e.length;n++)o=t.hasOwnProperty("$"+e[n].value),e[n].selected!==o&&(e[n].selected=o),o&&r&&(e[n].defaultSelected=!0)}else{for(n=""+ye(n),t=null,o=0;o<e.length;o++){if(e[o].value===n)return e[o].selected=!0,void(r&&(e[o].defaultSelected=!0));null!==t||e[o].disabled||(t=e[o])}null!==t&&(t.selected=!0)}}function Re(e,t){if(null!=t.dangerouslySetInnerHTML)throw Error(i(91));return o({},t,{value:void 0,defaultValue:void 0,children:""+e._wrapperState.initialValue})}function Ae(e,t){var n=t.value;if(null==n){if(n=t.children,t=t.defaultValue,null!=n){if(null!=t)throw Error(i(92));if(Array.isArray(n)){if(!(1>=n.length))throw Error(i(93));n=n[0]}t=n}null==t&&(t=""),n=t}e._wrapperState={initialValue:ye(n)}}function Ne(e,t){var n=ye(t.value),r=ye(t.defaultValue);null!=n&&((n=""+n)!==e.value&&(e.value=n),null==t.defaultValue&&e.defaultValue!==n&&(e.defaultValue=n)),null!=r&&(e.defaultValue=""+r)}function Ie(e){var t=e.textContent;t===e._wrapperState.initialValue&&""!==t&&null!==t&&(e.value=t)}var Le="http://www.w3.org/1999/xhtml",De="http://www.w3.org/2000/svg";function je(e){switch(e){case"svg":return"http://www.w3.org/2000/svg";case"math":return"http://www.w3.org/1998/Math/MathML";default:return"http://www.w3.org/1999/xhtml"}}function Fe(e,t){return null==e||"http://www.w3.org/1999/xhtml"===e?je(t):"http://www.w3.org/2000/svg"===e&&"foreignObject"===t?"http://www.w3.org/1999/xhtml":e}var Me,ze,Ue=(ze=function(e,t){if(e.namespaceURI!==De||"innerHTML"in e)e.innerHTML=t;else{for((Me=Me||document.createElement("div")).innerHTML="<svg>"+t.valueOf().toString()+"</svg>",t=Me.firstChild;e.firstChild;)e.removeChild(e.firstChild);for(;t.firstChild;)e.appendChild(t.firstChild)}},"undefined"!=typeof MSApp&&MSApp.execUnsafeLocalFunction?function(e,t,n,r){MSApp.execUnsafeLocalFunction((function(){return ze(e,t)}))}:ze);function $e(e,t){if(t){var n=e.firstChild;if(n&&n===e.lastChild&&3===n.nodeType)return void(n.nodeValue=t)}e.textContent=t}function Be(e,t){var n={};return n[e.toLowerCase()]=t.toLowerCase(),n["Webkit"+e]="webkit"+t,n["Moz"+e]="moz"+t,n}var qe={animationend:Be("Animation","AnimationEnd"),animationiteration:Be("Animation","AnimationIteration"),animationstart:Be("Animation","AnimationStart"),transitionend:Be("Transition","TransitionEnd")},Ge={},He={};function Ve(e){if(Ge[e])return Ge[e];if(!qe[e])return e;var t,n=qe[e];for(t in n)if(n.hasOwnProperty(t)&&t in He)return Ge[e]=n[t];return e}C&&(He=document.createElement("div").style,"AnimationEvent"in window||(delete qe.animationend.animation,delete qe.animationiteration.animation,delete qe.animationstart.animation),"TransitionEvent"in window||delete qe.transitionend.transition);var We=Ve("animationend"),Qe=Ve("animationiteration"),Ke=Ve("animationstart"),Xe=Ve("transitionend"),Ye="abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange seeked seeking stalled suspend timeupdate volumechange waiting".split(" "),Ze=new("function"==typeof WeakMap?WeakMap:Map);function Je(e){var t=Ze.get(e);return void 0===t&&(t=new Map,Ze.set(e,t)),t}function et(e){var t=e,n=e;if(e.alternate)for(;t.return;)t=t.return;else{e=t;do{0!=(1026&(t=e).effectTag)&&(n=t.return),e=t.return}while(e)}return 3===t.tag?n:null}function tt(e){if(13===e.tag){var t=e.memoizedState;if(null===t&&(null!==(e=e.alternate)&&(t=e.memoizedState)),null!==t)return t.dehydrated}return null}function nt(e){if(et(e)!==e)throw Error(i(188))}function rt(e){if(!(e=function(e){var t=e.alternate;if(!t){if(null===(t=et(e)))throw Error(i(188));return t!==e?null:e}for(var n=e,r=t;;){var o=n.return;if(null===o)break;var a=o.alternate;if(null===a){if(null!==(r=o.return)){n=r;continue}break}if(o.child===a.child){for(a=o.child;a;){if(a===n)return nt(o),e;if(a===r)return nt(o),t;a=a.sibling}throw Error(i(188))}if(n.return!==r.return)n=o,r=a;else{for(var l=!1,u=o.child;u;){if(u===n){l=!0,n=o,r=a;break}if(u===r){l=!0,r=o,n=a;break}u=u.sibling}if(!l){for(u=a.child;u;){if(u===n){l=!0,n=a,r=o;break}if(u===r){l=!0,r=a,n=o;break}u=u.sibling}if(!l)throw Error(i(189))}}if(n.alternate!==r)throw Error(i(190))}if(3!==n.tag)throw Error(i(188));return n.stateNode.current===n?e:t}(e)))return null;for(var t=e;;){if(5===t.tag||6===t.tag)return t;if(t.child)t.child.return=t,t=t.child;else{if(t===e)break;for(;!t.sibling;){if(!t.return||t.return===e)return null;t=t.return}t.sibling.return=t.return,t=t.sibling}}return null}function ot(e,t){if(null==t)throw Error(i(30));return null==e?t:Array.isArray(e)?Array.isArray(t)?(e.push.apply(e,t),e):(e.push(t),e):Array.isArray(t)?[e].concat(t):[e,t]}function at(e,t,n){Array.isArray(e)?e.forEach(t,n):e&&t.call(n,e)}var it=null;function lt(e){if(e){var t=e._dispatchListeners,n=e._dispatchInstances;if(Array.isArray(t))for(var r=0;r<t.length&&!e.isPropagationStopped();r++)v(e,t[r],n[r]);else t&&v(e,t,n);e._dispatchListeners=null,e._dispatchInstances=null,e.isPersistent()||e.constructor.release(e)}}function ut(e){if(null!==e&&(it=ot(it,e)),e=it,it=null,e){if(at(e,lt),it)throw Error(i(95));if(c)throw e=d,c=!1,d=null,e}}function st(e){return(e=e.target||e.srcElement||window).correspondingUseElement&&(e=e.correspondingUseElement),3===e.nodeType?e.parentNode:e}function ct(e){if(!C)return!1;var t=(e="on"+e)in document;return t||((t=document.createElement("div")).setAttribute(e,"return;"),t="function"==typeof t[e]),t}var dt=[];function ft(e){e.topLevelType=null,e.nativeEvent=null,e.targetInst=null,e.ancestors.length=0,10>dt.length&&dt.push(e)}function pt(e,t,n,r){if(dt.length){var o=dt.pop();return o.topLevelType=e,o.eventSystemFlags=r,o.nativeEvent=t,o.targetInst=n,o}return{topLevelType:e,eventSystemFlags:r,nativeEvent:t,targetInst:n,ancestors:[]}}function mt(e){var t=e.targetInst,n=t;do{if(!n){e.ancestors.push(n);break}var r=n;if(3===r.tag)r=r.stateNode.containerInfo;else{for(;r.return;)r=r.return;r=3!==r.tag?null:r.stateNode.containerInfo}if(!r)break;5!==(t=n.tag)&&6!==t||e.ancestors.push(n),n=An(r)}while(n);for(n=0;n<e.ancestors.length;n++){t=e.ancestors[n];var o=st(e.nativeEvent);r=e.topLevelType;var a=e.nativeEvent,i=e.eventSystemFlags;0===n&&(i|=64);for(var l=null,u=0;u<k.length;u++){var s=k[u];s&&(s=s.extractEvents(r,t,a,o,i))&&(l=ot(l,s))}ut(l)}}function ht(e,t,n){if(!n.has(e)){switch(e){case"scroll":Kt(t,"scroll",!0);break;case"focus":case"blur":Kt(t,"focus",!0),Kt(t,"blur",!0),n.set("blur",null),n.set("focus",null);break;case"cancel":case"close":ct(e)&&Kt(t,e,!0);break;case"invalid":case"submit":case"reset":break;default:-1===Ye.indexOf(e)&&Qt(e,t)}n.set(e,null)}}var gt,vt,yt,bt=!1,wt=[],xt=null,kt=null,Et=null,St=new Map,Tt=new Map,_t=[],Ct="mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput close cancel copy cut paste click change contextmenu reset submit".split(" "),Ot="focus blur dragenter dragleave mouseover mouseout pointerover pointerout gotpointercapture lostpointercapture".split(" ");function Pt(e,t,n,r,o){return{blockedOn:e,topLevelType:t,eventSystemFlags:32|n,nativeEvent:o,container:r}}function Rt(e,t){switch(e){case"focus":case"blur":xt=null;break;case"dragenter":case"dragleave":kt=null;break;case"mouseover":case"mouseout":Et=null;break;case"pointerover":case"pointerout":St.delete(t.pointerId);break;case"gotpointercapture":case"lostpointercapture":Tt.delete(t.pointerId)}}function At(e,t,n,r,o,a){return null===e||e.nativeEvent!==a?(e=Pt(t,n,r,o,a),null!==t&&(null!==(t=Nn(t))&&vt(t)),e):(e.eventSystemFlags|=r,e)}function Nt(e){var t=An(e.target);if(null!==t){var n=et(t);if(null!==n)if(13===(t=n.tag)){if(null!==(t=tt(n)))return e.blockedOn=t,void a.unstable_runWithPriority(e.priority,(function(){yt(n)}))}else if(3===t&&n.stateNode.hydrate)return void(e.blockedOn=3===n.tag?n.stateNode.containerInfo:null)}e.blockedOn=null}function It(e){if(null!==e.blockedOn)return!1;var t=Jt(e.topLevelType,e.eventSystemFlags,e.container,e.nativeEvent);if(null!==t){var n=Nn(t);return null!==n&&vt(n),e.blockedOn=t,!1}return!0}function Lt(e,t,n){It(e)&&n.delete(t)}function Dt(){for(bt=!1;0<wt.length;){var e=wt[0];if(null!==e.blockedOn){null!==(e=Nn(e.blockedOn))&&gt(e);break}var t=Jt(e.topLevelType,e.eventSystemFlags,e.container,e.nativeEvent);null!==t?e.blockedOn=t:wt.shift()}null!==xt&&It(xt)&&(xt=null),null!==kt&&It(kt)&&(kt=null),null!==Et&&It(Et)&&(Et=null),St.forEach(Lt),Tt.forEach(Lt)}function jt(e,t){e.blockedOn===t&&(e.blockedOn=null,bt||(bt=!0,a.unstable_scheduleCallback(a.unstable_NormalPriority,Dt)))}function Ft(e){function t(t){return jt(t,e)}if(0<wt.length){jt(wt[0],e);for(var n=1;n<wt.length;n++){var r=wt[n];r.blockedOn===e&&(r.blockedOn=null)}}for(null!==xt&&jt(xt,e),null!==kt&&jt(kt,e),null!==Et&&jt(Et,e),St.forEach(t),Tt.forEach(t),n=0;n<_t.length;n++)(r=_t[n]).blockedOn===e&&(r.blockedOn=null);for(;0<_t.length&&null===(n=_t[0]).blockedOn;)Nt(n),null===n.blockedOn&&_t.shift()}var Mt={},zt=new Map,Ut=new Map,$t=["abort","abort",We,"animationEnd",Qe,"animationIteration",Ke,"animationStart","canplay","canPlay","canplaythrough","canPlayThrough","durationchange","durationChange","emptied","emptied","encrypted","encrypted","ended","ended","error","error","gotpointercapture","gotPointerCapture","load","load","loadeddata","loadedData","loadedmetadata","loadedMetadata","loadstart","loadStart","lostpointercapture","lostPointerCapture","playing","playing","progress","progress","seeking","seeking","stalled","stalled","suspend","suspend","timeupdate","timeUpdate",Xe,"transitionEnd","waiting","waiting"];function Bt(e,t){for(var n=0;n<e.length;n+=2){var r=e[n],o=e[n+1],a="on"+(o[0].toUpperCase()+o.slice(1));a={phasedRegistrationNames:{bubbled:a,captured:a+"Capture"},dependencies:[r],eventPriority:t},Ut.set(r,t),zt.set(r,a),Mt[o]=a}}Bt("blur blur cancel cancel click click close close contextmenu contextMenu copy copy cut cut auxclick auxClick dblclick doubleClick dragend dragEnd dragstart dragStart drop drop focus focus input input invalid invalid keydown keyDown keypress keyPress keyup keyUp mousedown mouseDown mouseup mouseUp paste paste pause pause play play pointercancel pointerCancel pointerdown pointerDown pointerup pointerUp ratechange rateChange reset reset seeked seeked submit submit touchcancel touchCancel touchend touchEnd touchstart touchStart volumechange volumeChange".split(" "),0),Bt("drag drag dragenter dragEnter dragexit dragExit dragleave dragLeave dragover dragOver mousemove mouseMove mouseout mouseOut mouseover mouseOver pointermove pointerMove pointerout pointerOut pointerover pointerOver scroll scroll toggle toggle touchmove touchMove wheel wheel".split(" "),1),Bt($t,2);for(var qt="change selectionchange textInput compositionstart compositionend compositionupdate".split(" "),Gt=0;Gt<qt.length;Gt++)Ut.set(qt[Gt],0);var Ht=a.unstable_UserBlockingPriority,Vt=a.unstable_runWithPriority,Wt=!0;function Qt(e,t){Kt(t,e,!1)}function Kt(e,t,n){var r=Ut.get(t);switch(void 0===r?2:r){case 0:r=Xt.bind(null,t,1,e);break;case 1:r=Yt.bind(null,t,1,e);break;default:r=Zt.bind(null,t,1,e)}n?e.addEventListener(t,r,!0):e.addEventListener(t,r,!1)}function Xt(e,t,n,r){M||j();var o=Zt,a=M;M=!0;try{D(o,e,t,n,r)}finally{(M=a)||U()}}function Yt(e,t,n,r){Vt(Ht,Zt.bind(null,e,t,n,r))}function Zt(e,t,n,r){if(Wt)if(0<wt.length&&-1<Ct.indexOf(e))e=Pt(null,e,t,n,r),wt.push(e);else{var o=Jt(e,t,n,r);if(null===o)Rt(e,r);else if(-1<Ct.indexOf(e))e=Pt(o,e,t,n,r),wt.push(e);else if(!function(e,t,n,r,o){switch(t){case"focus":return xt=At(xt,e,t,n,r,o),!0;case"dragenter":return kt=At(kt,e,t,n,r,o),!0;case"mouseover":return Et=At(Et,e,t,n,r,o),!0;case"pointerover":var a=o.pointerId;return St.set(a,At(St.get(a)||null,e,t,n,r,o)),!0;case"gotpointercapture":return a=o.pointerId,Tt.set(a,At(Tt.get(a)||null,e,t,n,r,o)),!0}return!1}(o,e,t,n,r)){Rt(e,r),e=pt(e,r,null,t);try{$(mt,e)}finally{ft(e)}}}}function Jt(e,t,n,r){if(null!==(n=An(n=st(r)))){var o=et(n);if(null===o)n=null;else{var a=o.tag;if(13===a){if(null!==(n=tt(o)))return n;n=null}else if(3===a){if(o.stateNode.hydrate)return 3===o.tag?o.stateNode.containerInfo:null;n=null}else o!==n&&(n=null)}}e=pt(e,r,n,t);try{$(mt,e)}finally{ft(e)}return null}var en={animationIterationCount:!0,borderImageOutset:!0,borderImageSlice:!0,borderImageWidth:!0,boxFlex:!0,boxFlexGroup:!0,boxOrdinalGroup:!0,columnCount:!0,columns:!0,flex:!0,flexGrow:!0,flexPositive:!0,flexShrink:!0,flexNegative:!0,flexOrder:!0,gridArea:!0,gridRow:!0,gridRowEnd:!0,gridRowSpan:!0,gridRowStart:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnSpan:!0,gridColumnStart:!0,fontWeight:!0,lineClamp:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,tabSize:!0,widows:!0,zIndex:!0,zoom:!0,fillOpacity:!0,floodOpacity:!0,stopOpacity:!0,strokeDasharray:!0,strokeDashoffset:!0,strokeMiterlimit:!0,strokeOpacity:!0,strokeWidth:!0},tn=["Webkit","ms","Moz","O"];function nn(e,t,n){return null==t||"boolean"==typeof t||""===t?"":n||"number"!=typeof t||0===t||en.hasOwnProperty(e)&&en[e]?(""+t).trim():t+"px"}function rn(e,t){for(var n in e=e.style,t)if(t.hasOwnProperty(n)){var r=0===n.indexOf("--"),o=nn(n,t[n],r);"float"===n&&(n="cssFloat"),r?e.setProperty(n,o):e[n]=o}}Object.keys(en).forEach((function(e){tn.forEach((function(t){t=t+e.charAt(0).toUpperCase()+e.substring(1),en[t]=en[e]}))}));var on=o({menuitem:!0},{area:!0,base:!0,br:!0,col:!0,embed:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0});function an(e,t){if(t){if(on[e]&&(null!=t.children||null!=t.dangerouslySetInnerHTML))throw Error(i(137,e,""));if(null!=t.dangerouslySetInnerHTML){if(null!=t.children)throw Error(i(60));if("object"!=typeof t.dangerouslySetInnerHTML||!("__html"in t.dangerouslySetInnerHTML))throw Error(i(61))}if(null!=t.style&&"object"!=typeof t.style)throw Error(i(62,""))}}function ln(e,t){if(-1===e.indexOf("-"))return"string"==typeof t.is;switch(e){case"annotation-xml":case"color-profile":case"font-face":case"font-face-src":case"font-face-uri":case"font-face-format":case"font-face-name":case"missing-glyph":return!1;default:return!0}}var un=Le;function sn(e,t){var n=Je(e=9===e.nodeType||11===e.nodeType?e:e.ownerDocument);t=T[t];for(var r=0;r<t.length;r++)ht(t[r],e,n)}function cn(){}function dn(e){if(void 0===(e=e||("undefined"!=typeof document?document:void 0)))return null;try{return e.activeElement||e.body}catch(t){return e.body}}function fn(e){for(;e&&e.firstChild;)e=e.firstChild;return e}function pn(e,t){var n,r=fn(e);for(e=0;r;){if(3===r.nodeType){if(n=e+r.textContent.length,e<=t&&n>=t)return{node:r,offset:t-e};e=n}e:{for(;r;){if(r.nextSibling){r=r.nextSibling;break e}r=r.parentNode}r=void 0}r=fn(r)}}function mn(e,t){return!(!e||!t)&&(e===t||(!e||3!==e.nodeType)&&(t&&3===t.nodeType?mn(e,t.parentNode):"contains"in e?e.contains(t):!!e.compareDocumentPosition&&!!(16&e.compareDocumentPosition(t))))}function hn(){for(var e=window,t=dn();t instanceof e.HTMLIFrameElement;){try{var n="string"==typeof t.contentWindow.location.href}catch(r){n=!1}if(!n)break;t=dn((e=t.contentWindow).document)}return t}function gn(e){var t=e&&e.nodeName&&e.nodeName.toLowerCase();return t&&("input"===t&&("text"===e.type||"search"===e.type||"tel"===e.type||"url"===e.type||"password"===e.type)||"textarea"===t||"true"===e.contentEditable)}var vn="$?",yn="$!",bn=null,wn=null;function xn(e,t){switch(e){case"button":case"input":case"select":case"textarea":return!!t.autoFocus}return!1}function kn(e,t){return"textarea"===e||"option"===e||"noscript"===e||"string"==typeof t.children||"number"==typeof t.children||"object"==typeof t.dangerouslySetInnerHTML&&null!==t.dangerouslySetInnerHTML&&null!=t.dangerouslySetInnerHTML.__html}var En="function"==typeof setTimeout?setTimeout:void 0,Sn="function"==typeof clearTimeout?clearTimeout:void 0;function Tn(e){for(;null!=e;e=e.nextSibling){var t=e.nodeType;if(1===t||3===t)break}return e}function _n(e){e=e.previousSibling;for(var t=0;e;){if(8===e.nodeType){var n=e.data;if("$"===n||n===yn||n===vn){if(0===t)return e;t--}else"/$"===n&&t++}e=e.previousSibling}return null}var Cn=Math.random().toString(36).slice(2),On="__reactInternalInstance$"+Cn,Pn="__reactEventHandlers$"+Cn,Rn="__reactContainere$"+Cn;function An(e){var t=e[On];if(t)return t;for(var n=e.parentNode;n;){if(t=n[Rn]||n[On]){if(n=t.alternate,null!==t.child||null!==n&&null!==n.child)for(e=_n(e);null!==e;){if(n=e[On])return n;e=_n(e)}return t}n=(e=n).parentNode}return null}function Nn(e){return!(e=e[On]||e[Rn])||5!==e.tag&&6!==e.tag&&13!==e.tag&&3!==e.tag?null:e}function In(e){if(5===e.tag||6===e.tag)return e.stateNode;throw Error(i(33))}function Ln(e){return e[Pn]||null}function Dn(e){do{e=e.return}while(e&&5!==e.tag);return e||null}function jn(e,t){var n=e.stateNode;if(!n)return null;var r=m(n);if(!r)return null;n=r[t];e:switch(t){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":case"onMouseEnter":(r=!r.disabled)||(r=!("button"===(e=e.type)||"input"===e||"select"===e||"textarea"===e)),e=!r;break e;default:e=!1}if(e)return null;if(n&&"function"!=typeof n)throw Error(i(231,t,typeof n));return n}function Fn(e,t,n){(t=jn(e,n.dispatchConfig.phasedRegistrationNames[t]))&&(n._dispatchListeners=ot(n._dispatchListeners,t),n._dispatchInstances=ot(n._dispatchInstances,e))}function Mn(e){if(e&&e.dispatchConfig.phasedRegistrationNames){for(var t=e._targetInst,n=[];t;)n.push(t),t=Dn(t);for(t=n.length;0<t--;)Fn(n[t],"captured",e);for(t=0;t<n.length;t++)Fn(n[t],"bubbled",e)}}function zn(e,t,n){e&&n&&n.dispatchConfig.registrationName&&(t=jn(e,n.dispatchConfig.registrationName))&&(n._dispatchListeners=ot(n._dispatchListeners,t),n._dispatchInstances=ot(n._dispatchInstances,e))}function Un(e){e&&e.dispatchConfig.registrationName&&zn(e._targetInst,null,e)}function $n(e){at(e,Mn)}var Bn=null,qn=null,Gn=null;function Hn(){if(Gn)return Gn;var e,t,n=qn,r=n.length,o="value"in Bn?Bn.value:Bn.textContent,a=o.length;for(e=0;e<r&&n[e]===o[e];e++);var i=r-e;for(t=1;t<=i&&n[r-t]===o[a-t];t++);return Gn=o.slice(e,1<t?1-t:void 0)}function Vn(){return!0}function Wn(){return!1}function Qn(e,t,n,r){for(var o in this.dispatchConfig=e,this._targetInst=t,this.nativeEvent=n,e=this.constructor.Interface)e.hasOwnProperty(o)&&((t=e[o])?this[o]=t(n):"target"===o?this.target=r:this[o]=n[o]);return this.isDefaultPrevented=(null!=n.defaultPrevented?n.defaultPrevented:!1===n.returnValue)?Vn:Wn,this.isPropagationStopped=Wn,this}function Kn(e,t,n,r){if(this.eventPool.length){var o=this.eventPool.pop();return this.call(o,e,t,n,r),o}return new this(e,t,n,r)}function Xn(e){if(!(e instanceof this))throw Error(i(279));e.destructor(),10>this.eventPool.length&&this.eventPool.push(e)}function Yn(e){e.eventPool=[],e.getPooled=Kn,e.release=Xn}o(Qn.prototype,{preventDefault:function(){this.defaultPrevented=!0;var e=this.nativeEvent;e&&(e.preventDefault?e.preventDefault():"unknown"!=typeof e.returnValue&&(e.returnValue=!1),this.isDefaultPrevented=Vn)},stopPropagation:function(){var e=this.nativeEvent;e&&(e.stopPropagation?e.stopPropagation():"unknown"!=typeof e.cancelBubble&&(e.cancelBubble=!0),this.isPropagationStopped=Vn)},persist:function(){this.isPersistent=Vn},isPersistent:Wn,destructor:function(){var e,t=this.constructor.Interface;for(e in t)this[e]=null;this.nativeEvent=this._targetInst=this.dispatchConfig=null,this.isPropagationStopped=this.isDefaultPrevented=Wn,this._dispatchInstances=this._dispatchListeners=null}}),Qn.Interface={type:null,target:null,currentTarget:function(){return null},eventPhase:null,bubbles:null,cancelable:null,timeStamp:function(e){return e.timeStamp||Date.now()},defaultPrevented:null,isTrusted:null},Qn.extend=function(e){function t(){}function n(){return r.apply(this,arguments)}var r=this;t.prototype=r.prototype;var a=new t;return o(a,n.prototype),n.prototype=a,n.prototype.constructor=n,n.Interface=o({},r.Interface,e),n.extend=r.extend,Yn(n),n},Yn(Qn);var Zn=Qn.extend({data:null}),Jn=Qn.extend({data:null}),er=[9,13,27,32],tr=C&&"CompositionEvent"in window,nr=null;C&&"documentMode"in document&&(nr=document.documentMode);var rr=C&&"TextEvent"in window&&!nr,or=C&&(!tr||nr&&8<nr&&11>=nr),ar=String.fromCharCode(32),ir={beforeInput:{phasedRegistrationNames:{bubbled:"onBeforeInput",captured:"onBeforeInputCapture"},dependencies:["compositionend","keypress","textInput","paste"]},compositionEnd:{phasedRegistrationNames:{bubbled:"onCompositionEnd",captured:"onCompositionEndCapture"},dependencies:"blur compositionend keydown keypress keyup mousedown".split(" ")},compositionStart:{phasedRegistrationNames:{bubbled:"onCompositionStart",captured:"onCompositionStartCapture"},dependencies:"blur compositionstart keydown keypress keyup mousedown".split(" ")},compositionUpdate:{phasedRegistrationNames:{bubbled:"onCompositionUpdate",captured:"onCompositionUpdateCapture"},dependencies:"blur compositionupdate keydown keypress keyup mousedown".split(" ")}},lr=!1;function ur(e,t){switch(e){case"keyup":return-1!==er.indexOf(t.keyCode);case"keydown":return 229!==t.keyCode;case"keypress":case"mousedown":case"blur":return!0;default:return!1}}function sr(e){return"object"==typeof(e=e.detail)&&"data"in e?e.data:null}var cr=!1;var dr={eventTypes:ir,extractEvents:function(e,t,n,r){var o;if(tr)e:{switch(e){case"compositionstart":var a=ir.compositionStart;break e;case"compositionend":a=ir.compositionEnd;break e;case"compositionupdate":a=ir.compositionUpdate;break e}a=void 0}else cr?ur(e,n)&&(a=ir.compositionEnd):"keydown"===e&&229===n.keyCode&&(a=ir.compositionStart);return a?(or&&"ko"!==n.locale&&(cr||a!==ir.compositionStart?a===ir.compositionEnd&&cr&&(o=Hn()):(qn="value"in(Bn=r)?Bn.value:Bn.textContent,cr=!0)),a=Zn.getPooled(a,t,n,r),o?a.data=o:null!==(o=sr(n))&&(a.data=o),$n(a),o=a):o=null,(e=rr?function(e,t){switch(e){case"compositionend":return sr(t);case"keypress":return 32!==t.which?null:(lr=!0,ar);case"textInput":return(e=t.data)===ar&&lr?null:e;default:return null}}(e,n):function(e,t){if(cr)return"compositionend"===e||!tr&&ur(e,t)?(e=Hn(),Gn=qn=Bn=null,cr=!1,e):null;switch(e){case"paste":return null;case"keypress":if(!(t.ctrlKey||t.altKey||t.metaKey)||t.ctrlKey&&t.altKey){if(t.char&&1<t.char.length)return t.char;if(t.which)return String.fromCharCode(t.which)}return null;case"compositionend":return or&&"ko"!==t.locale?null:t.data;default:return null}}(e,n))?((t=Jn.getPooled(ir.beforeInput,t,n,r)).data=e,$n(t)):t=null,null===o?t:null===t?o:[o,t]}},fr={color:!0,date:!0,datetime:!0,"datetime-local":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function pr(e){var t=e&&e.nodeName&&e.nodeName.toLowerCase();return"input"===t?!!fr[e.type]:"textarea"===t}var mr={change:{phasedRegistrationNames:{bubbled:"onChange",captured:"onChangeCapture"},dependencies:"blur change click focus input keydown keyup selectionchange".split(" ")}};function hr(e,t,n){return(e=Qn.getPooled(mr.change,e,t,n)).type="change",N(n),$n(e),e}var gr=null,vr=null;function yr(e){ut(e)}function br(e){if(xe(In(e)))return e}function wr(e,t){if("change"===e)return t}var xr=!1;function kr(){gr&&(gr.detachEvent("onpropertychange",Er),vr=gr=null)}function Er(e){if("value"===e.propertyName&&br(vr))if(e=hr(vr,e,st(e)),M)ut(e);else{M=!0;try{L(yr,e)}finally{M=!1,U()}}}function Sr(e,t,n){"focus"===e?(kr(),vr=n,(gr=t).attachEvent("onpropertychange",Er)):"blur"===e&&kr()}function Tr(e){if("selectionchange"===e||"keyup"===e||"keydown"===e)return br(vr)}function _r(e,t){if("click"===e)return br(t)}function Cr(e,t){if("input"===e||"change"===e)return br(t)}C&&(xr=ct("input")&&(!document.documentMode||9<document.documentMode));var Or={eventTypes:mr,_isInputEventSupported:xr,extractEvents:function(e,t,n,r){var o=t?In(t):window,a=o.nodeName&&o.nodeName.toLowerCase();if("select"===a||"input"===a&&"file"===o.type)var i=wr;else if(pr(o))if(xr)i=Cr;else{i=Tr;var l=Sr}else(a=o.nodeName)&&"input"===a.toLowerCase()&&("checkbox"===o.type||"radio"===o.type)&&(i=_r);if(i&&(i=i(e,t)))return hr(i,n,r);l&&l(e,o,t),"blur"===e&&(e=o._wrapperState)&&e.controlled&&"number"===o.type&&Ce(o,"number",o.value)}},Pr=Qn.extend({view:null,detail:null}),Rr={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function Ar(e){var t=this.nativeEvent;return t.getModifierState?t.getModifierState(e):!!(e=Rr[e])&&!!t[e]}function Nr(){return Ar}var Ir=0,Lr=0,Dr=!1,jr=!1,Fr=Pr.extend({screenX:null,screenY:null,clientX:null,clientY:null,pageX:null,pageY:null,ctrlKey:null,shiftKey:null,altKey:null,metaKey:null,getModifierState:Nr,button:null,buttons:null,relatedTarget:function(e){return e.relatedTarget||(e.fromElement===e.srcElement?e.toElement:e.fromElement)},movementX:function(e){if("movementX"in e)return e.movementX;var t=Ir;return Ir=e.screenX,Dr?"mousemove"===e.type?e.screenX-t:0:(Dr=!0,0)},movementY:function(e){if("movementY"in e)return e.movementY;var t=Lr;return Lr=e.screenY,jr?"mousemove"===e.type?e.screenY-t:0:(jr=!0,0)}}),Mr=Fr.extend({pointerId:null,width:null,height:null,pressure:null,tangentialPressure:null,tiltX:null,tiltY:null,twist:null,pointerType:null,isPrimary:null}),zr={mouseEnter:{registrationName:"onMouseEnter",dependencies:["mouseout","mouseover"]},mouseLeave:{registrationName:"onMouseLeave",dependencies:["mouseout","mouseover"]},pointerEnter:{registrationName:"onPointerEnter",dependencies:["pointerout","pointerover"]},pointerLeave:{registrationName:"onPointerLeave",dependencies:["pointerout","pointerover"]}},Ur={eventTypes:zr,extractEvents:function(e,t,n,r,o){var a="mouseover"===e||"pointerover"===e,i="mouseout"===e||"pointerout"===e;if(a&&0==(32&o)&&(n.relatedTarget||n.fromElement)||!i&&!a)return null;(a=r.window===r?r:(a=r.ownerDocument)?a.defaultView||a.parentWindow:window,i)?(i=t,null!==(t=(t=n.relatedTarget||n.toElement)?An(t):null)&&(t!==et(t)||5!==t.tag&&6!==t.tag)&&(t=null)):i=null;if(i===t)return null;if("mouseout"===e||"mouseover"===e)var l=Fr,u=zr.mouseLeave,s=zr.mouseEnter,c="mouse";else"pointerout"!==e&&"pointerover"!==e||(l=Mr,u=zr.pointerLeave,s=zr.pointerEnter,c="pointer");if(e=null==i?a:In(i),a=null==t?a:In(t),(u=l.getPooled(u,i,n,r)).type=c+"leave",u.target=e,u.relatedTarget=a,(n=l.getPooled(s,t,n,r)).type=c+"enter",n.target=a,n.relatedTarget=e,c=t,(r=i)&&c)e:{for(s=c,i=0,e=l=r;e;e=Dn(e))i++;for(e=0,t=s;t;t=Dn(t))e++;for(;0<i-e;)l=Dn(l),i--;for(;0<e-i;)s=Dn(s),e--;for(;i--;){if(l===s||l===s.alternate)break e;l=Dn(l),s=Dn(s)}l=null}else l=null;for(s=l,l=[];r&&r!==s&&(null===(i=r.alternate)||i!==s);)l.push(r),r=Dn(r);for(r=[];c&&c!==s&&(null===(i=c.alternate)||i!==s);)r.push(c),c=Dn(c);for(c=0;c<l.length;c++)zn(l[c],"bubbled",u);for(c=r.length;0<c--;)zn(r[c],"captured",n);return 0==(64&o)?[u]:[u,n]}};var $r="function"==typeof Object.is?Object.is:function(e,t){return e===t&&(0!==e||1/e==1/t)||e!=e&&t!=t},Br=Object.prototype.hasOwnProperty;function qr(e,t){if($r(e,t))return!0;if("object"!=typeof e||null===e||"object"!=typeof t||null===t)return!1;var n=Object.keys(e),r=Object.keys(t);if(n.length!==r.length)return!1;for(r=0;r<n.length;r++)if(!Br.call(t,n[r])||!$r(e[n[r]],t[n[r]]))return!1;return!0}var Gr=C&&"documentMode"in document&&11>=document.documentMode,Hr={select:{phasedRegistrationNames:{bubbled:"onSelect",captured:"onSelectCapture"},dependencies:"blur contextmenu dragend focus keydown keyup mousedown mouseup selectionchange".split(" ")}},Vr=null,Wr=null,Qr=null,Kr=!1;function Xr(e,t){var n=t.window===t?t.document:9===t.nodeType?t:t.ownerDocument;return Kr||null==Vr||Vr!==dn(n)?null:("selectionStart"in(n=Vr)&&gn(n)?n={start:n.selectionStart,end:n.selectionEnd}:n={anchorNode:(n=(n.ownerDocument&&n.ownerDocument.defaultView||window).getSelection()).anchorNode,anchorOffset:n.anchorOffset,focusNode:n.focusNode,focusOffset:n.focusOffset},Qr&&qr(Qr,n)?null:(Qr=n,(e=Qn.getPooled(Hr.select,Wr,e,t)).type="select",e.target=Vr,$n(e),e))}var Yr={eventTypes:Hr,extractEvents:function(e,t,n,r,o,a){if(!(a=!(o=a||(r.window===r?r.document:9===r.nodeType?r:r.ownerDocument)))){e:{o=Je(o),a=T.onSelect;for(var i=0;i<a.length;i++)if(!o.has(a[i])){o=!1;break e}o=!0}a=!o}if(a)return null;switch(o=t?In(t):window,e){case"focus":(pr(o)||"true"===o.contentEditable)&&(Vr=o,Wr=t,Qr=null);break;case"blur":Qr=Wr=Vr=null;break;case"mousedown":Kr=!0;break;case"contextmenu":case"mouseup":case"dragend":return Kr=!1,Xr(n,r);case"selectionchange":if(Gr)break;case"keydown":case"keyup":return Xr(n,r)}return null}},Zr=Qn.extend({animationName:null,elapsedTime:null,pseudoElement:null}),Jr=Qn.extend({clipboardData:function(e){return"clipboardData"in e?e.clipboardData:window.clipboardData}}),eo=Pr.extend({relatedTarget:null});function to(e){var t=e.keyCode;return"charCode"in e?0===(e=e.charCode)&&13===t&&(e=13):e=t,10===e&&(e=13),32<=e||13===e?e:0}var no={Esc:"Escape",Spacebar:" ",Left:"ArrowLeft",Up:"ArrowUp",Right:"ArrowRight",Down:"ArrowDown",Del:"Delete",Win:"OS",Menu:"ContextMenu",Apps:"ContextMenu",Scroll:"ScrollLock",MozPrintableKey:"Unidentified"},ro={8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",45:"Insert",46:"Delete",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",120:"F9",121:"F10",122:"F11",123:"F12",144:"NumLock",145:"ScrollLock",224:"Meta"},oo=Pr.extend({key:function(e){if(e.key){var t=no[e.key]||e.key;if("Unidentified"!==t)return t}return"keypress"===e.type?13===(e=to(e))?"Enter":String.fromCharCode(e):"keydown"===e.type||"keyup"===e.type?ro[e.keyCode]||"Unidentified":""},location:null,ctrlKey:null,shiftKey:null,altKey:null,metaKey:null,repeat:null,locale:null,getModifierState:Nr,charCode:function(e){return"keypress"===e.type?to(e):0},keyCode:function(e){return"keydown"===e.type||"keyup"===e.type?e.keyCode:0},which:function(e){return"keypress"===e.type?to(e):"keydown"===e.type||"keyup"===e.type?e.keyCode:0}}),ao=Fr.extend({dataTransfer:null}),io=Pr.extend({touches:null,targetTouches:null,changedTouches:null,altKey:null,metaKey:null,ctrlKey:null,shiftKey:null,getModifierState:Nr}),lo=Qn.extend({propertyName:null,elapsedTime:null,pseudoElement:null}),uo=Fr.extend({deltaX:function(e){return"deltaX"in e?e.deltaX:"wheelDeltaX"in e?-e.wheelDeltaX:0},deltaY:function(e){return"deltaY"in e?e.deltaY:"wheelDeltaY"in e?-e.wheelDeltaY:"wheelDelta"in e?-e.wheelDelta:0},deltaZ:null,deltaMode:null}),so={eventTypes:Mt,extractEvents:function(e,t,n,r){var o=zt.get(e);if(!o)return null;switch(e){case"keypress":if(0===to(n))return null;case"keydown":case"keyup":e=oo;break;case"blur":case"focus":e=eo;break;case"click":if(2===n.button)return null;case"auxclick":case"dblclick":case"mousedown":case"mousemove":case"mouseup":case"mouseout":case"mouseover":case"contextmenu":e=Fr;break;case"drag":case"dragend":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"dragstart":case"drop":e=ao;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":e=io;break;case We:case Qe:case Ke:e=Zr;break;case Xe:e=lo;break;case"scroll":e=Pr;break;case"wheel":e=uo;break;case"copy":case"cut":case"paste":e=Jr;break;case"gotpointercapture":case"lostpointercapture":case"pointercancel":case"pointerdown":case"pointermove":case"pointerout":case"pointerover":case"pointerup":e=Mr;break;default:e=Qn}return $n(t=e.getPooled(o,t,n,r)),t}};if(y)throw Error(i(101));y=Array.prototype.slice.call("ResponderEventPlugin SimpleEventPlugin EnterLeaveEventPlugin ChangeEventPlugin SelectEventPlugin BeforeInputEventPlugin".split(" ")),w(),m=Ln,h=Nn,g=In,_({SimpleEventPlugin:so,EnterLeaveEventPlugin:Ur,ChangeEventPlugin:Or,SelectEventPlugin:Yr,BeforeInputEventPlugin:dr});var co=[],fo=-1;function po(e){0>fo||(e.current=co[fo],co[fo]=null,fo--)}function mo(e,t){fo++,co[fo]=e.current,e.current=t}var ho={},go={current:ho},vo={current:!1},yo=ho;function bo(e,t){var n=e.type.contextTypes;if(!n)return ho;var r=e.stateNode;if(r&&r.__reactInternalMemoizedUnmaskedChildContext===t)return r.__reactInternalMemoizedMaskedChildContext;var o,a={};for(o in n)a[o]=t[o];return r&&((e=e.stateNode).__reactInternalMemoizedUnmaskedChildContext=t,e.__reactInternalMemoizedMaskedChildContext=a),a}function wo(e){return null!=(e=e.childContextTypes)}function xo(){po(vo),po(go)}function ko(e,t,n){if(go.current!==ho)throw Error(i(168));mo(go,t),mo(vo,n)}function Eo(e,t,n){var r=e.stateNode;if(e=t.childContextTypes,"function"!=typeof r.getChildContext)return n;for(var a in r=r.getChildContext())if(!(a in e))throw Error(i(108,ge(t)||"Unknown",a));return o({},n,{},r)}function So(e){return e=(e=e.stateNode)&&e.__reactInternalMemoizedMergedChildContext||ho,yo=go.current,mo(go,e),mo(vo,vo.current),!0}function To(e,t,n){var r=e.stateNode;if(!r)throw Error(i(169));n?(e=Eo(e,t,yo),r.__reactInternalMemoizedMergedChildContext=e,po(vo),po(go),mo(go,e)):po(vo),mo(vo,n)}var _o=a.unstable_runWithPriority,Co=a.unstable_scheduleCallback,Oo=a.unstable_cancelCallback,Po=a.unstable_requestPaint,Ro=a.unstable_now,Ao=a.unstable_getCurrentPriorityLevel,No=a.unstable_ImmediatePriority,Io=a.unstable_UserBlockingPriority,Lo=a.unstable_NormalPriority,Do=a.unstable_LowPriority,jo=a.unstable_IdlePriority,Fo={},Mo=a.unstable_shouldYield,zo=void 0!==Po?Po:function(){},Uo=null,$o=null,Bo=!1,qo=Ro(),Go=1e4>qo?Ro:function(){return Ro()-qo};function Ho(){switch(Ao()){case No:return 99;case Io:return 98;case Lo:return 97;case Do:return 96;case jo:return 95;default:throw Error(i(332))}}function Vo(e){switch(e){case 99:return No;case 98:return Io;case 97:return Lo;case 96:return Do;case 95:return jo;default:throw Error(i(332))}}function Wo(e,t){return e=Vo(e),_o(e,t)}function Qo(e,t,n){return e=Vo(e),Co(e,t,n)}function Ko(e){return null===Uo?(Uo=[e],$o=Co(No,Yo)):Uo.push(e),Fo}function Xo(){if(null!==$o){var e=$o;$o=null,Oo(e)}Yo()}function Yo(){if(!Bo&&null!==Uo){Bo=!0;var e=0;try{var t=Uo;Wo(99,(function(){for(;e<t.length;e++){var n=t[e];do{n=n(!0)}while(null!==n)}})),Uo=null}catch(n){throw null!==Uo&&(Uo=Uo.slice(e+1)),Co(No,Xo),n}finally{Bo=!1}}}function Zo(e,t,n){return 1073741821-(1+((1073741821-e+t/10)/(n/=10)|0))*n}function Jo(e,t){if(e&&e.defaultProps)for(var n in t=o({},t),e=e.defaultProps)void 0===t[n]&&(t[n]=e[n]);return t}var ea={current:null},ta=null,na=null,ra=null;function oa(){ra=na=ta=null}function aa(e){var t=ea.current;po(ea),e.type._context._currentValue=t}function ia(e,t){for(;null!==e;){var n=e.alternate;if(e.childExpirationTime<t)e.childExpirationTime=t,null!==n&&n.childExpirationTime<t&&(n.childExpirationTime=t);else{if(!(null!==n&&n.childExpirationTime<t))break;n.childExpirationTime=t}e=e.return}}function la(e,t){ta=e,ra=na=null,null!==(e=e.dependencies)&&null!==e.firstContext&&(e.expirationTime>=t&&(Li=!0),e.firstContext=null)}function ua(e,t){if(ra!==e&&!1!==t&&0!==t)if("number"==typeof t&&1073741823!==t||(ra=e,t=1073741823),t={context:e,observedBits:t,next:null},null===na){if(null===ta)throw Error(i(308));na=t,ta.dependencies={expirationTime:0,firstContext:t,responders:null}}else na=na.next=t;return e._currentValue}var sa=!1;function ca(e){e.updateQueue={baseState:e.memoizedState,baseQueue:null,shared:{pending:null},effects:null}}function da(e,t){e=e.updateQueue,t.updateQueue===e&&(t.updateQueue={baseState:e.baseState,baseQueue:e.baseQueue,shared:e.shared,effects:e.effects})}function fa(e,t){return(e={expirationTime:e,suspenseConfig:t,tag:0,payload:null,callback:null,next:null}).next=e}function pa(e,t){if(null!==(e=e.updateQueue)){var n=(e=e.shared).pending;null===n?t.next=t:(t.next=n.next,n.next=t),e.pending=t}}function ma(e,t){var n=e.alternate;null!==n&&da(n,e),null===(n=(e=e.updateQueue).baseQueue)?(e.baseQueue=t.next=t,t.next=t):(t.next=n.next,n.next=t)}function ha(e,t,n,r){var a=e.updateQueue;sa=!1;var i=a.baseQueue,l=a.shared.pending;if(null!==l){if(null!==i){var u=i.next;i.next=l.next,l.next=u}i=l,a.shared.pending=null,null!==(u=e.alternate)&&(null!==(u=u.updateQueue)&&(u.baseQueue=l))}if(null!==i){u=i.next;var s=a.baseState,c=0,d=null,f=null,p=null;if(null!==u)for(var m=u;;){if((l=m.expirationTime)<r){var h={expirationTime:m.expirationTime,suspenseConfig:m.suspenseConfig,tag:m.tag,payload:m.payload,callback:m.callback,next:null};null===p?(f=p=h,d=s):p=p.next=h,l>c&&(c=l)}else{null!==p&&(p=p.next={expirationTime:1073741823,suspenseConfig:m.suspenseConfig,tag:m.tag,payload:m.payload,callback:m.callback,next:null}),pu(l,m.suspenseConfig);e:{var g=e,v=m;switch(l=t,h=n,v.tag){case 1:if("function"==typeof(g=v.payload)){s=g.call(h,s,l);break e}s=g;break e;case 3:g.effectTag=-4097&g.effectTag|64;case 0:if(null==(l="function"==typeof(g=v.payload)?g.call(h,s,l):g))break e;s=o({},s,l);break e;case 2:sa=!0}}null!==m.callback&&(e.effectTag|=32,null===(l=a.effects)?a.effects=[m]:l.push(m))}if(null===(m=m.next)||m===u){if(null===(l=a.shared.pending))break;m=i.next=l.next,l.next=u,a.baseQueue=i=l,a.shared.pending=null}}null===p?d=s:p.next=f,a.baseState=d,a.baseQueue=p,mu(c),e.expirationTime=c,e.memoizedState=s}}function ga(e,t,n){if(e=t.effects,t.effects=null,null!==e)for(t=0;t<e.length;t++){var r=e[t],o=r.callback;if(null!==o){if(r.callback=null,r=o,o=n,"function"!=typeof r)throw Error(i(191,r));r.call(o)}}}var va=X.ReactCurrentBatchConfig,ya=(new r.Component).refs;function ba(e,t,n,r){n=null==(n=n(r,t=e.memoizedState))?t:o({},t,n),e.memoizedState=n,0===e.expirationTime&&(e.updateQueue.baseState=n)}var wa={isMounted:function(e){return!!(e=e._reactInternalFiber)&&et(e)===e},enqueueSetState:function(e,t,n){e=e._reactInternalFiber;var r=eu(),o=va.suspense;(o=fa(r=tu(r,e,o),o)).payload=t,null!=n&&(o.callback=n),pa(e,o),nu(e,r)},enqueueReplaceState:function(e,t,n){e=e._reactInternalFiber;var r=eu(),o=va.suspense;(o=fa(r=tu(r,e,o),o)).tag=1,o.payload=t,null!=n&&(o.callback=n),pa(e,o),nu(e,r)},enqueueForceUpdate:function(e,t){e=e._reactInternalFiber;var n=eu(),r=va.suspense;(r=fa(n=tu(n,e,r),r)).tag=2,null!=t&&(r.callback=t),pa(e,r),nu(e,n)}};function xa(e,t,n,r,o,a,i){return"function"==typeof(e=e.stateNode).shouldComponentUpdate?e.shouldComponentUpdate(r,a,i):!t.prototype||!t.prototype.isPureReactComponent||(!qr(n,r)||!qr(o,a))}function ka(e,t,n){var r=!1,o=ho,a=t.contextType;return"object"==typeof a&&null!==a?a=ua(a):(o=wo(t)?yo:go.current,a=(r=null!=(r=t.contextTypes))?bo(e,o):ho),t=new t(n,a),e.memoizedState=null!==t.state&&void 0!==t.state?t.state:null,t.updater=wa,e.stateNode=t,t._reactInternalFiber=e,r&&((e=e.stateNode).__reactInternalMemoizedUnmaskedChildContext=o,e.__reactInternalMemoizedMaskedChildContext=a),t}function Ea(e,t,n,r){e=t.state,"function"==typeof t.componentWillReceiveProps&&t.componentWillReceiveProps(n,r),"function"==typeof t.UNSAFE_componentWillReceiveProps&&t.UNSAFE_componentWillReceiveProps(n,r),t.state!==e&&wa.enqueueReplaceState(t,t.state,null)}function Sa(e,t,n,r){var o=e.stateNode;o.props=n,o.state=e.memoizedState,o.refs=ya,ca(e);var a=t.contextType;"object"==typeof a&&null!==a?o.context=ua(a):(a=wo(t)?yo:go.current,o.context=bo(e,a)),ha(e,n,o,r),o.state=e.memoizedState,"function"==typeof(a=t.getDerivedStateFromProps)&&(ba(e,t,a,n),o.state=e.memoizedState),"function"==typeof t.getDerivedStateFromProps||"function"==typeof o.getSnapshotBeforeUpdate||"function"!=typeof o.UNSAFE_componentWillMount&&"function"!=typeof o.componentWillMount||(t=o.state,"function"==typeof o.componentWillMount&&o.componentWillMount(),"function"==typeof o.UNSAFE_componentWillMount&&o.UNSAFE_componentWillMount(),t!==o.state&&wa.enqueueReplaceState(o,o.state,null),ha(e,n,o,r),o.state=e.memoizedState),"function"==typeof o.componentDidMount&&(e.effectTag|=4)}var Ta=Array.isArray;function _a(e,t,n){if(null!==(e=n.ref)&&"function"!=typeof e&&"object"!=typeof e){if(n._owner){if(n=n._owner){if(1!==n.tag)throw Error(i(309));var r=n.stateNode}if(!r)throw Error(i(147,e));var o=""+e;return null!==t&&null!==t.ref&&"function"==typeof t.ref&&t.ref._stringRef===o?t.ref:((t=function(e){var t=r.refs;t===ya&&(t=r.refs={}),null===e?delete t[o]:t[o]=e})._stringRef=o,t)}if("string"!=typeof e)throw Error(i(284));if(!n._owner)throw Error(i(290,e))}return e}function Ca(e,t){if("textarea"!==e.type)throw Error(i(31,"[object Object]"===Object.prototype.toString.call(t)?"object with keys {"+Object.keys(t).join(", ")+"}":t,""))}function Oa(e){function t(t,n){if(e){var r=t.lastEffect;null!==r?(r.nextEffect=n,t.lastEffect=n):t.firstEffect=t.lastEffect=n,n.nextEffect=null,n.effectTag=8}}function n(n,r){if(!e)return null;for(;null!==r;)t(n,r),r=r.sibling;return null}function r(e,t){for(e=new Map;null!==t;)null!==t.key?e.set(t.key,t):e.set(t.index,t),t=t.sibling;return e}function o(e,t){return(e=Lu(e,t)).index=0,e.sibling=null,e}function a(t,n,r){return t.index=r,e?null!==(r=t.alternate)?(r=r.index)<n?(t.effectTag=2,n):r:(t.effectTag=2,n):n}function l(t){return e&&null===t.alternate&&(t.effectTag=2),t}function u(e,t,n,r){return null===t||6!==t.tag?((t=Fu(n,e.mode,r)).return=e,t):((t=o(t,n)).return=e,t)}function s(e,t,n,r){return null!==t&&t.elementType===n.type?((r=o(t,n.props)).ref=_a(e,t,n),r.return=e,r):((r=Du(n.type,n.key,n.props,null,e.mode,r)).ref=_a(e,t,n),r.return=e,r)}function c(e,t,n,r){return null===t||4!==t.tag||t.stateNode.containerInfo!==n.containerInfo||t.stateNode.implementation!==n.implementation?((t=Mu(n,e.mode,r)).return=e,t):((t=o(t,n.children||[])).return=e,t)}function d(e,t,n,r,a){return null===t||7!==t.tag?((t=ju(n,e.mode,r,a)).return=e,t):((t=o(t,n)).return=e,t)}function f(e,t,n){if("string"==typeof t||"number"==typeof t)return(t=Fu(""+t,e.mode,n)).return=e,t;if("object"==typeof t&&null!==t){switch(t.$$typeof){case ee:return(n=Du(t.type,t.key,t.props,null,e.mode,n)).ref=_a(e,null,t),n.return=e,n;case te:return(t=Mu(t,e.mode,n)).return=e,t}if(Ta(t)||he(t))return(t=ju(t,e.mode,n,null)).return=e,t;Ca(e,t)}return null}function p(e,t,n,r){var o=null!==t?t.key:null;if("string"==typeof n||"number"==typeof n)return null!==o?null:u(e,t,""+n,r);if("object"==typeof n&&null!==n){switch(n.$$typeof){case ee:return n.key===o?n.type===ne?d(e,t,n.props.children,r,o):s(e,t,n,r):null;case te:return n.key===o?c(e,t,n,r):null}if(Ta(n)||he(n))return null!==o?null:d(e,t,n,r,null);Ca(e,n)}return null}function m(e,t,n,r,o){if("string"==typeof r||"number"==typeof r)return u(t,e=e.get(n)||null,""+r,o);if("object"==typeof r&&null!==r){switch(r.$$typeof){case ee:return e=e.get(null===r.key?n:r.key)||null,r.type===ne?d(t,e,r.props.children,o,r.key):s(t,e,r,o);case te:return c(t,e=e.get(null===r.key?n:r.key)||null,r,o)}if(Ta(r)||he(r))return d(t,e=e.get(n)||null,r,o,null);Ca(t,r)}return null}function h(o,i,l,u){for(var s=null,c=null,d=i,h=i=0,g=null;null!==d&&h<l.length;h++){d.index>h?(g=d,d=null):g=d.sibling;var v=p(o,d,l[h],u);if(null===v){null===d&&(d=g);break}e&&d&&null===v.alternate&&t(o,d),i=a(v,i,h),null===c?s=v:c.sibling=v,c=v,d=g}if(h===l.length)return n(o,d),s;if(null===d){for(;h<l.length;h++)null!==(d=f(o,l[h],u))&&(i=a(d,i,h),null===c?s=d:c.sibling=d,c=d);return s}for(d=r(o,d);h<l.length;h++)null!==(g=m(d,o,h,l[h],u))&&(e&&null!==g.alternate&&d.delete(null===g.key?h:g.key),i=a(g,i,h),null===c?s=g:c.sibling=g,c=g);return e&&d.forEach((function(e){return t(o,e)})),s}function g(o,l,u,s){var c=he(u);if("function"!=typeof c)throw Error(i(150));if(null==(u=c.call(u)))throw Error(i(151));for(var d=c=null,h=l,g=l=0,v=null,y=u.next();null!==h&&!y.done;g++,y=u.next()){h.index>g?(v=h,h=null):v=h.sibling;var b=p(o,h,y.value,s);if(null===b){null===h&&(h=v);break}e&&h&&null===b.alternate&&t(o,h),l=a(b,l,g),null===d?c=b:d.sibling=b,d=b,h=v}if(y.done)return n(o,h),c;if(null===h){for(;!y.done;g++,y=u.next())null!==(y=f(o,y.value,s))&&(l=a(y,l,g),null===d?c=y:d.sibling=y,d=y);return c}for(h=r(o,h);!y.done;g++,y=u.next())null!==(y=m(h,o,g,y.value,s))&&(e&&null!==y.alternate&&h.delete(null===y.key?g:y.key),l=a(y,l,g),null===d?c=y:d.sibling=y,d=y);return e&&h.forEach((function(e){return t(o,e)})),c}return function(e,r,a,u){var s="object"==typeof a&&null!==a&&a.type===ne&&null===a.key;s&&(a=a.props.children);var c="object"==typeof a&&null!==a;if(c)switch(a.$$typeof){case ee:e:{for(c=a.key,s=r;null!==s;){if(s.key===c){switch(s.tag){case 7:if(a.type===ne){n(e,s.sibling),(r=o(s,a.props.children)).return=e,e=r;break e}break;default:if(s.elementType===a.type){n(e,s.sibling),(r=o(s,a.props)).ref=_a(e,s,a),r.return=e,e=r;break e}}n(e,s);break}t(e,s),s=s.sibling}a.type===ne?((r=ju(a.props.children,e.mode,u,a.key)).return=e,e=r):((u=Du(a.type,a.key,a.props,null,e.mode,u)).ref=_a(e,r,a),u.return=e,e=u)}return l(e);case te:e:{for(s=a.key;null!==r;){if(r.key===s){if(4===r.tag&&r.stateNode.containerInfo===a.containerInfo&&r.stateNode.implementation===a.implementation){n(e,r.sibling),(r=o(r,a.children||[])).return=e,e=r;break e}n(e,r);break}t(e,r),r=r.sibling}(r=Mu(a,e.mode,u)).return=e,e=r}return l(e)}if("string"==typeof a||"number"==typeof a)return a=""+a,null!==r&&6===r.tag?(n(e,r.sibling),(r=o(r,a)).return=e,e=r):(n(e,r),(r=Fu(a,e.mode,u)).return=e,e=r),l(e);if(Ta(a))return h(e,r,a,u);if(he(a))return g(e,r,a,u);if(c&&Ca(e,a),void 0===a&&!s)switch(e.tag){case 1:case 0:throw e=e.type,Error(i(152,e.displayName||e.name||"Component"))}return n(e,r)}}var Pa=Oa(!0),Ra=Oa(!1),Aa={},Na={current:Aa},Ia={current:Aa},La={current:Aa};function Da(e){if(e===Aa)throw Error(i(174));return e}function ja(e,t){switch(mo(La,t),mo(Ia,e),mo(Na,Aa),e=t.nodeType){case 9:case 11:t=(t=t.documentElement)?t.namespaceURI:Fe(null,"");break;default:t=Fe(t=(e=8===e?t.parentNode:t).namespaceURI||null,e=e.tagName)}po(Na),mo(Na,t)}function Fa(){po(Na),po(Ia),po(La)}function Ma(e){Da(La.current);var t=Da(Na.current),n=Fe(t,e.type);t!==n&&(mo(Ia,e),mo(Na,n))}function za(e){Ia.current===e&&(po(Na),po(Ia))}var Ua={current:0};function $a(e){for(var t=e;null!==t;){if(13===t.tag){var n=t.memoizedState;if(null!==n&&(null===(n=n.dehydrated)||n.data===vn||n.data===yn))return t}else if(19===t.tag&&void 0!==t.memoizedProps.revealOrder){if(0!=(64&t.effectTag))return t}else if(null!==t.child){t.child.return=t,t=t.child;continue}if(t===e)break;for(;null===t.sibling;){if(null===t.return||t.return===e)return null;t=t.return}t.sibling.return=t.return,t=t.sibling}return null}function Ba(e,t){return{responder:e,props:t}}var qa=X.ReactCurrentDispatcher,Ga=X.ReactCurrentBatchConfig,Ha=0,Va=null,Wa=null,Qa=null,Ka=!1;function Xa(){throw Error(i(321))}function Ya(e,t){if(null===t)return!1;for(var n=0;n<t.length&&n<e.length;n++)if(!$r(e[n],t[n]))return!1;return!0}function Za(e,t,n,r,o,a){if(Ha=a,Va=t,t.memoizedState=null,t.updateQueue=null,t.expirationTime=0,qa.current=null===e||null===e.memoizedState?xi:ki,e=n(r,o),t.expirationTime===Ha){a=0;do{if(t.expirationTime=0,!(25>a))throw Error(i(301));a+=1,Qa=Wa=null,t.updateQueue=null,qa.current=Ei,e=n(r,o)}while(t.expirationTime===Ha)}if(qa.current=wi,t=null!==Wa&&null!==Wa.next,Ha=0,Qa=Wa=Va=null,Ka=!1,t)throw Error(i(300));return e}function Ja(){var e={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};return null===Qa?Va.memoizedState=Qa=e:Qa=Qa.next=e,Qa}function ei(){if(null===Wa){var e=Va.alternate;e=null!==e?e.memoizedState:null}else e=Wa.next;var t=null===Qa?Va.memoizedState:Qa.next;if(null!==t)Qa=t,Wa=e;else{if(null===e)throw Error(i(310));e={memoizedState:(Wa=e).memoizedState,baseState:Wa.baseState,baseQueue:Wa.baseQueue,queue:Wa.queue,next:null},null===Qa?Va.memoizedState=Qa=e:Qa=Qa.next=e}return Qa}function ti(e,t){return"function"==typeof t?t(e):t}function ni(e){var t=ei(),n=t.queue;if(null===n)throw Error(i(311));n.lastRenderedReducer=e;var r=Wa,o=r.baseQueue,a=n.pending;if(null!==a){if(null!==o){var l=o.next;o.next=a.next,a.next=l}r.baseQueue=o=a,n.pending=null}if(null!==o){o=o.next,r=r.baseState;var u=l=a=null,s=o;do{var c=s.expirationTime;if(c<Ha){var d={expirationTime:s.expirationTime,suspenseConfig:s.suspenseConfig,action:s.action,eagerReducer:s.eagerReducer,eagerState:s.eagerState,next:null};null===u?(l=u=d,a=r):u=u.next=d,c>Va.expirationTime&&(Va.expirationTime=c,mu(c))}else null!==u&&(u=u.next={expirationTime:1073741823,suspenseConfig:s.suspenseConfig,action:s.action,eagerReducer:s.eagerReducer,eagerState:s.eagerState,next:null}),pu(c,s.suspenseConfig),r=s.eagerReducer===e?s.eagerState:e(r,s.action);s=s.next}while(null!==s&&s!==o);null===u?a=r:u.next=l,$r(r,t.memoizedState)||(Li=!0),t.memoizedState=r,t.baseState=a,t.baseQueue=u,n.lastRenderedState=r}return[t.memoizedState,n.dispatch]}function ri(e){var t=ei(),n=t.queue;if(null===n)throw Error(i(311));n.lastRenderedReducer=e;var r=n.dispatch,o=n.pending,a=t.memoizedState;if(null!==o){n.pending=null;var l=o=o.next;do{a=e(a,l.action),l=l.next}while(l!==o);$r(a,t.memoizedState)||(Li=!0),t.memoizedState=a,null===t.baseQueue&&(t.baseState=a),n.lastRenderedState=a}return[a,r]}function oi(e){var t=Ja();return"function"==typeof e&&(e=e()),t.memoizedState=t.baseState=e,e=(e=t.queue={pending:null,dispatch:null,lastRenderedReducer:ti,lastRenderedState:e}).dispatch=bi.bind(null,Va,e),[t.memoizedState,e]}function ai(e,t,n,r){return e={tag:e,create:t,destroy:n,deps:r,next:null},null===(t=Va.updateQueue)?(t={lastEffect:null},Va.updateQueue=t,t.lastEffect=e.next=e):null===(n=t.lastEffect)?t.lastEffect=e.next=e:(r=n.next,n.next=e,e.next=r,t.lastEffect=e),e}function ii(){return ei().memoizedState}function li(e,t,n,r){var o=Ja();Va.effectTag|=e,o.memoizedState=ai(1|t,n,void 0,void 0===r?null:r)}function ui(e,t,n,r){var o=ei();r=void 0===r?null:r;var a=void 0;if(null!==Wa){var i=Wa.memoizedState;if(a=i.destroy,null!==r&&Ya(r,i.deps))return void ai(t,n,a,r)}Va.effectTag|=e,o.memoizedState=ai(1|t,n,a,r)}function si(e,t){return li(516,4,e,t)}function ci(e,t){return ui(516,4,e,t)}function di(e,t){return ui(4,2,e,t)}function fi(e,t){return"function"==typeof t?(e=e(),t(e),function(){t(null)}):null!=t?(e=e(),t.current=e,function(){t.current=null}):void 0}function pi(e,t,n){return n=null!=n?n.concat([e]):null,ui(4,2,fi.bind(null,t,e),n)}function mi(){}function hi(e,t){return Ja().memoizedState=[e,void 0===t?null:t],e}function gi(e,t){var n=ei();t=void 0===t?null:t;var r=n.memoizedState;return null!==r&&null!==t&&Ya(t,r[1])?r[0]:(n.memoizedState=[e,t],e)}function vi(e,t){var n=ei();t=void 0===t?null:t;var r=n.memoizedState;return null!==r&&null!==t&&Ya(t,r[1])?r[0]:(e=e(),n.memoizedState=[e,t],e)}function yi(e,t,n){var r=Ho();Wo(98>r?98:r,(function(){e(!0)})),Wo(97<r?97:r,(function(){var r=Ga.suspense;Ga.suspense=void 0===t?null:t;try{e(!1),n()}finally{Ga.suspense=r}}))}function bi(e,t,n){var r=eu(),o=va.suspense;o={expirationTime:r=tu(r,e,o),suspenseConfig:o,action:n,eagerReducer:null,eagerState:null,next:null};var a=t.pending;if(null===a?o.next=o:(o.next=a.next,a.next=o),t.pending=o,a=e.alternate,e===Va||null!==a&&a===Va)Ka=!0,o.expirationTime=Ha,Va.expirationTime=Ha;else{if(0===e.expirationTime&&(null===a||0===a.expirationTime)&&null!==(a=t.lastRenderedReducer))try{var i=t.lastRenderedState,l=a(i,n);if(o.eagerReducer=a,o.eagerState=l,$r(l,i))return}catch(u){}nu(e,r)}}var wi={readContext:ua,useCallback:Xa,useContext:Xa,useEffect:Xa,useImperativeHandle:Xa,useLayoutEffect:Xa,useMemo:Xa,useReducer:Xa,useRef:Xa,useState:Xa,useDebugValue:Xa,useResponder:Xa,useDeferredValue:Xa,useTransition:Xa},xi={readContext:ua,useCallback:hi,useContext:ua,useEffect:si,useImperativeHandle:function(e,t,n){return n=null!=n?n.concat([e]):null,li(4,2,fi.bind(null,t,e),n)},useLayoutEffect:function(e,t){return li(4,2,e,t)},useMemo:function(e,t){var n=Ja();return t=void 0===t?null:t,e=e(),n.memoizedState=[e,t],e},useReducer:function(e,t,n){var r=Ja();return t=void 0!==n?n(t):t,r.memoizedState=r.baseState=t,e=(e=r.queue={pending:null,dispatch:null,lastRenderedReducer:e,lastRenderedState:t}).dispatch=bi.bind(null,Va,e),[r.memoizedState,e]},useRef:function(e){return e={current:e},Ja().memoizedState=e},useState:oi,useDebugValue:mi,useResponder:Ba,useDeferredValue:function(e,t){var n=oi(e),r=n[0],o=n[1];return si((function(){var n=Ga.suspense;Ga.suspense=void 0===t?null:t;try{o(e)}finally{Ga.suspense=n}}),[e,t]),r},useTransition:function(e){var t=oi(!1),n=t[0];return t=t[1],[hi(yi.bind(null,t,e),[t,e]),n]}},ki={readContext:ua,useCallback:gi,useContext:ua,useEffect:ci,useImperativeHandle:pi,useLayoutEffect:di,useMemo:vi,useReducer:ni,useRef:ii,useState:function(){return ni(ti)},useDebugValue:mi,useResponder:Ba,useDeferredValue:function(e,t){var n=ni(ti),r=n[0],o=n[1];return ci((function(){var n=Ga.suspense;Ga.suspense=void 0===t?null:t;try{o(e)}finally{Ga.suspense=n}}),[e,t]),r},useTransition:function(e){var t=ni(ti),n=t[0];return t=t[1],[gi(yi.bind(null,t,e),[t,e]),n]}},Ei={readContext:ua,useCallback:gi,useContext:ua,useEffect:ci,useImperativeHandle:pi,useLayoutEffect:di,useMemo:vi,useReducer:ri,useRef:ii,useState:function(){return ri(ti)},useDebugValue:mi,useResponder:Ba,useDeferredValue:function(e,t){var n=ri(ti),r=n[0],o=n[1];return ci((function(){var n=Ga.suspense;Ga.suspense=void 0===t?null:t;try{o(e)}finally{Ga.suspense=n}}),[e,t]),r},useTransition:function(e){var t=ri(ti),n=t[0];return t=t[1],[gi(yi.bind(null,t,e),[t,e]),n]}},Si=null,Ti=null,_i=!1;function Ci(e,t){var n=Nu(5,null,null,0);n.elementType="DELETED",n.type="DELETED",n.stateNode=t,n.return=e,n.effectTag=8,null!==e.lastEffect?(e.lastEffect.nextEffect=n,e.lastEffect=n):e.firstEffect=e.lastEffect=n}function Oi(e,t){switch(e.tag){case 5:var n=e.type;return null!==(t=1!==t.nodeType||n.toLowerCase()!==t.nodeName.toLowerCase()?null:t)&&(e.stateNode=t,!0);case 6:return null!==(t=""===e.pendingProps||3!==t.nodeType?null:t)&&(e.stateNode=t,!0);case 13:default:return!1}}function Pi(e){if(_i){var t=Ti;if(t){var n=t;if(!Oi(e,t)){if(!(t=Tn(n.nextSibling))||!Oi(e,t))return e.effectTag=-1025&e.effectTag|2,_i=!1,void(Si=e);Ci(Si,n)}Si=e,Ti=Tn(t.firstChild)}else e.effectTag=-1025&e.effectTag|2,_i=!1,Si=e}}function Ri(e){for(e=e.return;null!==e&&5!==e.tag&&3!==e.tag&&13!==e.tag;)e=e.return;Si=e}function Ai(e){if(e!==Si)return!1;if(!_i)return Ri(e),_i=!0,!1;var t=e.type;if(5!==e.tag||"head"!==t&&"body"!==t&&!kn(t,e.memoizedProps))for(t=Ti;t;)Ci(e,t),t=Tn(t.nextSibling);if(Ri(e),13===e.tag){if(!(e=null!==(e=e.memoizedState)?e.dehydrated:null))throw Error(i(317));e:{for(e=e.nextSibling,t=0;e;){if(8===e.nodeType){var n=e.data;if("/$"===n){if(0===t){Ti=Tn(e.nextSibling);break e}t--}else"$"!==n&&n!==yn&&n!==vn||t++}e=e.nextSibling}Ti=null}}else Ti=Si?Tn(e.stateNode.nextSibling):null;return!0}function Ni(){Ti=Si=null,_i=!1}var Ii=X.ReactCurrentOwner,Li=!1;function Di(e,t,n,r){t.child=null===e?Ra(t,null,n,r):Pa(t,e.child,n,r)}function ji(e,t,n,r,o){n=n.render;var a=t.ref;return la(t,o),r=Za(e,t,n,r,a,o),null===e||Li?(t.effectTag|=1,Di(e,t,r,o),t.child):(t.updateQueue=e.updateQueue,t.effectTag&=-517,e.expirationTime<=o&&(e.expirationTime=0),Zi(e,t,o))}function Fi(e,t,n,r,o,a){if(null===e){var i=n.type;return"function"!=typeof i||Iu(i)||void 0!==i.defaultProps||null!==n.compare||void 0!==n.defaultProps?((e=Du(n.type,null,r,null,t.mode,a)).ref=t.ref,e.return=t,t.child=e):(t.tag=15,t.type=i,Mi(e,t,i,r,o,a))}return i=e.child,o<a&&(o=i.memoizedProps,(n=null!==(n=n.compare)?n:qr)(o,r)&&e.ref===t.ref)?Zi(e,t,a):(t.effectTag|=1,(e=Lu(i,r)).ref=t.ref,e.return=t,t.child=e)}function Mi(e,t,n,r,o,a){return null!==e&&qr(e.memoizedProps,r)&&e.ref===t.ref&&(Li=!1,o<a)?(t.expirationTime=e.expirationTime,Zi(e,t,a)):Ui(e,t,n,r,a)}function zi(e,t){var n=t.ref;(null===e&&null!==n||null!==e&&e.ref!==n)&&(t.effectTag|=128)}function Ui(e,t,n,r,o){var a=wo(n)?yo:go.current;return a=bo(t,a),la(t,o),n=Za(e,t,n,r,a,o),null===e||Li?(t.effectTag|=1,Di(e,t,n,o),t.child):(t.updateQueue=e.updateQueue,t.effectTag&=-517,e.expirationTime<=o&&(e.expirationTime=0),Zi(e,t,o))}function $i(e,t,n,r,o){if(wo(n)){var a=!0;So(t)}else a=!1;if(la(t,o),null===t.stateNode)null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),ka(t,n,r),Sa(t,n,r,o),r=!0;else if(null===e){var i=t.stateNode,l=t.memoizedProps;i.props=l;var u=i.context,s=n.contextType;"object"==typeof s&&null!==s?s=ua(s):s=bo(t,s=wo(n)?yo:go.current);var c=n.getDerivedStateFromProps,d="function"==typeof c||"function"==typeof i.getSnapshotBeforeUpdate;d||"function"!=typeof i.UNSAFE_componentWillReceiveProps&&"function"!=typeof i.componentWillReceiveProps||(l!==r||u!==s)&&Ea(t,i,r,s),sa=!1;var f=t.memoizedState;i.state=f,ha(t,r,i,o),u=t.memoizedState,l!==r||f!==u||vo.current||sa?("function"==typeof c&&(ba(t,n,c,r),u=t.memoizedState),(l=sa||xa(t,n,l,r,f,u,s))?(d||"function"!=typeof i.UNSAFE_componentWillMount&&"function"!=typeof i.componentWillMount||("function"==typeof i.componentWillMount&&i.componentWillMount(),"function"==typeof i.UNSAFE_componentWillMount&&i.UNSAFE_componentWillMount()),"function"==typeof i.componentDidMount&&(t.effectTag|=4)):("function"==typeof i.componentDidMount&&(t.effectTag|=4),t.memoizedProps=r,t.memoizedState=u),i.props=r,i.state=u,i.context=s,r=l):("function"==typeof i.componentDidMount&&(t.effectTag|=4),r=!1)}else i=t.stateNode,da(e,t),l=t.memoizedProps,i.props=t.type===t.elementType?l:Jo(t.type,l),u=i.context,"object"==typeof(s=n.contextType)&&null!==s?s=ua(s):s=bo(t,s=wo(n)?yo:go.current),(d="function"==typeof(c=n.getDerivedStateFromProps)||"function"==typeof i.getSnapshotBeforeUpdate)||"function"!=typeof i.UNSAFE_componentWillReceiveProps&&"function"!=typeof i.componentWillReceiveProps||(l!==r||u!==s)&&Ea(t,i,r,s),sa=!1,u=t.memoizedState,i.state=u,ha(t,r,i,o),f=t.memoizedState,l!==r||u!==f||vo.current||sa?("function"==typeof c&&(ba(t,n,c,r),f=t.memoizedState),(c=sa||xa(t,n,l,r,u,f,s))?(d||"function"!=typeof i.UNSAFE_componentWillUpdate&&"function"!=typeof i.componentWillUpdate||("function"==typeof i.componentWillUpdate&&i.componentWillUpdate(r,f,s),"function"==typeof i.UNSAFE_componentWillUpdate&&i.UNSAFE_componentWillUpdate(r,f,s)),"function"==typeof i.componentDidUpdate&&(t.effectTag|=4),"function"==typeof i.getSnapshotBeforeUpdate&&(t.effectTag|=256)):("function"!=typeof i.componentDidUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=4),"function"!=typeof i.getSnapshotBeforeUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=256),t.memoizedProps=r,t.memoizedState=f),i.props=r,i.state=f,i.context=s,r=c):("function"!=typeof i.componentDidUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=4),"function"!=typeof i.getSnapshotBeforeUpdate||l===e.memoizedProps&&u===e.memoizedState||(t.effectTag|=256),r=!1);return Bi(e,t,n,r,a,o)}function Bi(e,t,n,r,o,a){zi(e,t);var i=0!=(64&t.effectTag);if(!r&&!i)return o&&To(t,n,!1),Zi(e,t,a);r=t.stateNode,Ii.current=t;var l=i&&"function"!=typeof n.getDerivedStateFromError?null:r.render();return t.effectTag|=1,null!==e&&i?(t.child=Pa(t,e.child,null,a),t.child=Pa(t,null,l,a)):Di(e,t,l,a),t.memoizedState=r.state,o&&To(t,n,!0),t.child}function qi(e){var t=e.stateNode;t.pendingContext?ko(0,t.pendingContext,t.pendingContext!==t.context):t.context&&ko(0,t.context,!1),ja(e,t.containerInfo)}var Gi,Hi,Vi,Wi={dehydrated:null,retryTime:0};function Qi(e,t,n){var r,o=t.mode,a=t.pendingProps,i=Ua.current,l=!1;if((r=0!=(64&t.effectTag))||(r=0!=(2&i)&&(null===e||null!==e.memoizedState)),r?(l=!0,t.effectTag&=-65):null!==e&&null===e.memoizedState||void 0===a.fallback||!0===a.unstable_avoidThisFallback||(i|=1),mo(Ua,1&i),null===e){if(void 0!==a.fallback&&Pi(t),l){if(l=a.fallback,(a=ju(null,o,0,null)).return=t,0==(2&t.mode))for(e=null!==t.memoizedState?t.child.child:t.child,a.child=e;null!==e;)e.return=a,e=e.sibling;return(n=ju(l,o,n,null)).return=t,a.sibling=n,t.memoizedState=Wi,t.child=a,n}return o=a.children,t.memoizedState=null,t.child=Ra(t,null,o,n)}if(null!==e.memoizedState){if(o=(e=e.child).sibling,l){if(a=a.fallback,(n=Lu(e,e.pendingProps)).return=t,0==(2&t.mode)&&(l=null!==t.memoizedState?t.child.child:t.child)!==e.child)for(n.child=l;null!==l;)l.return=n,l=l.sibling;return(o=Lu(o,a)).return=t,n.sibling=o,n.childExpirationTime=0,t.memoizedState=Wi,t.child=n,o}return n=Pa(t,e.child,a.children,n),t.memoizedState=null,t.child=n}if(e=e.child,l){if(l=a.fallback,(a=ju(null,o,0,null)).return=t,a.child=e,null!==e&&(e.return=a),0==(2&t.mode))for(e=null!==t.memoizedState?t.child.child:t.child,a.child=e;null!==e;)e.return=a,e=e.sibling;return(n=ju(l,o,n,null)).return=t,a.sibling=n,n.effectTag|=2,a.childExpirationTime=0,t.memoizedState=Wi,t.child=a,n}return t.memoizedState=null,t.child=Pa(t,e,a.children,n)}function Ki(e,t){e.expirationTime<t&&(e.expirationTime=t);var n=e.alternate;null!==n&&n.expirationTime<t&&(n.expirationTime=t),ia(e.return,t)}function Xi(e,t,n,r,o,a){var i=e.memoizedState;null===i?e.memoizedState={isBackwards:t,rendering:null,renderingStartTime:0,last:r,tail:n,tailExpiration:0,tailMode:o,lastEffect:a}:(i.isBackwards=t,i.rendering=null,i.renderingStartTime=0,i.last=r,i.tail=n,i.tailExpiration=0,i.tailMode=o,i.lastEffect=a)}function Yi(e,t,n){var r=t.pendingProps,o=r.revealOrder,a=r.tail;if(Di(e,t,r.children,n),0!=(2&(r=Ua.current)))r=1&r|2,t.effectTag|=64;else{if(null!==e&&0!=(64&e.effectTag))e:for(e=t.child;null!==e;){if(13===e.tag)null!==e.memoizedState&&Ki(e,n);else if(19===e.tag)Ki(e,n);else if(null!==e.child){e.child.return=e,e=e.child;continue}if(e===t)break e;for(;null===e.sibling;){if(null===e.return||e.return===t)break e;e=e.return}e.sibling.return=e.return,e=e.sibling}r&=1}if(mo(Ua,r),0==(2&t.mode))t.memoizedState=null;else switch(o){case"forwards":for(n=t.child,o=null;null!==n;)null!==(e=n.alternate)&&null===$a(e)&&(o=n),n=n.sibling;null===(n=o)?(o=t.child,t.child=null):(o=n.sibling,n.sibling=null),Xi(t,!1,o,n,a,t.lastEffect);break;case"backwards":for(n=null,o=t.child,t.child=null;null!==o;){if(null!==(e=o.alternate)&&null===$a(e)){t.child=o;break}e=o.sibling,o.sibling=n,n=o,o=e}Xi(t,!0,n,null,a,t.lastEffect);break;case"together":Xi(t,!1,null,null,void 0,t.lastEffect);break;default:t.memoizedState=null}return t.child}function Zi(e,t,n){null!==e&&(t.dependencies=e.dependencies);var r=t.expirationTime;if(0!==r&&mu(r),t.childExpirationTime<n)return null;if(null!==e&&t.child!==e.child)throw Error(i(153));if(null!==t.child){for(n=Lu(e=t.child,e.pendingProps),t.child=n,n.return=t;null!==e.sibling;)e=e.sibling,(n=n.sibling=Lu(e,e.pendingProps)).return=t;n.sibling=null}return t.child}function Ji(e,t){switch(e.tailMode){case"hidden":t=e.tail;for(var n=null;null!==t;)null!==t.alternate&&(n=t),t=t.sibling;null===n?e.tail=null:n.sibling=null;break;case"collapsed":n=e.tail;for(var r=null;null!==n;)null!==n.alternate&&(r=n),n=n.sibling;null===r?t||null===e.tail?e.tail=null:e.tail.sibling=null:r.sibling=null}}function el(e,t,n){var r=t.pendingProps;switch(t.tag){case 2:case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return null;case 1:return wo(t.type)&&xo(),null;case 3:return Fa(),po(vo),po(go),(n=t.stateNode).pendingContext&&(n.context=n.pendingContext,n.pendingContext=null),null!==e&&null!==e.child||!Ai(t)||(t.effectTag|=4),null;case 5:za(t),n=Da(La.current);var a=t.type;if(null!==e&&null!=t.stateNode)Hi(e,t,a,r,n),e.ref!==t.ref&&(t.effectTag|=128);else{if(!r){if(null===t.stateNode)throw Error(i(166));return null}if(e=Da(Na.current),Ai(t)){r=t.stateNode,a=t.type;var l=t.memoizedProps;switch(r[On]=t,r[Pn]=l,a){case"iframe":case"object":case"embed":Qt("load",r);break;case"video":case"audio":for(e=0;e<Ye.length;e++)Qt(Ye[e],r);break;case"source":Qt("error",r);break;case"img":case"image":case"link":Qt("error",r),Qt("load",r);break;case"form":Qt("reset",r),Qt("submit",r);break;case"details":Qt("toggle",r);break;case"input":Ee(r,l),Qt("invalid",r),sn(n,"onChange");break;case"select":r._wrapperState={wasMultiple:!!l.multiple},Qt("invalid",r),sn(n,"onChange");break;case"textarea":Ae(r,l),Qt("invalid",r),sn(n,"onChange")}for(var u in an(a,l),e=null,l)if(l.hasOwnProperty(u)){var s=l[u];"children"===u?"string"==typeof s?r.textContent!==s&&(e=["children",s]):"number"==typeof s&&r.textContent!==""+s&&(e=["children",""+s]):S.hasOwnProperty(u)&&null!=s&&sn(n,u)}switch(a){case"input":we(r),_e(r,l,!0);break;case"textarea":we(r),Ie(r);break;case"select":case"option":break;default:"function"==typeof l.onClick&&(r.onclick=cn)}n=e,t.updateQueue=n,null!==n&&(t.effectTag|=4)}else{switch(u=9===n.nodeType?n:n.ownerDocument,e===un&&(e=je(a)),e===un?"script"===a?((e=u.createElement("div")).innerHTML="<script><\/script>",e=e.removeChild(e.firstChild)):"string"==typeof r.is?e=u.createElement(a,{is:r.is}):(e=u.createElement(a),"select"===a&&(u=e,r.multiple?u.multiple=!0:r.size&&(u.size=r.size))):e=u.createElementNS(e,a),e[On]=t,e[Pn]=r,Gi(e,t),t.stateNode=e,u=ln(a,r),a){case"iframe":case"object":case"embed":Qt("load",e),s=r;break;case"video":case"audio":for(s=0;s<Ye.length;s++)Qt(Ye[s],e);s=r;break;case"source":Qt("error",e),s=r;break;case"img":case"image":case"link":Qt("error",e),Qt("load",e),s=r;break;case"form":Qt("reset",e),Qt("submit",e),s=r;break;case"details":Qt("toggle",e),s=r;break;case"input":Ee(e,r),s=ke(e,r),Qt("invalid",e),sn(n,"onChange");break;case"option":s=Oe(e,r);break;case"select":e._wrapperState={wasMultiple:!!r.multiple},s=o({},r,{value:void 0}),Qt("invalid",e),sn(n,"onChange");break;case"textarea":Ae(e,r),s=Re(e,r),Qt("invalid",e),sn(n,"onChange");break;default:s=r}an(a,s);var c=s;for(l in c)if(c.hasOwnProperty(l)){var d=c[l];"style"===l?rn(e,d):"dangerouslySetInnerHTML"===l?null!=(d=d?d.__html:void 0)&&Ue(e,d):"children"===l?"string"==typeof d?("textarea"!==a||""!==d)&&$e(e,d):"number"==typeof d&&$e(e,""+d):"suppressContentEditableWarning"!==l&&"suppressHydrationWarning"!==l&&"autoFocus"!==l&&(S.hasOwnProperty(l)?null!=d&&sn(n,l):null!=d&&Y(e,l,d,u))}switch(a){case"input":we(e),_e(e,r,!1);break;case"textarea":we(e),Ie(e);break;case"option":null!=r.value&&e.setAttribute("value",""+ye(r.value));break;case"select":e.multiple=!!r.multiple,null!=(n=r.value)?Pe(e,!!r.multiple,n,!1):null!=r.defaultValue&&Pe(e,!!r.multiple,r.defaultValue,!0);break;default:"function"==typeof s.onClick&&(e.onclick=cn)}xn(a,r)&&(t.effectTag|=4)}null!==t.ref&&(t.effectTag|=128)}return null;case 6:if(e&&null!=t.stateNode)Vi(0,t,e.memoizedProps,r);else{if("string"!=typeof r&&null===t.stateNode)throw Error(i(166));n=Da(La.current),Da(Na.current),Ai(t)?(n=t.stateNode,r=t.memoizedProps,n[On]=t,n.nodeValue!==r&&(t.effectTag|=4)):((n=(9===n.nodeType?n:n.ownerDocument).createTextNode(r))[On]=t,t.stateNode=n)}return null;case 13:return po(Ua),r=t.memoizedState,0!=(64&t.effectTag)?(t.expirationTime=n,t):(n=null!==r,r=!1,null===e?void 0!==t.memoizedProps.fallback&&Ai(t):(r=null!==(a=e.memoizedState),n||null===a||null!==(a=e.child.sibling)&&(null!==(l=t.firstEffect)?(t.firstEffect=a,a.nextEffect=l):(t.firstEffect=t.lastEffect=a,a.nextEffect=null),a.effectTag=8)),n&&!r&&0!=(2&t.mode)&&(null===e&&!0!==t.memoizedProps.unstable_avoidThisFallback||0!=(1&Ua.current)?Dl===Ol&&(Dl=Pl):(Dl!==Ol&&Dl!==Pl||(Dl=Rl),0!==Ul&&null!==Nl&&($u(Nl,Ll),Bu(Nl,Ul)))),(n||r)&&(t.effectTag|=4),null);case 4:return Fa(),null;case 10:return aa(t),null;case 17:return wo(t.type)&&xo(),null;case 19:if(po(Ua),null===(r=t.memoizedState))return null;if(a=0!=(64&t.effectTag),null===(l=r.rendering)){if(a)Ji(r,!1);else if(Dl!==Ol||null!==e&&0!=(64&e.effectTag))for(l=t.child;null!==l;){if(null!==(e=$a(l))){for(t.effectTag|=64,Ji(r,!1),null!==(a=e.updateQueue)&&(t.updateQueue=a,t.effectTag|=4),null===r.lastEffect&&(t.firstEffect=null),t.lastEffect=r.lastEffect,r=t.child;null!==r;)l=n,(a=r).effectTag&=2,a.nextEffect=null,a.firstEffect=null,a.lastEffect=null,null===(e=a.alternate)?(a.childExpirationTime=0,a.expirationTime=l,a.child=null,a.memoizedProps=null,a.memoizedState=null,a.updateQueue=null,a.dependencies=null):(a.childExpirationTime=e.childExpirationTime,a.expirationTime=e.expirationTime,a.child=e.child,a.memoizedProps=e.memoizedProps,a.memoizedState=e.memoizedState,a.updateQueue=e.updateQueue,l=e.dependencies,a.dependencies=null===l?null:{expirationTime:l.expirationTime,firstContext:l.firstContext,responders:l.responders}),r=r.sibling;return mo(Ua,1&Ua.current|2),t.child}l=l.sibling}}else{if(!a)if(null!==(e=$a(l))){if(t.effectTag|=64,a=!0,null!==(n=e.updateQueue)&&(t.updateQueue=n,t.effectTag|=4),Ji(r,!0),null===r.tail&&"hidden"===r.tailMode&&!l.alternate)return null!==(t=t.lastEffect=r.lastEffect)&&(t.nextEffect=null),null}else 2*Go()-r.renderingStartTime>r.tailExpiration&&1<n&&(t.effectTag|=64,a=!0,Ji(r,!1),t.expirationTime=t.childExpirationTime=n-1);r.isBackwards?(l.sibling=t.child,t.child=l):(null!==(n=r.last)?n.sibling=l:t.child=l,r.last=l)}return null!==r.tail?(0===r.tailExpiration&&(r.tailExpiration=Go()+500),n=r.tail,r.rendering=n,r.tail=n.sibling,r.lastEffect=t.lastEffect,r.renderingStartTime=Go(),n.sibling=null,t=Ua.current,mo(Ua,a?1&t|2:1&t),n):null}throw Error(i(156,t.tag))}function tl(e){switch(e.tag){case 1:wo(e.type)&&xo();var t=e.effectTag;return 4096&t?(e.effectTag=-4097&t|64,e):null;case 3:if(Fa(),po(vo),po(go),0!=(64&(t=e.effectTag)))throw Error(i(285));return e.effectTag=-4097&t|64,e;case 5:return za(e),null;case 13:return po(Ua),4096&(t=e.effectTag)?(e.effectTag=-4097&t|64,e):null;case 19:return po(Ua),null;case 4:return Fa(),null;case 10:return aa(e),null;default:return null}}function nl(e,t){return{value:e,source:t,stack:ve(t)}}Gi=function(e,t){for(var n=t.child;null!==n;){if(5===n.tag||6===n.tag)e.appendChild(n.stateNode);else if(4!==n.tag&&null!==n.child){n.child.return=n,n=n.child;continue}if(n===t)break;for(;null===n.sibling;){if(null===n.return||n.return===t)return;n=n.return}n.sibling.return=n.return,n=n.sibling}},Hi=function(e,t,n,r,a){var i=e.memoizedProps;if(i!==r){var l,u,s=t.stateNode;switch(Da(Na.current),e=null,n){case"input":i=ke(s,i),r=ke(s,r),e=[];break;case"option":i=Oe(s,i),r=Oe(s,r),e=[];break;case"select":i=o({},i,{value:void 0}),r=o({},r,{value:void 0}),e=[];break;case"textarea":i=Re(s,i),r=Re(s,r),e=[];break;default:"function"!=typeof i.onClick&&"function"==typeof r.onClick&&(s.onclick=cn)}for(l in an(n,r),n=null,i)if(!r.hasOwnProperty(l)&&i.hasOwnProperty(l)&&null!=i[l])if("style"===l)for(u in s=i[l])s.hasOwnProperty(u)&&(n||(n={}),n[u]="");else"dangerouslySetInnerHTML"!==l&&"children"!==l&&"suppressContentEditableWarning"!==l&&"suppressHydrationWarning"!==l&&"autoFocus"!==l&&(S.hasOwnProperty(l)?e||(e=[]):(e=e||[]).push(l,null));for(l in r){var c=r[l];if(s=null!=i?i[l]:void 0,r.hasOwnProperty(l)&&c!==s&&(null!=c||null!=s))if("style"===l)if(s){for(u in s)!s.hasOwnProperty(u)||c&&c.hasOwnProperty(u)||(n||(n={}),n[u]="");for(u in c)c.hasOwnProperty(u)&&s[u]!==c[u]&&(n||(n={}),n[u]=c[u])}else n||(e||(e=[]),e.push(l,n)),n=c;else"dangerouslySetInnerHTML"===l?(c=c?c.__html:void 0,s=s?s.__html:void 0,null!=c&&s!==c&&(e=e||[]).push(l,c)):"children"===l?s===c||"string"!=typeof c&&"number"!=typeof c||(e=e||[]).push(l,""+c):"suppressContentEditableWarning"!==l&&"suppressHydrationWarning"!==l&&(S.hasOwnProperty(l)?(null!=c&&sn(a,l),e||s===c||(e=[])):(e=e||[]).push(l,c))}n&&(e=e||[]).push("style",n),a=e,(t.updateQueue=a)&&(t.effectTag|=4)}},Vi=function(e,t,n,r){n!==r&&(t.effectTag|=4)};var rl="function"==typeof WeakSet?WeakSet:Set;function ol(e,t){var n=t.source,r=t.stack;null===r&&null!==n&&(r=ve(n)),null!==n&&ge(n.type),t=t.value,null!==e&&1===e.tag&&ge(e.type);try{console.error(t)}catch(o){setTimeout((function(){throw o}))}}function al(e){var t=e.ref;if(null!==t)if("function"==typeof t)try{t(null)}catch(n){_u(e,n)}else t.current=null}function il(e,t){switch(t.tag){case 0:case 11:case 15:case 22:return;case 1:if(256&t.effectTag&&null!==e){var n=e.memoizedProps,r=e.memoizedState;t=(e=t.stateNode).getSnapshotBeforeUpdate(t.elementType===t.type?n:Jo(t.type,n),r),e.__reactInternalSnapshotBeforeUpdate=t}return;case 3:case 5:case 6:case 4:case 17:return}throw Error(i(163))}function ll(e,t){if(null!==(t=null!==(t=t.updateQueue)?t.lastEffect:null)){var n=t=t.next;do{if((n.tag&e)===e){var r=n.destroy;n.destroy=void 0,void 0!==r&&r()}n=n.next}while(n!==t)}}function ul(e,t){if(null!==(t=null!==(t=t.updateQueue)?t.lastEffect:null)){var n=t=t.next;do{if((n.tag&e)===e){var r=n.create;n.destroy=r()}n=n.next}while(n!==t)}}function sl(e,t,n){switch(n.tag){case 0:case 11:case 15:case 22:return void ul(3,n);case 1:if(e=n.stateNode,4&n.effectTag)if(null===t)e.componentDidMount();else{var r=n.elementType===n.type?t.memoizedProps:Jo(n.type,t.memoizedProps);e.componentDidUpdate(r,t.memoizedState,e.__reactInternalSnapshotBeforeUpdate)}return void(null!==(t=n.updateQueue)&&ga(n,t,e));case 3:if(null!==(t=n.updateQueue)){if(e=null,null!==n.child)switch(n.child.tag){case 5:e=n.child.stateNode;break;case 1:e=n.child.stateNode}ga(n,t,e)}return;case 5:return e=n.stateNode,void(null===t&&4&n.effectTag&&xn(n.type,n.memoizedProps)&&e.focus());case 6:case 4:case 12:return;case 13:return void(null===n.memoizedState&&(n=n.alternate,null!==n&&(n=n.memoizedState,null!==n&&(n=n.dehydrated,null!==n&&Ft(n)))));case 19:case 17:case 20:case 21:return}throw Error(i(163))}function cl(e,t,n){switch("function"==typeof Ru&&Ru(t),t.tag){case 0:case 11:case 14:case 15:case 22:if(null!==(e=t.updateQueue)&&null!==(e=e.lastEffect)){var r=e.next;Wo(97<n?97:n,(function(){var e=r;do{var n=e.destroy;if(void 0!==n){var o=t;try{n()}catch(a){_u(o,a)}}e=e.next}while(e!==r)}))}break;case 1:al(t),"function"==typeof(n=t.stateNode).componentWillUnmount&&function(e,t){try{t.props=e.memoizedProps,t.state=e.memoizedState,t.componentWillUnmount()}catch(n){_u(e,n)}}(t,n);break;case 5:al(t);break;case 4:gl(e,t,n)}}function dl(e){var t=e.alternate;e.return=null,e.child=null,e.memoizedState=null,e.updateQueue=null,e.dependencies=null,e.alternate=null,e.firstEffect=null,e.lastEffect=null,e.pendingProps=null,e.memoizedProps=null,e.stateNode=null,null!==t&&dl(t)}function fl(e){return 5===e.tag||3===e.tag||4===e.tag}function pl(e){e:{for(var t=e.return;null!==t;){if(fl(t)){var n=t;break e}t=t.return}throw Error(i(160))}switch(t=n.stateNode,n.tag){case 5:var r=!1;break;case 3:case 4:t=t.containerInfo,r=!0;break;default:throw Error(i(161))}16&n.effectTag&&($e(t,""),n.effectTag&=-17);e:t:for(n=e;;){for(;null===n.sibling;){if(null===n.return||fl(n.return)){n=null;break e}n=n.return}for(n.sibling.return=n.return,n=n.sibling;5!==n.tag&&6!==n.tag&&18!==n.tag;){if(2&n.effectTag)continue t;if(null===n.child||4===n.tag)continue t;n.child.return=n,n=n.child}if(!(2&n.effectTag)){n=n.stateNode;break e}}r?ml(e,n,t):hl(e,n,t)}function ml(e,t,n){var r=e.tag,o=5===r||6===r;if(o)e=o?e.stateNode:e.stateNode.instance,t?8===n.nodeType?n.parentNode.insertBefore(e,t):n.insertBefore(e,t):(8===n.nodeType?(t=n.parentNode).insertBefore(e,n):(t=n).appendChild(e),null!=(n=n._reactRootContainer)||null!==t.onclick||(t.onclick=cn));else if(4!==r&&null!==(e=e.child))for(ml(e,t,n),e=e.sibling;null!==e;)ml(e,t,n),e=e.sibling}function hl(e,t,n){var r=e.tag,o=5===r||6===r;if(o)e=o?e.stateNode:e.stateNode.instance,t?n.insertBefore(e,t):n.appendChild(e);else if(4!==r&&null!==(e=e.child))for(hl(e,t,n),e=e.sibling;null!==e;)hl(e,t,n),e=e.sibling}function gl(e,t,n){for(var r,o,a=t,l=!1;;){if(!l){l=a.return;e:for(;;){if(null===l)throw Error(i(160));switch(r=l.stateNode,l.tag){case 5:o=!1;break e;case 3:case 4:r=r.containerInfo,o=!0;break e}l=l.return}l=!0}if(5===a.tag||6===a.tag){e:for(var u=e,s=a,c=n,d=s;;)if(cl(u,d,c),null!==d.child&&4!==d.tag)d.child.return=d,d=d.child;else{if(d===s)break e;for(;null===d.sibling;){if(null===d.return||d.return===s)break e;d=d.return}d.sibling.return=d.return,d=d.sibling}o?(u=r,s=a.stateNode,8===u.nodeType?u.parentNode.removeChild(s):u.removeChild(s)):r.removeChild(a.stateNode)}else if(4===a.tag){if(null!==a.child){r=a.stateNode.containerInfo,o=!0,a.child.return=a,a=a.child;continue}}else if(cl(e,a,n),null!==a.child){a.child.return=a,a=a.child;continue}if(a===t)break;for(;null===a.sibling;){if(null===a.return||a.return===t)return;4===(a=a.return).tag&&(l=!1)}a.sibling.return=a.return,a=a.sibling}}function vl(e,t){switch(t.tag){case 0:case 11:case 14:case 15:case 22:return void ll(3,t);case 1:return;case 5:var n=t.stateNode;if(null!=n){var r=t.memoizedProps,o=null!==e?e.memoizedProps:r;e=t.type;var a=t.updateQueue;if(t.updateQueue=null,null!==a){for(n[Pn]=r,"input"===e&&"radio"===r.type&&null!=r.name&&Se(n,r),ln(e,o),t=ln(e,r),o=0;o<a.length;o+=2){var l=a[o],u=a[o+1];"style"===l?rn(n,u):"dangerouslySetInnerHTML"===l?Ue(n,u):"children"===l?$e(n,u):Y(n,l,u,t)}switch(e){case"input":Te(n,r);break;case"textarea":Ne(n,r);break;case"select":t=n._wrapperState.wasMultiple,n._wrapperState.wasMultiple=!!r.multiple,null!=(e=r.value)?Pe(n,!!r.multiple,e,!1):t!==!!r.multiple&&(null!=r.defaultValue?Pe(n,!!r.multiple,r.defaultValue,!0):Pe(n,!!r.multiple,r.multiple?[]:"",!1))}}}return;case 6:if(null===t.stateNode)throw Error(i(162));return void(t.stateNode.nodeValue=t.memoizedProps);case 3:return void((t=t.stateNode).hydrate&&(t.hydrate=!1,Ft(t.containerInfo)));case 12:return;case 13:if(n=t,null===t.memoizedState?r=!1:(r=!0,n=t.child,Bl=Go()),null!==n)e:for(e=n;;){if(5===e.tag)a=e.stateNode,r?"function"==typeof(a=a.style).setProperty?a.setProperty("display","none","important"):a.display="none":(a=e.stateNode,o=null!=(o=e.memoizedProps.style)&&o.hasOwnProperty("display")?o.display:null,a.style.display=nn("display",o));else if(6===e.tag)e.stateNode.nodeValue=r?"":e.memoizedProps;else{if(13===e.tag&&null!==e.memoizedState&&null===e.memoizedState.dehydrated){(a=e.child.sibling).return=e,e=a;continue}if(null!==e.child){e.child.return=e,e=e.child;continue}}if(e===n)break;for(;null===e.sibling;){if(null===e.return||e.return===n)break e;e=e.return}e.sibling.return=e.return,e=e.sibling}return void yl(t);case 19:return void yl(t);case 17:return}throw Error(i(163))}function yl(e){var t=e.updateQueue;if(null!==t){e.updateQueue=null;var n=e.stateNode;null===n&&(n=e.stateNode=new rl),t.forEach((function(t){var r=Ou.bind(null,e,t);n.has(t)||(n.add(t),t.then(r,r))}))}}var bl="function"==typeof WeakMap?WeakMap:Map;function wl(e,t,n){(n=fa(n,null)).tag=3,n.payload={element:null};var r=t.value;return n.callback=function(){Gl||(Gl=!0,Hl=r),ol(e,t)},n}function xl(e,t,n){(n=fa(n,null)).tag=3;var r=e.type.getDerivedStateFromError;if("function"==typeof r){var o=t.value;n.payload=function(){return ol(e,t),r(o)}}var a=e.stateNode;return null!==a&&"function"==typeof a.componentDidCatch&&(n.callback=function(){"function"!=typeof r&&(null===Vl?Vl=new Set([this]):Vl.add(this),ol(e,t));var n=t.stack;this.componentDidCatch(t.value,{componentStack:null!==n?n:""})}),n}var kl,El=Math.ceil,Sl=X.ReactCurrentDispatcher,Tl=X.ReactCurrentOwner,_l=16,Cl=32,Ol=0,Pl=3,Rl=4,Al=0,Nl=null,Il=null,Ll=0,Dl=Ol,jl=null,Fl=1073741823,Ml=1073741823,zl=null,Ul=0,$l=!1,Bl=0,ql=null,Gl=!1,Hl=null,Vl=null,Wl=!1,Ql=null,Kl=90,Xl=null,Yl=0,Zl=null,Jl=0;function eu(){return 0!=(48&Al)?1073741821-(Go()/10|0):0!==Jl?Jl:Jl=1073741821-(Go()/10|0)}function tu(e,t,n){if(0==(2&(t=t.mode)))return 1073741823;var r=Ho();if(0==(4&t))return 99===r?1073741823:1073741822;if(0!=(Al&_l))return Ll;if(null!==n)e=Zo(e,0|n.timeoutMs||5e3,250);else switch(r){case 99:e=1073741823;break;case 98:e=Zo(e,150,100);break;case 97:case 96:e=Zo(e,5e3,250);break;case 95:e=2;break;default:throw Error(i(326))}return null!==Nl&&e===Ll&&--e,e}function nu(e,t){if(50<Yl)throw Yl=0,Zl=null,Error(i(185));if(null!==(e=ru(e,t))){var n=Ho();1073741823===t?0!=(8&Al)&&0==(48&Al)?lu(e):(au(e),0===Al&&Xo()):au(e),0==(4&Al)||98!==n&&99!==n||(null===Xl?Xl=new Map([[e,t]]):(void 0===(n=Xl.get(e))||n>t)&&Xl.set(e,t))}}function ru(e,t){e.expirationTime<t&&(e.expirationTime=t);var n=e.alternate;null!==n&&n.expirationTime<t&&(n.expirationTime=t);var r=e.return,o=null;if(null===r&&3===e.tag)o=e.stateNode;else for(;null!==r;){if(n=r.alternate,r.childExpirationTime<t&&(r.childExpirationTime=t),null!==n&&n.childExpirationTime<t&&(n.childExpirationTime=t),null===r.return&&3===r.tag){o=r.stateNode;break}r=r.return}return null!==o&&(Nl===o&&(mu(t),Dl===Rl&&$u(o,Ll)),Bu(o,t)),o}function ou(e){var t=e.lastExpiredTime;if(0!==t)return t;if(!Uu(e,t=e.firstPendingTime))return t;var n=e.lastPingedTime;return 2>=(e=n>(e=e.nextKnownPendingLevel)?n:e)&&t!==e?0:e}function au(e){if(0!==e.lastExpiredTime)e.callbackExpirationTime=1073741823,e.callbackPriority=99,e.callbackNode=Ko(lu.bind(null,e));else{var t=ou(e),n=e.callbackNode;if(0===t)null!==n&&(e.callbackNode=null,e.callbackExpirationTime=0,e.callbackPriority=90);else{var r=eu();if(1073741823===t?r=99:1===t||2===t?r=95:r=0>=(r=10*(1073741821-t)-10*(1073741821-r))?99:250>=r?98:5250>=r?97:95,null!==n){var o=e.callbackPriority;if(e.callbackExpirationTime===t&&o>=r)return;n!==Fo&&Oo(n)}e.callbackExpirationTime=t,e.callbackPriority=r,t=1073741823===t?Ko(lu.bind(null,e)):Qo(r,iu.bind(null,e),{timeout:10*(1073741821-t)-Go()}),e.callbackNode=t}}}function iu(e,t){if(Jl=0,t)return qu(e,t=eu()),au(e),null;var n=ou(e);if(0!==n){if(t=e.callbackNode,0!=(48&Al))throw Error(i(327));if(Eu(),e===Nl&&n===Ll||cu(e,n),null!==Il){var r=Al;Al|=_l;for(var o=fu();;)try{gu();break}catch(u){du(e,u)}if(oa(),Al=r,Sl.current=o,1===Dl)throw t=jl,cu(e,n),$u(e,n),au(e),t;if(null===Il)switch(o=e.finishedWork=e.current.alternate,e.finishedExpirationTime=n,r=Dl,Nl=null,r){case Ol:case 1:throw Error(i(345));case 2:qu(e,2<n?2:n);break;case Pl:if($u(e,n),n===(r=e.lastSuspendedTime)&&(e.nextKnownPendingLevel=bu(o)),1073741823===Fl&&10<(o=Bl+500-Go())){if($l){var a=e.lastPingedTime;if(0===a||a>=n){e.lastPingedTime=n,cu(e,n);break}}if(0!==(a=ou(e))&&a!==n)break;if(0!==r&&r!==n){e.lastPingedTime=r;break}e.timeoutHandle=En(wu.bind(null,e),o);break}wu(e);break;case Rl:if($u(e,n),n===(r=e.lastSuspendedTime)&&(e.nextKnownPendingLevel=bu(o)),$l&&(0===(o=e.lastPingedTime)||o>=n)){e.lastPingedTime=n,cu(e,n);break}if(0!==(o=ou(e))&&o!==n)break;if(0!==r&&r!==n){e.lastPingedTime=r;break}if(1073741823!==Ml?r=10*(1073741821-Ml)-Go():1073741823===Fl?r=0:(r=10*(1073741821-Fl)-5e3,0>(r=(o=Go())-r)&&(r=0),(n=10*(1073741821-n)-o)<(r=(120>r?120:480>r?480:1080>r?1080:1920>r?1920:3e3>r?3e3:4320>r?4320:1960*El(r/1960))-r)&&(r=n)),10<r){e.timeoutHandle=En(wu.bind(null,e),r);break}wu(e);break;case 5:if(1073741823!==Fl&&null!==zl){a=Fl;var l=zl;if(0>=(r=0|l.busyMinDurationMs)?r=0:(o=0|l.busyDelayMs,r=(a=Go()-(10*(1073741821-a)-(0|l.timeoutMs||5e3)))<=o?0:o+r-a),10<r){$u(e,n),e.timeoutHandle=En(wu.bind(null,e),r);break}}wu(e);break;default:throw Error(i(329))}if(au(e),e.callbackNode===t)return iu.bind(null,e)}}return null}function lu(e){var t=e.lastExpiredTime;if(t=0!==t?t:1073741823,0!=(48&Al))throw Error(i(327));if(Eu(),e===Nl&&t===Ll||cu(e,t),null!==Il){var n=Al;Al|=_l;for(var r=fu();;)try{hu();break}catch(o){du(e,o)}if(oa(),Al=n,Sl.current=r,1===Dl)throw n=jl,cu(e,t),$u(e,t),au(e),n;if(null!==Il)throw Error(i(261));e.finishedWork=e.current.alternate,e.finishedExpirationTime=t,Nl=null,wu(e),au(e)}return null}function uu(e,t){var n=Al;Al|=1;try{return e(t)}finally{0===(Al=n)&&Xo()}}function su(e,t){var n=Al;Al&=-2,Al|=8;try{return e(t)}finally{0===(Al=n)&&Xo()}}function cu(e,t){e.finishedWork=null,e.finishedExpirationTime=0;var n=e.timeoutHandle;if(-1!==n&&(e.timeoutHandle=-1,Sn(n)),null!==Il)for(n=Il.return;null!==n;){var r=n;switch(r.tag){case 1:null!=(r=r.type.childContextTypes)&&xo();break;case 3:Fa(),po(vo),po(go);break;case 5:za(r);break;case 4:Fa();break;case 13:case 19:po(Ua);break;case 10:aa(r)}n=n.return}Nl=e,Il=Lu(e.current,null),Ll=t,Dl=Ol,jl=null,Ml=Fl=1073741823,zl=null,Ul=0,$l=!1}function du(e,t){for(;;){try{if(oa(),qa.current=wi,Ka)for(var n=Va.memoizedState;null!==n;){var r=n.queue;null!==r&&(r.pending=null),n=n.next}if(Ha=0,Qa=Wa=Va=null,Ka=!1,null===Il||null===Il.return)return Dl=1,jl=t,Il=null;e:{var o=e,a=Il.return,i=Il,l=t;if(t=Ll,i.effectTag|=2048,i.firstEffect=i.lastEffect=null,null!==l&&"object"==typeof l&&"function"==typeof l.then){var u=l;if(0==(2&i.mode)){var s=i.alternate;s?(i.updateQueue=s.updateQueue,i.memoizedState=s.memoizedState,i.expirationTime=s.expirationTime):(i.updateQueue=null,i.memoizedState=null)}var c=0!=(1&Ua.current),d=a;do{var f;if(f=13===d.tag){var p=d.memoizedState;if(null!==p)f=null!==p.dehydrated;else{var m=d.memoizedProps;f=void 0!==m.fallback&&(!0!==m.unstable_avoidThisFallback||!c)}}if(f){var h=d.updateQueue;if(null===h){var g=new Set;g.add(u),d.updateQueue=g}else h.add(u);if(0==(2&d.mode)){if(d.effectTag|=64,i.effectTag&=-2981,1===i.tag)if(null===i.alternate)i.tag=17;else{var v=fa(1073741823,null);v.tag=2,pa(i,v)}i.expirationTime=1073741823;break e}l=void 0,i=t;var y=o.pingCache;if(null===y?(y=o.pingCache=new bl,l=new Set,y.set(u,l)):void 0===(l=y.get(u))&&(l=new Set,y.set(u,l)),!l.has(i)){l.add(i);var b=Cu.bind(null,o,u,i);u.then(b,b)}d.effectTag|=4096,d.expirationTime=t;break e}d=d.return}while(null!==d);l=Error((ge(i.type)||"A React component")+" suspended while rendering, but no fallback UI was specified.\n\nAdd a <Suspense fallback=...> component higher in the tree to provide a loading indicator or placeholder to display."+ve(i))}5!==Dl&&(Dl=2),l=nl(l,i),d=a;do{switch(d.tag){case 3:u=l,d.effectTag|=4096,d.expirationTime=t,ma(d,wl(d,u,t));break e;case 1:u=l;var w=d.type,x=d.stateNode;if(0==(64&d.effectTag)&&("function"==typeof w.getDerivedStateFromError||null!==x&&"function"==typeof x.componentDidCatch&&(null===Vl||!Vl.has(x)))){d.effectTag|=4096,d.expirationTime=t,ma(d,xl(d,u,t));break e}}d=d.return}while(null!==d)}Il=yu(Il)}catch(k){t=k;continue}break}}function fu(){var e=Sl.current;return Sl.current=wi,null===e?wi:e}function pu(e,t){e<Fl&&2<e&&(Fl=e),null!==t&&e<Ml&&2<e&&(Ml=e,zl=t)}function mu(e){e>Ul&&(Ul=e)}function hu(){for(;null!==Il;)Il=vu(Il)}function gu(){for(;null!==Il&&!Mo();)Il=vu(Il)}function vu(e){var t=kl(e.alternate,e,Ll);return e.memoizedProps=e.pendingProps,null===t&&(t=yu(e)),Tl.current=null,t}function yu(e){Il=e;do{var t=Il.alternate;if(e=Il.return,0==(2048&Il.effectTag)){if(t=el(t,Il,Ll),1===Ll||1!==Il.childExpirationTime){for(var n=0,r=Il.child;null!==r;){var o=r.expirationTime,a=r.childExpirationTime;o>n&&(n=o),a>n&&(n=a),r=r.sibling}Il.childExpirationTime=n}if(null!==t)return t;null!==e&&0==(2048&e.effectTag)&&(null===e.firstEffect&&(e.firstEffect=Il.firstEffect),null!==Il.lastEffect&&(null!==e.lastEffect&&(e.lastEffect.nextEffect=Il.firstEffect),e.lastEffect=Il.lastEffect),1<Il.effectTag&&(null!==e.lastEffect?e.lastEffect.nextEffect=Il:e.firstEffect=Il,e.lastEffect=Il))}else{if(null!==(t=tl(Il)))return t.effectTag&=2047,t;null!==e&&(e.firstEffect=e.lastEffect=null,e.effectTag|=2048)}if(null!==(t=Il.sibling))return t;Il=e}while(null!==Il);return Dl===Ol&&(Dl=5),null}function bu(e){var t=e.expirationTime;return t>(e=e.childExpirationTime)?t:e}function wu(e){var t=Ho();return Wo(99,xu.bind(null,e,t)),null}function xu(e,t){do{Eu()}while(null!==Ql);if(0!=(48&Al))throw Error(i(327));var n=e.finishedWork,r=e.finishedExpirationTime;if(null===n)return null;if(e.finishedWork=null,e.finishedExpirationTime=0,n===e.current)throw Error(i(177));e.callbackNode=null,e.callbackExpirationTime=0,e.callbackPriority=90,e.nextKnownPendingLevel=0;var o=bu(n);if(e.firstPendingTime=o,r<=e.lastSuspendedTime?e.firstSuspendedTime=e.lastSuspendedTime=e.nextKnownPendingLevel=0:r<=e.firstSuspendedTime&&(e.firstSuspendedTime=r-1),r<=e.lastPingedTime&&(e.lastPingedTime=0),r<=e.lastExpiredTime&&(e.lastExpiredTime=0),e===Nl&&(Il=Nl=null,Ll=0),1<n.effectTag?null!==n.lastEffect?(n.lastEffect.nextEffect=n,o=n.firstEffect):o=n:o=n.firstEffect,null!==o){var a=Al;Al|=Cl,Tl.current=null,bn=Wt;var l=hn();if(gn(l)){if("selectionStart"in l)var u={start:l.selectionStart,end:l.selectionEnd};else e:{var s=(u=(u=l.ownerDocument)&&u.defaultView||window).getSelection&&u.getSelection();if(s&&0!==s.rangeCount){u=s.anchorNode;var c=s.anchorOffset,d=s.focusNode;s=s.focusOffset;try{u.nodeType,d.nodeType}catch(_){u=null;break e}var f=0,p=-1,m=-1,h=0,g=0,v=l,y=null;t:for(;;){for(var b;v!==u||0!==c&&3!==v.nodeType||(p=f+c),v!==d||0!==s&&3!==v.nodeType||(m=f+s),3===v.nodeType&&(f+=v.nodeValue.length),null!==(b=v.firstChild);)y=v,v=b;for(;;){if(v===l)break t;if(y===u&&++h===c&&(p=f),y===d&&++g===s&&(m=f),null!==(b=v.nextSibling))break;y=(v=y).parentNode}v=b}u=-1===p||-1===m?null:{start:p,end:m}}else u=null}u=u||{start:0,end:0}}else u=null;wn={activeElementDetached:null,focusedElem:l,selectionRange:u},Wt=!1,ql=o;do{try{ku()}catch(_){if(null===ql)throw Error(i(330));_u(ql,_),ql=ql.nextEffect}}while(null!==ql);ql=o;do{try{for(l=e,u=t;null!==ql;){var w=ql.effectTag;if(16&w&&$e(ql.stateNode,""),128&w){var x=ql.alternate;if(null!==x){var k=x.ref;null!==k&&("function"==typeof k?k(null):k.current=null)}}switch(1038&w){case 2:pl(ql),ql.effectTag&=-3;break;case 6:pl(ql),ql.effectTag&=-3,vl(ql.alternate,ql);break;case 1024:ql.effectTag&=-1025;break;case 1028:ql.effectTag&=-1025,vl(ql.alternate,ql);break;case 4:vl(ql.alternate,ql);break;case 8:gl(l,c=ql,u),dl(c)}ql=ql.nextEffect}}catch(_){if(null===ql)throw Error(i(330));_u(ql,_),ql=ql.nextEffect}}while(null!==ql);if(k=wn,x=hn(),w=k.focusedElem,u=k.selectionRange,x!==w&&w&&w.ownerDocument&&mn(w.ownerDocument.documentElement,w)){null!==u&&gn(w)&&(x=u.start,void 0===(k=u.end)&&(k=x),"selectionStart"in w?(w.selectionStart=x,w.selectionEnd=Math.min(k,w.value.length)):(k=(x=w.ownerDocument||document)&&x.defaultView||window).getSelection&&(k=k.getSelection(),c=w.textContent.length,l=Math.min(u.start,c),u=void 0===u.end?l:Math.min(u.end,c),!k.extend&&l>u&&(c=u,u=l,l=c),c=pn(w,l),d=pn(w,u),c&&d&&(1!==k.rangeCount||k.anchorNode!==c.node||k.anchorOffset!==c.offset||k.focusNode!==d.node||k.focusOffset!==d.offset)&&((x=x.createRange()).setStart(c.node,c.offset),k.removeAllRanges(),l>u?(k.addRange(x),k.extend(d.node,d.offset)):(x.setEnd(d.node,d.offset),k.addRange(x))))),x=[];for(k=w;k=k.parentNode;)1===k.nodeType&&x.push({element:k,left:k.scrollLeft,top:k.scrollTop});for("function"==typeof w.focus&&w.focus(),w=0;w<x.length;w++)(k=x[w]).element.scrollLeft=k.left,k.element.scrollTop=k.top}Wt=!!bn,wn=bn=null,e.current=n,ql=o;do{try{for(w=e;null!==ql;){var E=ql.effectTag;if(36&E&&sl(w,ql.alternate,ql),128&E){x=void 0;var S=ql.ref;if(null!==S){var T=ql.stateNode;switch(ql.tag){case 5:x=T;break;default:x=T}"function"==typeof S?S(x):S.current=x}}ql=ql.nextEffect}}catch(_){if(null===ql)throw Error(i(330));_u(ql,_),ql=ql.nextEffect}}while(null!==ql);ql=null,zo(),Al=a}else e.current=n;if(Wl)Wl=!1,Ql=e,Kl=t;else for(ql=o;null!==ql;)t=ql.nextEffect,ql.nextEffect=null,ql=t;if(0===(t=e.firstPendingTime)&&(Vl=null),1073741823===t?e===Zl?Yl++:(Yl=0,Zl=e):Yl=0,"function"==typeof Pu&&Pu(n.stateNode,r),au(e),Gl)throw Gl=!1,e=Hl,Hl=null,e;return 0!=(8&Al)||Xo(),null}function ku(){for(;null!==ql;){var e=ql.effectTag;0!=(256&e)&&il(ql.alternate,ql),0==(512&e)||Wl||(Wl=!0,Qo(97,(function(){return Eu(),null}))),ql=ql.nextEffect}}function Eu(){if(90!==Kl){var e=97<Kl?97:Kl;return Kl=90,Wo(e,Su)}}function Su(){if(null===Ql)return!1;var e=Ql;if(Ql=null,0!=(48&Al))throw Error(i(331));var t=Al;for(Al|=Cl,e=e.current.firstEffect;null!==e;){try{var n=e;if(0!=(512&n.effectTag))switch(n.tag){case 0:case 11:case 15:case 22:ll(5,n),ul(5,n)}}catch(r){if(null===e)throw Error(i(330));_u(e,r)}n=e.nextEffect,e.nextEffect=null,e=n}return Al=t,Xo(),!0}function Tu(e,t,n){pa(e,t=wl(e,t=nl(n,t),1073741823)),null!==(e=ru(e,1073741823))&&au(e)}function _u(e,t){if(3===e.tag)Tu(e,e,t);else for(var n=e.return;null!==n;){if(3===n.tag){Tu(n,e,t);break}if(1===n.tag){var r=n.stateNode;if("function"==typeof n.type.getDerivedStateFromError||"function"==typeof r.componentDidCatch&&(null===Vl||!Vl.has(r))){pa(n,e=xl(n,e=nl(t,e),1073741823)),null!==(n=ru(n,1073741823))&&au(n);break}}n=n.return}}function Cu(e,t,n){var r=e.pingCache;null!==r&&r.delete(t),Nl===e&&Ll===n?Dl===Rl||Dl===Pl&&1073741823===Fl&&Go()-Bl<500?cu(e,Ll):$l=!0:Uu(e,n)&&(0!==(t=e.lastPingedTime)&&t<n||(e.lastPingedTime=n,au(e)))}function Ou(e,t){var n=e.stateNode;null!==n&&n.delete(t),0===(t=0)&&(t=tu(t=eu(),e,null)),null!==(e=ru(e,t))&&au(e)}kl=function(e,t,n){var r=t.expirationTime;if(null!==e){var o=t.pendingProps;if(e.memoizedProps!==o||vo.current)Li=!0;else{if(r<n){switch(Li=!1,t.tag){case 3:qi(t),Ni();break;case 5:if(Ma(t),4&t.mode&&1!==n&&o.hidden)return t.expirationTime=t.childExpirationTime=1,null;break;case 1:wo(t.type)&&So(t);break;case 4:ja(t,t.stateNode.containerInfo);break;case 10:r=t.memoizedProps.value,o=t.type._context,mo(ea,o._currentValue),o._currentValue=r;break;case 13:if(null!==t.memoizedState)return 0!==(r=t.child.childExpirationTime)&&r>=n?Qi(e,t,n):(mo(Ua,1&Ua.current),null!==(t=Zi(e,t,n))?t.sibling:null);mo(Ua,1&Ua.current);break;case 19:if(r=t.childExpirationTime>=n,0!=(64&e.effectTag)){if(r)return Yi(e,t,n);t.effectTag|=64}if(null!==(o=t.memoizedState)&&(o.rendering=null,o.tail=null),mo(Ua,Ua.current),!r)return null}return Zi(e,t,n)}Li=!1}}else Li=!1;switch(t.expirationTime=0,t.tag){case 2:if(r=t.type,null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),e=t.pendingProps,o=bo(t,go.current),la(t,n),o=Za(null,t,r,e,o,n),t.effectTag|=1,"object"==typeof o&&null!==o&&"function"==typeof o.render&&void 0===o.$$typeof){if(t.tag=1,t.memoizedState=null,t.updateQueue=null,wo(r)){var a=!0;So(t)}else a=!1;t.memoizedState=null!==o.state&&void 0!==o.state?o.state:null,ca(t);var l=r.getDerivedStateFromProps;"function"==typeof l&&ba(t,r,l,e),o.updater=wa,t.stateNode=o,o._reactInternalFiber=t,Sa(t,r,e,n),t=Bi(null,t,r,!0,a,n)}else t.tag=0,Di(null,t,o,n),t=t.child;return t;case 16:e:{if(o=t.elementType,null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),e=t.pendingProps,function(e){if(-1===e._status){e._status=0;var t=e._ctor;t=t(),e._result=t,t.then((function(t){0===e._status&&(t=t.default,e._status=1,e._result=t)}),(function(t){0===e._status&&(e._status=2,e._result=t)}))}}(o),1!==o._status)throw o._result;switch(o=o._result,t.type=o,a=t.tag=function(e){if("function"==typeof e)return Iu(e)?1:0;if(null!=e){if((e=e.$$typeof)===ue)return 11;if(e===de)return 14}return 2}(o),e=Jo(o,e),a){case 0:t=Ui(null,t,o,e,n);break e;case 1:t=$i(null,t,o,e,n);break e;case 11:t=ji(null,t,o,e,n);break e;case 14:t=Fi(null,t,o,Jo(o.type,e),r,n);break e}throw Error(i(306,o,""))}return t;case 0:return r=t.type,o=t.pendingProps,Ui(e,t,r,o=t.elementType===r?o:Jo(r,o),n);case 1:return r=t.type,o=t.pendingProps,$i(e,t,r,o=t.elementType===r?o:Jo(r,o),n);case 3:if(qi(t),r=t.updateQueue,null===e||null===r)throw Error(i(282));if(r=t.pendingProps,o=null!==(o=t.memoizedState)?o.element:null,da(e,t),ha(t,r,null,n),(r=t.memoizedState.element)===o)Ni(),t=Zi(e,t,n);else{if((o=t.stateNode.hydrate)&&(Ti=Tn(t.stateNode.containerInfo.firstChild),Si=t,o=_i=!0),o)for(n=Ra(t,null,r,n),t.child=n;n;)n.effectTag=-3&n.effectTag|1024,n=n.sibling;else Di(e,t,r,n),Ni();t=t.child}return t;case 5:return Ma(t),null===e&&Pi(t),r=t.type,o=t.pendingProps,a=null!==e?e.memoizedProps:null,l=o.children,kn(r,o)?l=null:null!==a&&kn(r,a)&&(t.effectTag|=16),zi(e,t),4&t.mode&&1!==n&&o.hidden?(t.expirationTime=t.childExpirationTime=1,t=null):(Di(e,t,l,n),t=t.child),t;case 6:return null===e&&Pi(t),null;case 13:return Qi(e,t,n);case 4:return ja(t,t.stateNode.containerInfo),r=t.pendingProps,null===e?t.child=Pa(t,null,r,n):Di(e,t,r,n),t.child;case 11:return r=t.type,o=t.pendingProps,ji(e,t,r,o=t.elementType===r?o:Jo(r,o),n);case 7:return Di(e,t,t.pendingProps,n),t.child;case 8:case 12:return Di(e,t,t.pendingProps.children,n),t.child;case 10:e:{r=t.type._context,o=t.pendingProps,l=t.memoizedProps,a=o.value;var u=t.type._context;if(mo(ea,u._currentValue),u._currentValue=a,null!==l)if(u=l.value,0===(a=$r(u,a)?0:0|("function"==typeof r._calculateChangedBits?r._calculateChangedBits(u,a):1073741823))){if(l.children===o.children&&!vo.current){t=Zi(e,t,n);break e}}else for(null!==(u=t.child)&&(u.return=t);null!==u;){var s=u.dependencies;if(null!==s){l=u.child;for(var c=s.firstContext;null!==c;){if(c.context===r&&0!=(c.observedBits&a)){1===u.tag&&((c=fa(n,null)).tag=2,pa(u,c)),u.expirationTime<n&&(u.expirationTime=n),null!==(c=u.alternate)&&c.expirationTime<n&&(c.expirationTime=n),ia(u.return,n),s.expirationTime<n&&(s.expirationTime=n);break}c=c.next}}else l=10===u.tag&&u.type===t.type?null:u.child;if(null!==l)l.return=u;else for(l=u;null!==l;){if(l===t){l=null;break}if(null!==(u=l.sibling)){u.return=l.return,l=u;break}l=l.return}u=l}Di(e,t,o.children,n),t=t.child}return t;case 9:return o=t.type,r=(a=t.pendingProps).children,la(t,n),r=r(o=ua(o,a.unstable_observedBits)),t.effectTag|=1,Di(e,t,r,n),t.child;case 14:return a=Jo(o=t.type,t.pendingProps),Fi(e,t,o,a=Jo(o.type,a),r,n);case 15:return Mi(e,t,t.type,t.pendingProps,r,n);case 17:return r=t.type,o=t.pendingProps,o=t.elementType===r?o:Jo(r,o),null!==e&&(e.alternate=null,t.alternate=null,t.effectTag|=2),t.tag=1,wo(r)?(e=!0,So(t)):e=!1,la(t,n),ka(t,r,o),Sa(t,r,o,n),Bi(null,t,r,!0,e,n);case 19:return Yi(e,t,n)}throw Error(i(156,t.tag))};var Pu=null,Ru=null;function Au(e,t,n,r){this.tag=e,this.key=n,this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null,this.index=0,this.ref=null,this.pendingProps=t,this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null,this.mode=r,this.effectTag=0,this.lastEffect=this.firstEffect=this.nextEffect=null,this.childExpirationTime=this.expirationTime=0,this.alternate=null}function Nu(e,t,n,r){return new Au(e,t,n,r)}function Iu(e){return!(!(e=e.prototype)||!e.isReactComponent)}function Lu(e,t){var n=e.alternate;return null===n?((n=Nu(e.tag,t,e.key,e.mode)).elementType=e.elementType,n.type=e.type,n.stateNode=e.stateNode,n.alternate=e,e.alternate=n):(n.pendingProps=t,n.effectTag=0,n.nextEffect=null,n.firstEffect=null,n.lastEffect=null),n.childExpirationTime=e.childExpirationTime,n.expirationTime=e.expirationTime,n.child=e.child,n.memoizedProps=e.memoizedProps,n.memoizedState=e.memoizedState,n.updateQueue=e.updateQueue,t=e.dependencies,n.dependencies=null===t?null:{expirationTime:t.expirationTime,firstContext:t.firstContext,responders:t.responders},n.sibling=e.sibling,n.index=e.index,n.ref=e.ref,n}function Du(e,t,n,r,o,a){var l=2;if(r=e,"function"==typeof e)Iu(e)&&(l=1);else if("string"==typeof e)l=5;else e:switch(e){case ne:return ju(n.children,o,a,t);case le:l=8,o|=7;break;case re:l=8,o|=1;break;case oe:return(e=Nu(12,n,t,8|o)).elementType=oe,e.type=oe,e.expirationTime=a,e;case se:return(e=Nu(13,n,t,o)).type=se,e.elementType=se,e.expirationTime=a,e;case ce:return(e=Nu(19,n,t,o)).elementType=ce,e.expirationTime=a,e;default:if("object"==typeof e&&null!==e)switch(e.$$typeof){case ae:l=10;break e;case ie:l=9;break e;case ue:l=11;break e;case de:l=14;break e;case fe:l=16,r=null;break e;case pe:l=22;break e}throw Error(i(130,null==e?e:typeof e,""))}return(t=Nu(l,n,t,o)).elementType=e,t.type=r,t.expirationTime=a,t}function ju(e,t,n,r){return(e=Nu(7,e,r,t)).expirationTime=n,e}function Fu(e,t,n){return(e=Nu(6,e,null,t)).expirationTime=n,e}function Mu(e,t,n){return(t=Nu(4,null!==e.children?e.children:[],e.key,t)).expirationTime=n,t.stateNode={containerInfo:e.containerInfo,pendingChildren:null,implementation:e.implementation},t}function zu(e,t,n){this.tag=t,this.current=null,this.containerInfo=e,this.pingCache=this.pendingChildren=null,this.finishedExpirationTime=0,this.finishedWork=null,this.timeoutHandle=-1,this.pendingContext=this.context=null,this.hydrate=n,this.callbackNode=null,this.callbackPriority=90,this.lastExpiredTime=this.lastPingedTime=this.nextKnownPendingLevel=this.lastSuspendedTime=this.firstSuspendedTime=this.firstPendingTime=0}function Uu(e,t){var n=e.firstSuspendedTime;return e=e.lastSuspendedTime,0!==n&&n>=t&&e<=t}function $u(e,t){var n=e.firstSuspendedTime,r=e.lastSuspendedTime;n<t&&(e.firstSuspendedTime=t),(r>t||0===n)&&(e.lastSuspendedTime=t),t<=e.lastPingedTime&&(e.lastPingedTime=0),t<=e.lastExpiredTime&&(e.lastExpiredTime=0)}function Bu(e,t){t>e.firstPendingTime&&(e.firstPendingTime=t);var n=e.firstSuspendedTime;0!==n&&(t>=n?e.firstSuspendedTime=e.lastSuspendedTime=e.nextKnownPendingLevel=0:t>=e.lastSuspendedTime&&(e.lastSuspendedTime=t+1),t>e.nextKnownPendingLevel&&(e.nextKnownPendingLevel=t))}function qu(e,t){var n=e.lastExpiredTime;(0===n||n>t)&&(e.lastExpiredTime=t)}function Gu(e,t,n,r){var o=t.current,a=eu(),l=va.suspense;a=tu(a,o,l);e:if(n){t:{if(et(n=n._reactInternalFiber)!==n||1!==n.tag)throw Error(i(170));var u=n;do{switch(u.tag){case 3:u=u.stateNode.context;break t;case 1:if(wo(u.type)){u=u.stateNode.__reactInternalMemoizedMergedChildContext;break t}}u=u.return}while(null!==u);throw Error(i(171))}if(1===n.tag){var s=n.type;if(wo(s)){n=Eo(n,s,u);break e}}n=u}else n=ho;return null===t.context?t.context=n:t.pendingContext=n,(t=fa(a,l)).payload={element:e},null!==(r=void 0===r?null:r)&&(t.callback=r),pa(o,t),nu(o,a),a}function Hu(e){if(!(e=e.current).child)return null;switch(e.child.tag){case 5:default:return e.child.stateNode}}function Vu(e,t){null!==(e=e.memoizedState)&&null!==e.dehydrated&&e.retryTime<t&&(e.retryTime=t)}function Wu(e,t){Vu(e,t),(e=e.alternate)&&Vu(e,t)}function Qu(e,t,n){var r=new zu(e,t,n=null!=n&&!0===n.hydrate),o=Nu(3,null,null,2===t?7:1===t?3:0);r.current=o,o.stateNode=r,ca(o),e[Rn]=r.current,n&&0!==t&&function(e,t){var n=Je(t);Ct.forEach((function(e){ht(e,t,n)})),Ot.forEach((function(e){ht(e,t,n)}))}(0,9===e.nodeType?e:e.ownerDocument),this._internalRoot=r}function Ku(e){return!(!e||1!==e.nodeType&&9!==e.nodeType&&11!==e.nodeType&&(8!==e.nodeType||" react-mount-point-unstable "!==e.nodeValue))}function Xu(e,t,n,r,o){var a=n._reactRootContainer;if(a){var i=a._internalRoot;if("function"==typeof o){var l=o;o=function(){var e=Hu(i);l.call(e)}}Gu(t,i,e,o)}else{if(a=n._reactRootContainer=function(e,t){if(t||(t=!(!(t=e?9===e.nodeType?e.documentElement:e.firstChild:null)||1!==t.nodeType||!t.hasAttribute("data-reactroot"))),!t)for(var n;n=e.lastChild;)e.removeChild(n);return new Qu(e,0,t?{hydrate:!0}:void 0)}(n,r),i=a._internalRoot,"function"==typeof o){var u=o;o=function(){var e=Hu(i);u.call(e)}}su((function(){Gu(t,i,e,o)}))}return Hu(i)}function Yu(e,t,n){var r=3<arguments.length&&void 0!==arguments[3]?arguments[3]:null;return{$$typeof:te,key:null==r?null:""+r,children:e,containerInfo:t,implementation:n}}function Zu(e,t){var n=2<arguments.length&&void 0!==arguments[2]?arguments[2]:null;if(!Ku(t))throw Error(i(200));return Yu(e,t,null,n)}Qu.prototype.render=function(e){Gu(e,this._internalRoot,null,null)},Qu.prototype.unmount=function(){var e=this._internalRoot,t=e.containerInfo;Gu(null,e,null,(function(){t[Rn]=null}))},gt=function(e){if(13===e.tag){var t=Zo(eu(),150,100);nu(e,t),Wu(e,t)}},vt=function(e){13===e.tag&&(nu(e,3),Wu(e,3))},yt=function(e){if(13===e.tag){var t=eu();nu(e,t=tu(t,e,null)),Wu(e,t)}},O=function(e,t,n){switch(t){case"input":if(Te(e,n),t=n.name,"radio"===n.type&&null!=t){for(n=e;n.parentNode;)n=n.parentNode;for(n=n.querySelectorAll("input[name="+JSON.stringify(""+t)+'][type="radio"]'),t=0;t<n.length;t++){var r=n[t];if(r!==e&&r.form===e.form){var o=Ln(r);if(!o)throw Error(i(90));xe(r),Te(r,o)}}}break;case"textarea":Ne(e,n);break;case"select":null!=(t=n.value)&&Pe(e,!!n.multiple,t,!1)}},L=uu,D=function(e,t,n,r,o){var a=Al;Al|=4;try{return Wo(98,e.bind(null,t,n,r,o))}finally{0===(Al=a)&&Xo()}},j=function(){0==(49&Al)&&(function(){if(null!==Xl){var e=Xl;Xl=null,e.forEach((function(e,t){qu(t,e),au(t)})),Xo()}}(),Eu())},F=function(e,t){var n=Al;Al|=2;try{return e(t)}finally{0===(Al=n)&&Xo()}};var Ju={Events:[Nn,In,Ln,_,E,$n,function(e){at(e,Un)},N,I,Zt,ut,Eu,{current:!1}]};!function(e){var t=e.findFiberByHostInstance;(function(e){if("undefined"==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__)return!1;var t=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(t.isDisabled||!t.supportsFiber)return!0;try{var n=t.inject(e);Pu=function(e){try{t.onCommitFiberRoot(n,e,void 0,64==(64&e.current.effectTag))}catch(r){}},Ru=function(e){try{t.onCommitFiberUnmount(n,e)}catch(r){}}}catch(r){}})(o({},e,{overrideHookState:null,overrideProps:null,setSuspenseHandler:null,scheduleUpdate:null,currentDispatcherRef:X.ReactCurrentDispatcher,findHostInstanceByFiber:function(e){return null===(e=rt(e))?null:e.stateNode},findFiberByHostInstance:function(e){return t?t(e):null},findHostInstancesForRefresh:null,scheduleRefresh:null,scheduleRoot:null,setRefreshHandler:null,getCurrentFiber:null}))}({findFiberByHostInstance:An,bundleType:0,version:"16.14.0",rendererPackageName:"react-dom"}),t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=Ju,t.createPortal=Zu,t.findDOMNode=function(e){if(null==e)return null;if(1===e.nodeType)return e;var t=e._reactInternalFiber;if(void 0===t){if("function"==typeof e.render)throw Error(i(188));throw Error(i(268,Object.keys(e)))}return e=null===(e=rt(t))?null:e.stateNode},t.flushSync=function(e,t){if(0!=(48&Al))throw Error(i(187));var n=Al;Al|=1;try{return Wo(99,e.bind(null,t))}finally{Al=n,Xo()}},t.hydrate=function(e,t,n){if(!Ku(t))throw Error(i(200));return Xu(null,e,t,!0,n)},t.render=function(e,t,n){if(!Ku(t))throw Error(i(200));return Xu(null,e,t,!1,n)},t.unmountComponentAtNode=function(e){if(!Ku(e))throw Error(i(40));return!!e._reactRootContainer&&(su((function(){Xu(null,null,e,!1,(function(){e._reactRootContainer=null,e[Rn]=null}))})),!0)},t.unstable_batchedUpdates=uu,t.unstable_createPortal=function(e,t){return Zu(e,t,2<arguments.length&&void 0!==arguments[2]?arguments[2]:null)},t.unstable_renderSubtreeIntoContainer=function(e,t,n,r){if(!Ku(n))throw Error(i(200));if(null==e||void 0===e._reactInternalFiber)throw Error(i(38));return Xu(e,t,n,!1,r)},t.version="16.14.0"},function(e,t,n){"use strict";e.exports=n(34)},function(e,t,n){"use strict";var r,o,a,i,l;if("undefined"==typeof window||"function"!=typeof MessageChannel){var u=null,s=null,c=function(){if(null!==u)try{var e=t.unstable_now();u(!0,e),u=null}catch(n){throw setTimeout(c,0),n}},d=Date.now();t.unstable_now=function(){return Date.now()-d},r=function(e){null!==u?setTimeout(r,0,e):(u=e,setTimeout(c,0))},o=function(e,t){s=setTimeout(e,t)},a=function(){clearTimeout(s)},i=function(){return!1},l=t.unstable_forceFrameRate=function(){}}else{var f=window.performance,p=window.Date,m=window.setTimeout,h=window.clearTimeout;if("undefined"!=typeof console){var g=window.cancelAnimationFrame;"function"!=typeof window.requestAnimationFrame&&console.error("This browser doesn't support requestAnimationFrame. Make sure that you load a polyfill in older browsers. https://fb.me/react-polyfills"),"function"!=typeof g&&console.error("This browser doesn't support cancelAnimationFrame. Make sure that you load a polyfill in older browsers. https://fb.me/react-polyfills")}if("object"==typeof f&&"function"==typeof f.now)t.unstable_now=function(){return f.now()};else{var v=p.now();t.unstable_now=function(){return p.now()-v}}var y=!1,b=null,w=-1,x=5,k=0;i=function(){return t.unstable_now()>=k},l=function(){},t.unstable_forceFrameRate=function(e){0>e||125<e?console.error("forceFrameRate takes a positive int between 0 and 125, forcing framerates higher than 125 fps is not unsupported"):x=0<e?Math.floor(1e3/e):5};var E=new MessageChannel,S=E.port2;E.port1.onmessage=function(){if(null!==b){var e=t.unstable_now();k=e+x;try{b(!0,e)?S.postMessage(null):(y=!1,b=null)}catch(n){throw S.postMessage(null),n}}else y=!1},r=function(e){b=e,y||(y=!0,S.postMessage(null))},o=function(e,n){w=m((function(){e(t.unstable_now())}),n)},a=function(){h(w),w=-1}}function T(e,t){var n=e.length;e.push(t);e:for(;;){var r=n-1>>>1,o=e[r];if(!(void 0!==o&&0<O(o,t)))break e;e[r]=t,e[n]=o,n=r}}function _(e){return void 0===(e=e[0])?null:e}function C(e){var t=e[0];if(void 0!==t){var n=e.pop();if(n!==t){e[0]=n;e:for(var r=0,o=e.length;r<o;){var a=2*(r+1)-1,i=e[a],l=a+1,u=e[l];if(void 0!==i&&0>O(i,n))void 0!==u&&0>O(u,i)?(e[r]=u,e[l]=n,r=l):(e[r]=i,e[a]=n,r=a);else{if(!(void 0!==u&&0>O(u,n)))break e;e[r]=u,e[l]=n,r=l}}}return t}return null}function O(e,t){var n=e.sortIndex-t.sortIndex;return 0!==n?n:e.id-t.id}var P=[],R=[],A=1,N=null,I=3,L=!1,D=!1,j=!1;function F(e){for(var t=_(R);null!==t;){if(null===t.callback)C(R);else{if(!(t.startTime<=e))break;C(R),t.sortIndex=t.expirationTime,T(P,t)}t=_(R)}}function M(e){if(j=!1,F(e),!D)if(null!==_(P))D=!0,r(z);else{var t=_(R);null!==t&&o(M,t.startTime-e)}}function z(e,n){D=!1,j&&(j=!1,a()),L=!0;var r=I;try{for(F(n),N=_(P);null!==N&&(!(N.expirationTime>n)||e&&!i());){var l=N.callback;if(null!==l){N.callback=null,I=N.priorityLevel;var u=l(N.expirationTime<=n);n=t.unstable_now(),"function"==typeof u?N.callback=u:N===_(P)&&C(P),F(n)}else C(P);N=_(P)}if(null!==N)var s=!0;else{var c=_(R);null!==c&&o(M,c.startTime-n),s=!1}return s}finally{N=null,I=r,L=!1}}function U(e){switch(e){case 1:return-1;case 2:return 250;case 5:return 1073741823;case 4:return 1e4;default:return 5e3}}var $=l;t.unstable_IdlePriority=5,t.unstable_ImmediatePriority=1,t.unstable_LowPriority=4,t.unstable_NormalPriority=3,t.unstable_Profiling=null,t.unstable_UserBlockingPriority=2,t.unstable_cancelCallback=function(e){e.callback=null},t.unstable_continueExecution=function(){D||L||(D=!0,r(z))},t.unstable_getCurrentPriorityLevel=function(){return I},t.unstable_getFirstCallbackNode=function(){return _(P)},t.unstable_next=function(e){switch(I){case 1:case 2:case 3:var t=3;break;default:t=I}var n=I;I=t;try{return e()}finally{I=n}},t.unstable_pauseExecution=function(){},t.unstable_requestPaint=$,t.unstable_runWithPriority=function(e,t){switch(e){case 1:case 2:case 3:case 4:case 5:break;default:e=3}var n=I;I=e;try{return t()}finally{I=n}},t.unstable_scheduleCallback=function(e,n,i){var l=t.unstable_now();if("object"==typeof i&&null!==i){var u=i.delay;u="number"==typeof u&&0<u?l+u:l,i="number"==typeof i.timeout?i.timeout:U(e)}else i=U(e),u=l;return e={id:A++,callback:n,priorityLevel:e,startTime:u,expirationTime:i=u+i,sortIndex:-1},u>l?(e.sortIndex=u,T(R,e),null===_(P)&&e===_(R)&&(j?a():j=!0,o(M,u-l))):(e.sortIndex=i,T(P,e),D||L||(D=!0,r(z))),e},t.unstable_shouldYield=function(){var e=t.unstable_now();F(e);var n=_(P);return n!==N&&null!==N&&null!==n&&null!==n.callback&&n.startTime<=e&&n.expirationTime<N.expirationTime||i()},t.unstable_wrapCallback=function(e){var t=I;return function(){var n=I;I=t;try{return e.apply(this,arguments)}finally{I=n}}}},function(e,t,n){"use strict";var r=n(36);function o(){}function a(){}a.resetWarningCache=o,e.exports=function(){function e(e,t,n,o,a,i){if(i!==r){var l=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw l.name="Invariant Violation",l}}function t(){return e}e.isRequired=e;var n={array:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,objectOf:t,oneOf:t,oneOfType:t,shape:t,exact:t,checkPropTypes:a,resetWarningCache:o};return n.PropTypes=n,n}},function(e,t,n){"use strict";e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},function(e,t){e.exports=Array.isArray||function(e){return"[object Array]"==Object.prototype.toString.call(e)}},function(e,t,n){"use strict";var r="function"==typeof Symbol&&Symbol.for,o=r?Symbol.for("react.element"):60103,a=r?Symbol.for("react.portal"):60106,i=r?Symbol.for("react.fragment"):60107,l=r?Symbol.for("react.strict_mode"):60108,u=r?Symbol.for("react.profiler"):60114,s=r?Symbol.for("react.provider"):60109,c=r?Symbol.for("react.context"):60110,d=r?Symbol.for("react.async_mode"):60111,f=r?Symbol.for("react.concurrent_mode"):60111,p=r?Symbol.for("react.forward_ref"):60112,m=r?Symbol.for("react.suspense"):60113,h=r?Symbol.for("react.suspense_list"):60120,g=r?Symbol.for("react.memo"):60115,v=r?Symbol.for("react.lazy"):60116,y=r?Symbol.for("react.block"):60121,b=r?Symbol.for("react.fundamental"):60117,w=r?Symbol.for("react.responder"):60118,x=r?Symbol.for("react.scope"):60119;function k(e){if("object"==typeof e&&null!==e){var t=e.$$typeof;switch(t){case o:switch(e=e.type){case d:case f:case i:case u:case l:case m:return e;default:switch(e=e&&e.$$typeof){case c:case p:case v:case g:case s:return e;default:return t}}case a:return t}}}function E(e){return k(e)===f}t.AsyncMode=d,t.ConcurrentMode=f,t.ContextConsumer=c,t.ContextProvider=s,t.Element=o,t.ForwardRef=p,t.Fragment=i,t.Lazy=v,t.Memo=g,t.Portal=a,t.Profiler=u,t.StrictMode=l,t.Suspense=m,t.isAsyncMode=function(e){return E(e)||k(e)===d},t.isConcurrentMode=E,t.isContextConsumer=function(e){return k(e)===c},t.isContextProvider=function(e){return k(e)===s},t.isElement=function(e){return"object"==typeof e&&null!==e&&e.$$typeof===o},t.isForwardRef=function(e){return k(e)===p},t.isFragment=function(e){return k(e)===i},t.isLazy=function(e){return k(e)===v},t.isMemo=function(e){return k(e)===g},t.isPortal=function(e){return k(e)===a},t.isProfiler=function(e){return k(e)===u},t.isStrictMode=function(e){return k(e)===l},t.isSuspense=function(e){return k(e)===m},t.isValidElementType=function(e){return"string"==typeof e||"function"==typeof e||e===i||e===f||e===u||e===l||e===m||e===h||"object"==typeof e&&null!==e&&(e.$$typeof===v||e.$$typeof===g||e.$$typeof===s||e.$$typeof===c||e.$$typeof===p||e.$$typeof===b||e.$$typeof===w||e.$$typeof===x||e.$$typeof===y)},t.typeOf=k},,function(e,t,n){const r=n(41),o=n(42),a=new Set;function i(e){void 0===e?e=Object.keys(r.languages).filter((e=>"meta"!=e)):Array.isArray(e)||(e=[e]);const t=[...a,...Object.keys(Prism.languages)];o(r,e,t).load((e=>{if(!(e in r.languages))return void(i.silent||console.warn("Language does not exist: "+e));const t="./prism-"+e;delete n.c[n(16).resolve(t)],delete Prism.languages[e],n(16)(t),a.add(e)}))}i.silent=!1,e.exports=i},function(e,t,n){e.exports&&(e.exports={core:{meta:{path:"components/prism-core.js",option:"mandatory"},core:"Core"},themes:{meta:{path:"themes/{id}.css",link:"index.html?theme={id}",exclusive:!0},prism:{title:"Default",option:"default"},"prism-dark":"Dark","prism-funky":"Funky","prism-okaidia":{title:"Okaidia",owner:"ocodia"},"prism-twilight":{title:"Twilight",owner:"remybach"},"prism-coy":{title:"Coy",owner:"tshedor"},"prism-solarizedlight":{title:"Solarized Light",owner:"hectormatos2011 "},"prism-tomorrow":{title:"Tomorrow Night",owner:"Rosey"}},languages:{meta:{path:"components/prism-{id}",noCSS:!0,examplesPath:"examples/prism-{id}",addCheckAll:!0},markup:{title:"Markup",alias:["html","xml","svg","mathml","ssml","atom","rss"],aliasTitles:{html:"HTML",xml:"XML",svg:"SVG",mathml:"MathML",ssml:"SSML",atom:"Atom",rss:"RSS"},option:"default"},css:{title:"CSS",option:"default",modify:"markup"},clike:{title:"C-like",option:"default"},javascript:{title:"JavaScript",require:"clike",modify:"markup",optional:"regex",alias:"js",option:"default"},abap:{title:"ABAP",owner:"dellagustin"},abnf:{title:"ABNF",owner:"RunDevelopment"},actionscript:{title:"ActionScript",require:"javascript",modify:"markup",owner:"Golmote"},ada:{title:"Ada",owner:"Lucretia"},agda:{title:"Agda",owner:"xy-ren"},al:{title:"AL",owner:"RunDevelopment"},antlr4:{title:"ANTLR4",alias:"g4",owner:"RunDevelopment"},apacheconf:{title:"Apache Configuration",owner:"GuiTeK"},apl:{title:"APL",owner:"ngn"},applescript:{title:"AppleScript",owner:"Golmote"},aql:{title:"AQL",owner:"RunDevelopment"},arduino:{title:"Arduino",require:"cpp",owner:"dkern"},arff:{title:"ARFF",owner:"Golmote"},asciidoc:{alias:"adoc",title:"AsciiDoc",owner:"Golmote"},aspnet:{title:"ASP.NET (C#)",require:["markup","csharp"],owner:"nauzilus"},asm6502:{title:"6502 Assembly",owner:"kzurawel"},autohotkey:{title:"AutoHotkey",owner:"aviaryan"},autoit:{title:"AutoIt",owner:"Golmote"},bash:{title:"Bash",alias:"shell",aliasTitles:{shell:"Shell"},owner:"zeitgeist87"},basic:{title:"BASIC",owner:"Golmote"},batch:{title:"Batch",owner:"Golmote"},bbcode:{title:"BBcode",alias:"shortcode",aliasTitles:{shortcode:"Shortcode"},owner:"RunDevelopment"},birb:{title:"Birb",require:"clike",owner:"Calamity210"},bison:{title:"Bison",require:"c",owner:"Golmote"},bnf:{title:"BNF",alias:"rbnf",aliasTitles:{rbnf:"RBNF"},owner:"RunDevelopment"},brainfuck:{title:"Brainfuck",owner:"Golmote"},brightscript:{title:"BrightScript",owner:"RunDevelopment"},bro:{title:"Bro",owner:"wayward710"},bsl:{title:"BSL (1C:Enterprise)",alias:"oscript",aliasTitles:{oscript:"OneScript"},owner:"Diversus23"},c:{title:"C",require:"clike",owner:"zeitgeist87"},csharp:{title:"C#",require:"clike",alias:["cs","dotnet"],owner:"mvalipour"},cpp:{title:"C++",require:"c",owner:"zeitgeist87"},cil:{title:"CIL",owner:"sbrl"},clojure:{title:"Clojure",owner:"troglotit"},cmake:{title:"CMake",owner:"mjrogozinski"},coffeescript:{title:"CoffeeScript",require:"javascript",alias:"coffee",owner:"R-osey"},concurnas:{title:"Concurnas",alias:"conc",owner:"jasontatton"},csp:{title:"Content-Security-Policy",owner:"ScottHelme"},crystal:{title:"Crystal",require:"ruby",owner:"MakeNowJust"},"css-extras":{title:"CSS Extras",require:"css",modify:"css",owner:"milesj"},cypher:{title:"Cypher",owner:"RunDevelopment"},d:{title:"D",require:"clike",owner:"Golmote"},dart:{title:"Dart",require:"clike",owner:"Golmote"},dax:{title:"DAX",owner:"peterbud"},dhall:{title:"Dhall",owner:"RunDevelopment"},diff:{title:"Diff",owner:"uranusjr"},django:{title:"Django/Jinja2",require:"markup-templating",alias:"jinja2",owner:"romanvm"},"dns-zone-file":{title:"DNS zone file",owner:"RunDevelopment",alias:"dns-zone"},docker:{title:"Docker",alias:"dockerfile",owner:"JustinBeckwith"},ebnf:{title:"EBNF",owner:"RunDevelopment"},editorconfig:{title:"EditorConfig",owner:"osipxd"},eiffel:{title:"Eiffel",owner:"Conaclos"},ejs:{title:"EJS",require:["javascript","markup-templating"],owner:"RunDevelopment",alias:"eta",aliasTitles:{eta:"Eta"}},elixir:{title:"Elixir",owner:"Golmote"},elm:{title:"Elm",owner:"zwilias"},etlua:{title:"Embedded Lua templating",require:["lua","markup-templating"],owner:"RunDevelopment"},erb:{title:"ERB",require:["ruby","markup-templating"],owner:"Golmote"},erlang:{title:"Erlang",owner:"Golmote"},"excel-formula":{title:"Excel Formula",alias:["xlsx","xls"],owner:"RunDevelopment"},fsharp:{title:"F#",require:"clike",owner:"simonreynolds7"},factor:{title:"Factor",owner:"catb0t"},"firestore-security-rules":{title:"Firestore security rules",require:"clike",owner:"RunDevelopment"},flow:{title:"Flow",require:"javascript",owner:"Golmote"},fortran:{title:"Fortran",owner:"Golmote"},ftl:{title:"FreeMarker Template Language",require:"markup-templating",owner:"RunDevelopment"},gml:{title:"GameMaker Language",alias:"gamemakerlanguage",require:"clike",owner:"LiarOnce"},gcode:{title:"G-code",owner:"RunDevelopment"},gdscript:{title:"GDScript",owner:"RunDevelopment"},gedcom:{title:"GEDCOM",owner:"Golmote"},gherkin:{title:"Gherkin",owner:"hason"},git:{title:"Git",owner:"lgiraudel"},glsl:{title:"GLSL",require:"c",owner:"Golmote"},go:{title:"Go",require:"clike",owner:"arnehormann"},graphql:{title:"GraphQL",optional:["markdown"],owner:"Golmote"},groovy:{title:"Groovy",require:"clike",owner:"robfletcher"},haml:{title:"Haml",require:"ruby",optional:["css","css-extras","coffeescript","erb","javascript","less","markdown","scss","textile"],owner:"Golmote"},handlebars:{title:"Handlebars",require:"markup-templating",owner:"Golmote"},haskell:{title:"Haskell",alias:"hs",owner:"bholst"},haxe:{title:"Haxe",require:"clike",owner:"Golmote"},hcl:{title:"HCL",owner:"outsideris"},hlsl:{title:"HLSL",require:"c",owner:"RunDevelopment"},http:{title:"HTTP",optional:["css","javascript","json","markup"],owner:"danielgtaylor"},hpkp:{title:"HTTP Public-Key-Pins",owner:"ScottHelme"},hsts:{title:"HTTP Strict-Transport-Security",owner:"ScottHelme"},ichigojam:{title:"IchigoJam",owner:"BlueCocoa"},icon:{title:"Icon",owner:"Golmote"},ignore:{title:".ignore",owner:"osipxd",alias:["gitignore","hgignore","npmignore"],aliasTitles:{gitignore:".gitignore",hgignore:".hgignore",npmignore:".npmignore"}},inform7:{title:"Inform 7",owner:"Golmote"},ini:{title:"Ini",owner:"aviaryan"},io:{title:"Io",owner:"AlesTsurko"},j:{title:"J",owner:"Golmote"},java:{title:"Java",require:"clike",owner:"sherblot"},javadoc:{title:"JavaDoc",require:["markup","java","javadoclike"],modify:"java",optional:"scala",owner:"RunDevelopment"},javadoclike:{title:"JavaDoc-like",modify:["java","javascript","php"],owner:"RunDevelopment"},javastacktrace:{title:"Java stack trace",owner:"RunDevelopment"},jolie:{title:"Jolie",require:"clike",owner:"thesave"},jq:{title:"JQ",owner:"RunDevelopment"},jsdoc:{title:"JSDoc",require:["javascript","javadoclike","typescript"],modify:"javascript",optional:["actionscript","coffeescript"],owner:"RunDevelopment"},"js-extras":{title:"JS Extras",require:"javascript",modify:"javascript",optional:["actionscript","coffeescript","flow","n4js","typescript"],owner:"RunDevelopment"},json:{title:"JSON",alias:"webmanifest",aliasTitles:{webmanifest:"Web App Manifest"},owner:"CupOfTea696"},json5:{title:"JSON5",require:"json",owner:"RunDevelopment"},jsonp:{title:"JSONP",require:"json",owner:"RunDevelopment"},jsstacktrace:{title:"JS stack trace",owner:"sbrl"},"js-templates":{title:"JS Templates",require:"javascript",modify:"javascript",optional:["css","css-extras","graphql","markdown","markup"],owner:"RunDevelopment"},julia:{title:"Julia",owner:"cdagnino"},keyman:{title:"Keyman",owner:"mcdurdin"},kotlin:{title:"Kotlin",alias:["kt","kts"],aliasTitles:{kts:"Kotlin Script"},require:"clike",owner:"Golmote"},latex:{title:"LaTeX",alias:["tex","context"],aliasTitles:{tex:"TeX",context:"ConTeXt"},owner:"japborst"},latte:{title:"Latte",require:["clike","markup-templating","php"],owner:"nette"},less:{title:"Less",require:"css",optional:"css-extras",owner:"Golmote"},lilypond:{title:"LilyPond",require:"scheme",alias:"ly",owner:"RunDevelopment"},liquid:{title:"Liquid",owner:"cinhtau"},lisp:{title:"Lisp",alias:["emacs","elisp","emacs-lisp"],owner:"JuanCaicedo"},livescript:{title:"LiveScript",owner:"Golmote"},llvm:{title:"LLVM IR",owner:"porglezomp"},lolcode:{title:"LOLCODE",owner:"Golmote"},lua:{title:"Lua",owner:"Golmote"},makefile:{title:"Makefile",owner:"Golmote"},markdown:{title:"Markdown",require:"markup",alias:"md",owner:"Golmote"},"markup-templating":{title:"Markup templating",require:"markup",owner:"Golmote"},matlab:{title:"MATLAB",owner:"Golmote"},mel:{title:"MEL",owner:"Golmote"},mizar:{title:"Mizar",owner:"Golmote"},mongodb:{title:"MongoDB",owner:"airs0urce",require:"javascript"},monkey:{title:"Monkey",owner:"Golmote"},moonscript:{title:"MoonScript",alias:"moon",owner:"RunDevelopment"},n1ql:{title:"N1QL",owner:"TMWilds"},n4js:{title:"N4JS",require:"javascript",optional:"jsdoc",alias:"n4jsd",owner:"bsmith-n4"},"nand2tetris-hdl":{title:"Nand To Tetris HDL",owner:"stephanmax"},naniscript:{title:"Naninovel Script",owner:"Elringus",alias:"nani"},nasm:{title:"NASM",owner:"rbmj"},neon:{title:"NEON",owner:"nette"},nginx:{title:"nginx",owner:"westonganger",require:"clike"},nim:{title:"Nim",owner:"Golmote"},nix:{title:"Nix",owner:"Golmote"},nsis:{title:"NSIS",owner:"idleberg"},objectivec:{title:"Objective-C",require:"c",alias:"objc",owner:"uranusjr"},ocaml:{title:"OCaml",owner:"Golmote"},opencl:{title:"OpenCL",require:"c",modify:["c","cpp"],owner:"Milania1"},oz:{title:"Oz",owner:"Golmote"},parigp:{title:"PARI/GP",owner:"Golmote"},parser:{title:"Parser",require:"markup",owner:"Golmote"},pascal:{title:"Pascal",alias:"objectpascal",aliasTitles:{objectpascal:"Object Pascal"},owner:"Golmote"},pascaligo:{title:"Pascaligo",owner:"DefinitelyNotAGoat"},pcaxis:{title:"PC-Axis",alias:"px",owner:"RunDevelopment"},peoplecode:{title:"PeopleCode",alias:"pcode",owner:"RunDevelopment"},perl:{title:"Perl",owner:"Golmote"},php:{title:"PHP",require:["clike","markup-templating"],owner:"milesj"},phpdoc:{title:"PHPDoc",require:["php","javadoclike"],modify:"php",owner:"RunDevelopment"},"php-extras":{title:"PHP Extras",require:"php",modify:"php",owner:"milesj"},plsql:{title:"PL/SQL",require:"sql",owner:"Golmote"},powerquery:{title:"PowerQuery",alias:["pq","mscript"],owner:"peterbud"},powershell:{title:"PowerShell",owner:"nauzilus"},processing:{title:"Processing",require:"clike",owner:"Golmote"},prolog:{title:"Prolog",owner:"Golmote"},properties:{title:".properties",owner:"Golmote"},protobuf:{title:"Protocol Buffers",require:"clike",owner:"just-boris"},pug:{title:"Pug",require:["markup","javascript"],optional:["coffeescript","ejs","handlebars","less","livescript","markdown","scss","stylus","twig"],owner:"Golmote"},puppet:{title:"Puppet",owner:"Golmote"},pure:{title:"Pure",optional:["c","cpp","fortran"],owner:"Golmote"},purebasic:{title:"PureBasic",require:"clike",alias:"pbfasm",owner:"HeX0R101"},purescript:{title:"PureScript",require:"haskell",alias:"purs",owner:"sriharshachilakapati"},python:{title:"Python",alias:"py",owner:"multipetros"},q:{title:"Q (kdb+ database)",owner:"Golmote"},qml:{title:"QML",require:"javascript",owner:"RunDevelopment"},qore:{title:"Qore",require:"clike",owner:"temnroegg"},r:{title:"R",owner:"Golmote"},racket:{title:"Racket",require:"scheme",alias:"rkt",owner:"RunDevelopment"},jsx:{title:"React JSX",require:["markup","javascript"],optional:["jsdoc","js-extras","js-templates"],owner:"vkbansal"},tsx:{title:"React TSX",require:["jsx","typescript"]},reason:{title:"Reason",require:"clike",owner:"Golmote"},regex:{title:"Regex",owner:"RunDevelopment"},renpy:{title:"Ren'py",alias:"rpy",owner:"HyuchiaDiego"},rest:{title:"reST (reStructuredText)",owner:"Golmote"},rip:{title:"Rip",owner:"ravinggenius"},roboconf:{title:"Roboconf",owner:"Golmote"},robotframework:{title:"Robot Framework",alias:"robot",owner:"RunDevelopment"},ruby:{title:"Ruby",require:"clike",alias:"rb",owner:"samflores"},rust:{title:"Rust",owner:"Golmote"},sas:{title:"SAS",optional:["groovy","lua","sql"],owner:"Golmote"},sass:{title:"Sass (Sass)",require:"css",owner:"Golmote"},scss:{title:"Sass (Scss)",require:"css",optional:"css-extras",owner:"MoOx"},scala:{title:"Scala",require:"java",owner:"jozic"},scheme:{title:"Scheme",owner:"bacchus123"},"shell-session":{title:"Shell session",require:"bash",alias:["sh-session","shellsession"],owner:"RunDevelopment"},smali:{title:"Smali",owner:"RunDevelopment"},smalltalk:{title:"Smalltalk",owner:"Golmote"},smarty:{title:"Smarty",require:"markup-templating",owner:"Golmote"},sml:{title:"SML",alias:"smlnj",aliasTitles:{smlnj:"SML/NJ"},owner:"RunDevelopment"},solidity:{title:"Solidity (Ethereum)",alias:"sol",require:"clike",owner:"glachaud"},"solution-file":{title:"Solution file",alias:"sln",owner:"RunDevelopment"},soy:{title:"Soy (Closure Template)",require:"markup-templating",owner:"Golmote"},sparql:{title:"SPARQL",require:"turtle",owner:"Triply-Dev",alias:"rq"},"splunk-spl":{title:"Splunk SPL",owner:"RunDevelopment"},sqf:{title:"SQF: Status Quo Function (Arma 3)",require:"clike",owner:"RunDevelopment"},sql:{title:"SQL",owner:"multipetros"},stan:{title:"Stan",owner:"RunDevelopment"},iecst:{title:"Structured Text (IEC 61131-3)",owner:"serhioromano"},stylus:{title:"Stylus",owner:"vkbansal"},swift:{title:"Swift",require:"clike",owner:"chrischares"},"t4-templating":{title:"T4 templating",owner:"RunDevelopment"},"t4-cs":{title:"T4 Text Templates (C#)",require:["t4-templating","csharp"],alias:"t4",owner:"RunDevelopment"},"t4-vb":{title:"T4 Text Templates (VB)",require:["t4-templating","vbnet"],owner:"RunDevelopment"},tap:{title:"TAP",owner:"isaacs",require:"yaml"},tcl:{title:"Tcl",owner:"PeterChaplin"},tt2:{title:"Template Toolkit 2",require:["clike","markup-templating"],owner:"gflohr"},textile:{title:"Textile",require:"markup",optional:"css",owner:"Golmote"},toml:{title:"TOML",owner:"RunDevelopment"},turtle:{title:"Turtle",alias:"trig",aliasTitles:{trig:"TriG"},owner:"jakubklimek"},twig:{title:"Twig",require:"markup",owner:"brandonkelly"},typescript:{title:"TypeScript",require:"javascript",optional:"js-templates",alias:"ts",owner:"vkbansal"},typoscript:{title:"TypoScript",alias:"tsconfig",aliasTitles:{tsconfig:"TSConfig"},owner:"dkern"},unrealscript:{title:"UnrealScript",alias:["uscript","uc"],owner:"RunDevelopment"},vala:{title:"Vala",require:"clike",optional:"regex",owner:"TemplarVolk"},vbnet:{title:"VB.Net",require:"basic",owner:"Bigsby"},velocity:{title:"Velocity",require:"markup",owner:"Golmote"},verilog:{title:"Verilog",owner:"a-rey"},vhdl:{title:"VHDL",owner:"a-rey"},vim:{title:"vim",owner:"westonganger"},"visual-basic":{title:"Visual Basic",alias:["vb","vba"],aliasTitles:{vba:"VBA"},owner:"Golmote"},warpscript:{title:"WarpScript",owner:"RunDevelopment"},wasm:{title:"WebAssembly",owner:"Golmote"},wiki:{title:"Wiki markup",require:"markup",owner:"Golmote"},xeora:{title:"Xeora",require:"markup",alias:"xeoracube",aliasTitles:{xeoracube:"XeoraCube"},owner:"freakmaxi"},"xml-doc":{title:"XML doc (.net)",require:"markup",modify:["csharp","fsharp","vbnet"],owner:"RunDevelopment"},xojo:{title:"Xojo (REALbasic)",owner:"Golmote"},xquery:{title:"XQuery",require:"markup",owner:"Golmote"},yaml:{title:"YAML",alias:"yml",owner:"hason"},yang:{title:"YANG",owner:"RunDevelopment"},zig:{title:"Zig",owner:"RunDevelopment"}},plugins:{meta:{path:"plugins/{id}/prism-{id}",link:"plugins/{id}/"},"line-highlight":{title:"Line Highlight",description:"Highlights specific lines and/or line ranges."},"line-numbers":{title:"Line Numbers",description:"Line number at the beginning of code lines.",owner:"kuba-kubula"},"show-invisibles":{title:"Show Invisibles",description:"Show hidden characters such as tabs and line breaks.",optional:["autolinker","data-uri-highlight"]},autolinker:{title:"Autolinker",description:"Converts URLs and emails in code to clickable links. Parses Markdown links in comments."},wpd:{title:"WebPlatform Docs",description:'Makes tokens link to <a href="https://webplatform.github.io/docs/">WebPlatform.org documentation</a>. The links open in a new tab.'},"custom-class":{title:"Custom Class",description:"This plugin allows you to prefix Prism's default classes (<code>.comment</code> can become <code>.namespace--comment</code>) or replace them with your defined ones (like <code>.editor__comment</code>). You can even add new classes.",owner:"dvkndn",noCSS:!0},"file-highlight":{title:"File Highlight",description:"Fetch external files and highlight them with Prism. Used on the Prism website itself.",noCSS:!0},"show-language":{title:"Show Language",description:"Display the highlighted language in code blocks (inline code does not show the label).",owner:"nauzilus",noCSS:!0,require:"toolbar"},"jsonp-highlight":{title:"JSONP Highlight",description:"Fetch content with JSONP and highlight some interesting content (e.g. GitHub/Gists or Bitbucket API).",noCSS:!0,owner:"nauzilus"},"highlight-keywords":{title:"Highlight Keywords",description:"Adds special CSS classes for each keyword matched in the code. For example, the keyword <code>if</code> will have the class <code>keyword-if</code> as well. You can have fine grained control over the appearance of each keyword by providing your own CSS rules.",owner:"vkbansal",noCSS:!0},"remove-initial-line-feed":{title:"Remove initial line feed",description:"Removes the initial line feed in code blocks.",owner:"Golmote",noCSS:!0},"inline-color":{title:"Inline color",description:"Adds a small inline preview for colors in style sheets.",require:"css-extras",owner:"RunDevelopment"},previewers:{title:"Previewers",description:"Previewers for angles, colors, gradients, easing and time.",require:"css-extras",owner:"Golmote"},autoloader:{title:"Autoloader",description:"Automatically loads the needed languages to highlight the code blocks.",owner:"Golmote",noCSS:!0},"keep-markup":{title:"Keep Markup",description:"Prevents custom markup from being dropped out during highlighting.",owner:"Golmote",optional:"normalize-whitespace",noCSS:!0},"command-line":{title:"Command Line",description:"Display a command line with a prompt and, optionally, the output/response from the commands.",owner:"chriswells0"},"unescaped-markup":{title:"Unescaped Markup",description:"Write markup without having to escape anything."},"normalize-whitespace":{title:"Normalize Whitespace",description:"Supports multiple operations to normalize whitespace in code blocks.",owner:"zeitgeist87",optional:"unescaped-markup",noCSS:!0},"data-uri-highlight":{title:"Data-URI Highlight",description:"Highlights data-URI contents.",owner:"Golmote",noCSS:!0},toolbar:{title:"Toolbar",description:"Attach a toolbar for plugins to easily register buttons on the top of a code block.",owner:"mAAdhaTTah"},"copy-to-clipboard":{title:"Copy to Clipboard Button",description:"Add a button that copies the code block to the clipboard when clicked.",owner:"mAAdhaTTah",require:"toolbar",noCSS:!0},"download-button":{title:"Download Button",description:"A button in the toolbar of a code block adding a convenient way to download a code file.",owner:"Golmote",require:"toolbar",noCSS:!0},"match-braces":{title:"Match braces",description:"Highlights matching braces.",owner:"RunDevelopment"},"diff-highlight":{title:"Diff Highlight",description:"Highlights the code inside diff blocks.",owner:"RunDevelopment",require:"diff"},"filter-highlight-all":{title:"Filter highlightAll",description:"Filters the elements the <code>highlightAll</code> and <code>highlightAllUnder</code> methods actually highlight.",owner:"RunDevelopment",noCSS:!0},treeview:{title:"Treeview",description:"A language with special styles to highlight file system tree structures.",owner:"Golmote"}}})},function(e,t,n){"use strict";var r=function(){var e=function(){};function t(e,t){Array.isArray(e)?e.forEach(t):null!=e&&t(e,0)}function n(e){for(var t={},n=0,r=e.length;n<r;n++)t[e[n]]=!0;return t}function r(e){var n={},r=[];function o(r,a){if(!(r in n)){a.push(r);var i=a.indexOf(r);if(i<a.length-1)throw new Error("Circular dependency: "+a.slice(i).join(" -> "));var l={},u=e[r];if(u){function s(t){if(!(t in e))throw new Error(r+" depends on an unknown component "+t);if(!(t in l))for(var i in o(t,a),l[t]=!0,n[t])l[i]=!0}t(u.require,s),t(u.optional,s),t(u.modify,s)}n[r]=l,a.pop()}}return function(e){var t=n[e];return t||(o(e,r),t=n[e]),t}}function o(e){for(var t in e)return!0;return!1}return function(a,i,l){var u=function(e){var t={};for(var n in e){var r=e[n];for(var o in r)if("meta"!=o){var a=r[o];t[o]="string"==typeof a?{title:a}:a}}return t}(a),s=function(e){var n;return function(r){if(r in e)return r;if(!n)for(var o in n={},e){var a=e[o];t(a&&a.alias,(function(t){if(t in n)throw new Error(t+" cannot be alias for both "+o+" and "+n[t]);if(t in e)throw new Error(t+" cannot be alias of "+o+" because it is a component.");n[t]=o}))}return n[r]||r}}(u);i=i.map(s),l=(l||[]).map(s);var c=n(i),d=n(l);i.forEach((function e(n){var r=u[n];t(r&&r.require,(function(t){t in d||(c[t]=!0,e(t))}))}));for(var f,p=r(u),m=c;o(m);){for(var h in f={},m){var g=u[h];t(g&&g.modify,(function(e){e in d&&(f[e]=!0)}))}for(var v in d)if(!(v in c))for(var y in p(v))if(y in c){f[v]=!0;break}for(var b in m=f)c[b]=!0}var w={getIds:function(){var e=[];return w.load((function(t){e.push(t)})),e},load:function(t,n){return function(t,n,r,o){const a=o?o.series:void 0,i=o?o.parallel:e;var l={},u={};function s(e){if(e in l)return l[e];u[e]=!0;var o,c=[];for(var d in t(e))d in n&&c.push(d);if(0===c.length)o=r(e);else{var f=i(c.map((function(e){var t=s(e);return delete u[e],t})));a?o=a(f,(function(){return r(e)})):r(e)}return l[e]=o}for(var c in n)s(c);var d=[];for(var f in u)d.push(l[f]);return i(d)}(p,c,t,n)}};return w}}();e.exports=r},,,function(e,t,n){"use strict";n.r(t);var r=n(0),o=n.n(r),a=n(25),i=n(13),l=n(17),u=n.n(l),s=function(e){var t=e.error,n=e.retry,r=e.pastDelay;return t?o.a.createElement("div",{style:{align:"center",color:"#fff",backgroundColor:"#fa383e",borderColor:"#fa383e",borderStyle:"solid",borderRadius:"0.25rem",borderWidth:"1px",boxSizing:"border-box",display:"block",padding:"1rem",flex:"0 0 50%",marginLeft:"25%",marginRight:"25%",marginTop:"5rem",maxWidth:"50%",width:"100%"}},o.a.createElement("p",null,t.message),o.a.createElement("div",null,o.a.createElement("button",{type:"button",onClick:n},"Retry"))):r?o.a.createElement("div",{style:{display:"flex",justifyContent:"center",alignItems:"center",height:"100vh"}},o.a.createElement("svg",{id:"loader",style:{width:128,height:110,position:"absolute",top:"calc(100vh - 64%)"},viewBox:"0 0 45 45",xmlns:"http://www.w3.org/2000/svg",stroke:"#61dafb"},o.a.createElement("g",{fill:"none",fillRule:"evenodd",transform:"translate(1 1)",strokeWidth:"2"},o.a.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},o.a.createElement("animate",{attributeName:"r",begin:"1.5s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-opacity",begin:"1.5s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-width",begin:"1.5s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),o.a.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},o.a.createElement("animate",{attributeName:"r",begin:"3s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-opacity",begin:"3s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),o.a.createElement("animate",{attributeName:"stroke-width",begin:"3s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),o.a.createElement("circle",{cx:"22",cy:"22",r:"8"},o.a.createElement("animate",{attributeName:"r",begin:"0s",dur:"1.5s",values:"6;1;2;3;4;5;6",calcMode:"linear",repeatCount:"indefinite"}))))):null},c=n(10),d={"001ca130":[function(){return n.e(3).then(n.bind(null,57))},"@site/versioned_docs/version-7.0.x/features/endpoints.md",57],"00691219":[function(){return n.e(4).then(n.bind(null,58))},"@site/versioned_docs/version-7.0.x/configuration/tls.md",58],"0721a2c0":[function(){return n.e(5).then(n.bind(null,59))},"@site/versioned_docs/version-7.0.x/installation.md",59],"0f425520":[function(){return n.e(6).then(n.bind(null,60))},"@site/docs/configuration/overview.md",60],17896441:[function(){return Promise.all([n.e(0),n.e(1),n.e(7)]).then(n.bind(null,93))},"@theme/DocItem",93],"1be78505":[function(){return Promise.all([n.e(0),n.e(1),n.e(2),n.e(38)]).then(n.bind(null,94))},"@theme/DocPage",94],"1f391b9e":[function(){return Promise.all([n.e(0),n.e(1),n.e(2),n.e(39)]).then(n.bind(null,64))},"@theme/MDXPage",64],"230aeb34":[function(){return n.e(8).then(n.t.bind(null,65,3))},"~docs/default/version-7-0-x-metadata-prop-4d1.json",65],"35234f08":[function(){return n.e(9).then(n.bind(null,66))},"@site/docs/community/security.md",66],"357fe94d":[function(){return n.e(10).then(n.bind(null,67))},"@site/docs/configuration/auth.md",67],"3b8c55ea":[function(){return n.e(11).then(n.bind(null,68))},"@site/docs/installation.md",68],"3def9002":[function(){return n.e(12).then(n.bind(null,69))},"@site/versioned_docs/version-6.1.x/configuration/auth.md",69],"3fa022c7":[function(){return n.e(13).then(n.bind(null,70))},"@site/versioned_docs/version-7.0.x/configuration/alpha_config.md",70],"42326c77":[function(){return n.e(14).then(n.bind(null,71))},"@site/versioned_docs/version-6.1.x/behaviour.md",71],"585bdad0":[function(){return n.e(15).then(n.bind(null,72))},"@site/docs/configuration/tls.md",72],"5a047177":[function(){return n.e(16).then(n.bind(null,73))},"@site/versioned_docs/version-7.0.x/behaviour.md",73],"6f497b56":[function(){return n.e(17).then(n.bind(null,74))},"@site/versioned_docs/version-6.1.x/features/request_signatures.md",74],"7b04b1d5":[function(){return n.e(18).then(n.bind(null,75))},"@site/versioned_docs/version-6.1.x/installation.md",75],"7dcecc8d":[function(){return n.e(19).then(n.bind(null,76))},"@site/versioned_docs/version-7.0.x/configuration/auth.md",76],"8c826f25":[function(){return n.e(20).then(n.bind(null,77))},"@site/versioned_docs/version-7.0.x/configuration/overview.md",77],"935f2afb":[function(){return n.e(21).then(n.t.bind(null,78,3))},"~docs/default/version-current-metadata-prop-751.json",78],94285305:[function(){return n.e(22).then(n.bind(null,79))},"@site/docs/behaviour.md",79],"9f61b932":[function(){return n.e(23).then(n.bind(null,80))},"@site/docs/configuration/sessions.md",80],a37c03cb:[function(){return n.e(24).then(n.bind(null,81))},"@site/versioned_docs/version-6.1.x/configuration/tls.md",81],a991188b:[function(){return n.e(25).then(n.bind(null,82))},"@site/versioned_docs/version-6.1.x/features/endpoints.md",82],ade45c9a:[function(){return n.e(26).then(n.bind(null,83))},"@site/versioned_docs/version-6.1.x/configuration/overview.md",83],b89e1cb0:[function(){return n.e(27).then(n.bind(null,84))},"@site/versioned_docs/version-7.0.x/features/request_signatures.md",84],be200c4b:[function(){return n.e(28).then(n.t.bind(null,85,3))},"~docs/default/version-6-1-x-metadata-prop-625.json",85],cd4a49c1:[function(){return n.e(29).then(n.bind(null,86))},"@site/docs/configuration/alpha_config.md",86],ea7cbf6d:[function(){return n.e(30).then(n.bind(null,87))},"@site/versioned_docs/version-6.1.x/community/security.md",87],edfc6e1b:[function(){return n.e(31).then(n.bind(null,88))},"@site/versioned_docs/version-7.0.x/configuration/sessions.md",88],efc9be4b:[function(){return n.e(32).then(n.bind(null,89))},"@site/docs/features/endpoints.md",89],f3976560:[function(){return n.e(33).then(n.bind(null,90))},"@site/src/pages/index.md",90],f4c9d322:[function(){return n.e(34).then(n.bind(null,91))},"@site/versioned_docs/version-7.0.x/community/security.md",91],f5839aac:[function(){return n.e(35).then(n.bind(null,92))},"@site/versioned_docs/version-6.1.x/configuration/sessions.md",92]};var f=function(e){var t={};return function e(n,r){Object.keys(n).forEach((function(o){var a=n[o],i=r?r+"."+o:o;"object"===typeof a&&!!a&&Object.keys(a).length?e(a,i):t[i]=a}))}(e),t};var p=function(e,t){if("*"===e)return u()({loading:s,loader:function(){return Promise.all([n.e(0),n.e(1),n.e(2),n.e(40)]).then(n.bind(null,113))}});var r=c[e+"-"+t],a=[],i=[],l={},p=f(r);return Object.keys(p).forEach((function(e){var t=d[p[e]];t&&(l[e]=t[0],a.push(t[1]),i.push(t[2]))})),u.a.Map({loading:s,loader:l,modules:a,webpack:function(){return i},render:function(e,t){var n=JSON.parse(JSON.stringify(r));Object.keys(e).forEach((function(t){for(var r=n,o=t.split("."),a=0;a<o.length-1;a+=1)r=r[o[a]];r[o[o.length-1]]=e[t].default;var i=Object.keys(e[t]).filter((function(e){return"default"!==e}));i&&i.length&&i.forEach((function(n){r[o[o.length-1]][n]=e[t][n]}))}));var a=n.component;return delete n.component,o.a.createElement(a,Object.assign({},n,t))}})},m=[{path:"/oauth2-proxy/",component:p("/oauth2-proxy/","4c3"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x",component:p("/oauth2-proxy/docs/6.1.x","b03"),routes:[{path:"/oauth2-proxy/docs/6.1.x/",component:p("/oauth2-proxy/docs/6.1.x/","574"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/behaviour",component:p("/oauth2-proxy/docs/6.1.x/behaviour","bbe"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/community/security",component:p("/oauth2-proxy/docs/6.1.x/community/security","9f3"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider",component:p("/oauth2-proxy/docs/6.1.x/configuration/oauth_provider","a82"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/overview",component:p("/oauth2-proxy/docs/6.1.x/configuration/overview","e4e"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/session_storage",component:p("/oauth2-proxy/docs/6.1.x/configuration/session_storage","2f9"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/configuration/tls",component:p("/oauth2-proxy/docs/6.1.x/configuration/tls","ece"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/features/endpoints",component:p("/oauth2-proxy/docs/6.1.x/features/endpoints","c39"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x/features/request_signatures",component:p("/oauth2-proxy/docs/6.1.x/features/request_signatures","d6c"),exact:!0}]},{path:"/oauth2-proxy/docs/next",component:p("/oauth2-proxy/docs/next","434"),routes:[{path:"/oauth2-proxy/docs/next/",component:p("/oauth2-proxy/docs/next/","9e9"),exact:!0},{path:"/oauth2-proxy/docs/next/behaviour",component:p("/oauth2-proxy/docs/next/behaviour","8be"),exact:!0},{path:"/oauth2-proxy/docs/next/community/security",component:p("/oauth2-proxy/docs/next/community/security","166"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/alpha-config",component:p("/oauth2-proxy/docs/next/configuration/alpha-config","85d"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/oauth_provider",component:p("/oauth2-proxy/docs/next/configuration/oauth_provider","2fc"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/overview",component:p("/oauth2-proxy/docs/next/configuration/overview","613"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/session_storage",component:p("/oauth2-proxy/docs/next/configuration/session_storage","683"),exact:!0},{path:"/oauth2-proxy/docs/next/configuration/tls",component:p("/oauth2-proxy/docs/next/configuration/tls","2d0"),exact:!0},{path:"/oauth2-proxy/docs/next/features/endpoints",component:p("/oauth2-proxy/docs/next/features/endpoints","e4a"),exact:!0}]},{path:"/oauth2-proxy/docs",component:p("/oauth2-proxy/docs","5d5"),routes:[{path:"/oauth2-proxy/docs/",component:p("/oauth2-proxy/docs/","e44"),exact:!0},{path:"/oauth2-proxy/docs/behaviour",component:p("/oauth2-proxy/docs/behaviour","64e"),exact:!0},{path:"/oauth2-proxy/docs/community/security",component:p("/oauth2-proxy/docs/community/security","8ab"),exact:!0},{path:"/oauth2-proxy/docs/configuration/alpha-config",component:p("/oauth2-proxy/docs/configuration/alpha-config","0f1"),exact:!0},{path:"/oauth2-proxy/docs/configuration/oauth_provider",component:p("/oauth2-proxy/docs/configuration/oauth_provider","eca"),exact:!0},{path:"/oauth2-proxy/docs/configuration/overview",component:p("/oauth2-proxy/docs/configuration/overview","f23"),exact:!0},{path:"/oauth2-proxy/docs/configuration/session_storage",component:p("/oauth2-proxy/docs/configuration/session_storage","0fa"),exact:!0},{path:"/oauth2-proxy/docs/configuration/tls",component:p("/oauth2-proxy/docs/configuration/tls","44d"),exact:!0},{path:"/oauth2-proxy/docs/features/endpoints",component:p("/oauth2-proxy/docs/features/endpoints","8f1"),exact:!0},{path:"/oauth2-proxy/docs/features/request_signatures",component:p("/oauth2-proxy/docs/features/request_signatures","7a6"),exact:!0}]},{path:"*",component:p("*")}],h=n(9),g=n(11),v=n(26),y=n(27),b=n(22),w=n(24),x=n(3),k=n(1),E=n(12),S=n.n(E),T=[n(15),n(15),n(15),n(39),n(46),n(43)];function _(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];T.forEach((function(t){var r,o,a=null!==(o=null===(r=null==t?void 0:t.default)||void 0===r?void 0:r[e])&&void 0!==o?o:t[e];a&&a.apply(void 0,n)}))}var C={onRouteUpdate:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];_.apply(void 0,["onRouteUpdate"].concat(t))},onRouteUpdateDelayed:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];_.apply(void 0,["onRouteUpdateDelayed"].concat(t))}},O=n(8);function P(e,t){var n=Object(O.a)(e,t);return Promise.all(n.map((function(e){var t=e.route.component;if(t&&t.preload)return t.preload()})))}var R={};var A=function(e){if(R[e.pathname])return Object.assign(Object.assign({},e),{pathname:R[e.pathname]});var t=e.pathname||"/";return""===(t=t.trim().replace(/\/index\.html$/,""))&&(t="/"),R[e.pathname]=t,Object.assign(Object.assign({},e),{pathname:t})};n(44);S.a.configure({showSpinner:!1});var N=function(e){function t(t){var n;return(n=e.call(this,t)||this).previousLocation=null,n.progressBarTimeout=null,n.state={nextRouteHasLoaded:!0},n}Object(x.a)(t,e);var n=t.prototype;return n.shouldComponentUpdate=function(e,t){var n=this,r=e.location!==this.props.location,o=this.props,a=o.routes,i=o.delay,l=void 0===i?1e3:i;if(r){var u=A(e.location);return this.startProgressBar(l),this.previousLocation=A(this.props.location),this.setState({nextRouteHasLoaded:!1}),P(a,u.pathname).then((function(){C.onRouteUpdate({previousLocation:n.previousLocation,location:u}),n.previousLocation=null,n.setState({nextRouteHasLoaded:!0},n.stopProgressBar);var e=u.hash;if(e){var t=e.substring(1),r=document.getElementById(t);r&&r.scrollIntoView()}else window.scrollTo(0,0)})).catch((function(e){return console.warn(e)})),!1}return!!t.nextRouteHasLoaded},n.clearProgressBarTimeout=function(){this.progressBarTimeout&&(clearTimeout(this.progressBarTimeout),this.progressBarTimeout=null)},n.startProgressBar=function(e){var t=this;this.clearProgressBarTimeout(),this.progressBarTimeout=setTimeout((function(){C.onRouteUpdateDelayed({location:A(t.props.location)}),S.a.start()}),e)},n.stopProgressBar=function(){this.clearProgressBarTimeout(),S.a.done()},n.render=function(){var e=this.props,t=e.children,n=e.location;return o.a.createElement(k.d,{location:A(n),render:function(){return t}})},t}(o.a.Component),I=Object(k.o)(N);var L=function(){var e=Object(r.useState)(!1),t=e[0],n=e[1];return Object(r.useEffect)((function(){n(!0)}),[]),o.a.createElement(w.a.Provider,{value:{siteConfig:g.a,siteMetadata:y,globalData:v,isClient:t}},o.a.createElement(I,{routes:m},Object(b.a)(m)))};var D=function(e){if("undefined"==typeof document)return!1;var t=document.createElement("link");try{if(t.relList&&"function"==typeof t.relList.supports)return t.relList.supports(e)}catch(n){return!1}return!1}("prefetch")?function(e){return new Promise((function(t,n){if("undefined"!=typeof document){var r=document.createElement("link");r.setAttribute("rel","prefetch"),r.setAttribute("href",e),r.onload=t,r.onerror=n,(document.getElementsByTagName("head")[0]||document.getElementsByName("script")[0].parentNode).appendChild(r)}else n()}))}:function(e){return new Promise((function(t,n){var r=new XMLHttpRequest;r.open("GET",e,!0),r.withCredentials=!0,r.onload=function(){200===r.status?t():n()},r.send(null)}))},j={};var F=function(e){return new Promise((function(t){j[e]?t():D(e).then((function(){t(),j[e]=!0})).catch((function(){}))}))},M={},z={},U=function(){return!(!("connection"in navigator)||-1===(navigator.connection.effectiveType||"").indexOf("2g")||!navigator.connection.saveData)},$={prefetch:function(e){return!!function(e){return!U()&&!z[e]&&!M[e]}(e)&&(M[e]=!0,Object(O.a)(m,e).reduce((function(e,t){var n=c[t.route.path];if(!n)return e;var r=Object.values(f(n));return e.concat(r)}),[]).forEach((function(e){var t=n.gca(e);t&&!/undefined/.test(t)&&F(t)})),!0)},preload:function(e){return!!function(e){return!U()&&!z[e]}(e)&&(z[e]=!0,P(m,e),!0)}};if(h.a.canUseDOM){window.docusaurus=$;var B=a.hydrate;P(m,window.location.pathname).then((function(){B(o.a.createElement(i.a,null,o.a.createElement(L,null)),document.getElementById("__docusaurus"))}))}},function(e,t,n){"use strict";n.r(t);var r=n(20),o=n(9),a=n(11);(function(e){if(o.a.canUseDOM){var t=a.a.themeConfig.prism,r=(t=void 0===t?{}:t).additionalLanguages,i=void 0===r?[]:r;window.Prism=e,i.forEach((function(e){n(16)("./prism-"+e)})),delete window.Prism}})(r.a)}],[[30,37,0]]]);
\ No newline at end of file
diff --git a/main.02092c2d.js.LICENSE.txt b/main.ff464f14.js.LICENSE.txt
similarity index 100%
rename from main.02092c2d.js.LICENSE.txt
rename to main.ff464f14.js.LICENSE.txt
diff --git a/runtime~main.4b63b5ec.js b/runtime~main.4b63b5ec.js
deleted file mode 100644
index ec38a5a5..00000000
--- a/runtime~main.4b63b5ec.js
+++ /dev/null
@@ -1 +0,0 @@
-!function(e){function c(c){for(var a,f,o=c[0],b=c[1],d=c[2],u=0,l=[];u<o.length;u++)f=o[u],Object.prototype.hasOwnProperty.call(t,f)&&t[f]&&l.push(t[f][0]),t[f]=0;for(a in b)Object.prototype.hasOwnProperty.call(b,a)&&(e[a]=b[a]);for(i&&i(c);l.length;)l.shift()();return n.push.apply(n,d||[]),r()}function r(){for(var e,c=0;c<n.length;c++){for(var r=n[c],a=!0,f=1;f<r.length;f++){var b=r[f];0!==t[b]&&(a=!1)}a&&(n.splice(c--,1),e=o(o.s=r[0]))}return e}var a={},t={38:0},n=[];function f(e){return o.p+""+({3:"001ca130",4:"00691219",5:"0721a2c0",6:"0f425520",7:"17896441",8:"230aeb34",9:"35234f08",10:"357fe94d",11:"3b8c55ea",12:"3def9002",13:"3fa022c7",14:"42326c77",15:"585bdad0",16:"5a047177",17:"6f497b56",18:"7b04b1d5",19:"7dcecc8d",20:"8c826f25",21:"935f2afb",22:"94285305",23:"9f61b932",24:"a37c03cb",25:"a991188b",26:"ade45c9a",27:"b5649f1e",28:"b89e1cb0",29:"be200c4b",30:"cd4a49c1",31:"ea7cbf6d",32:"edfc6e1b",33:"efc9be4b",34:"f3976560",35:"f4c9d322",36:"f5839aac"}[e]||e)+"."+{1:"6bed8819",2:"f73f779a",3:"864ff6c9",4:"5a332c9c",5:"c40b0d06",6:"6e17044c",7:"2c25168c",8:"b0a8f7b9",9:"540f1aca",10:"f0a0c172",11:"1396475e",12:"8829538f",13:"2a08f900",14:"09a0e8e4",15:"2c674a88",16:"05c93143",17:"ffc09987",18:"49cea530",19:"1a244b07",20:"19b6a6ee",21:"86ec86d4",22:"c1f11fb3",23:"52eb58d3",24:"cb23f5eb",25:"3c713607",26:"0673a20d",27:"3a95cf7b",28:"3196bbbd",29:"0ad1e075",30:"8ba23d44",31:"51c5dea8",32:"4df93a8a",33:"4d539956",34:"5b30cd66",35:"ee82cb40",36:"d42acf97",39:"6bb7dda7",40:"24f08f88",41:"2d80f77f"}[e]+".js"}function o(c){if(a[c])return a[c].exports;var r=a[c]={i:c,l:!1,exports:{}};return e[c].call(r.exports,r,r.exports,o),r.l=!0,r.exports}o.e=function(e){var c=[],r=t[e];if(0!==r)if(r)c.push(r[2]);else{var a=new Promise((function(c,a){r=t[e]=[c,a]}));c.push(r[2]=a);var n,b=document.createElement("script");b.charset="utf-8",b.timeout=120,o.nc&&b.setAttribute("nonce",o.nc),b.src=f(e);var d=new Error;n=function(c){b.onerror=b.onload=null,clearTimeout(u);var r=t[e];if(0!==r){if(r){var a=c&&("load"===c.type?"missing":c.type),n=c&&c.target&&c.target.src;d.message="Loading chunk "+e+" failed.\n("+a+": "+n+")",d.name="ChunkLoadError",d.type=a,d.request=n,r[1](d)}t[e]=void 0}};var u=setTimeout((function(){n({type:"timeout",target:b})}),12e4);b.onerror=b.onload=n,document.head.appendChild(b)}return Promise.all(c)},o.m=e,o.c=a,o.d=function(e,c,r){o.o(e,c)||Object.defineProperty(e,c,{enumerable:!0,get:r})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,c){if(1&c&&(e=o(e)),8&c)return e;if(4&c&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(o.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&c&&"string"!=typeof e)for(var a in e)o.d(r,a,function(c){return e[c]}.bind(null,a));return r},o.n=function(e){var c=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(c,"a",c),c},o.o=function(e,c){return Object.prototype.hasOwnProperty.call(e,c)},o.p="/oauth2-proxy/",o.gca=function(e){return f(e={17896441:"7",94285305:"22","001ca130":"3","00691219":"4","0721a2c0":"5","0f425520":"6","230aeb34":"8","35234f08":"9","357fe94d":"10","3b8c55ea":"11","3def9002":"12","3fa022c7":"13","42326c77":"14","585bdad0":"15","5a047177":"16","6f497b56":"17","7b04b1d5":"18","7dcecc8d":"19","8c826f25":"20","935f2afb":"21","9f61b932":"23",a37c03cb:"24",a991188b:"25",ade45c9a:"26",b5649f1e:"27",b89e1cb0:"28",be200c4b:"29",cd4a49c1:"30",ea7cbf6d:"31",edfc6e1b:"32",efc9be4b:"33",f3976560:"34",f4c9d322:"35",f5839aac:"36"}[e]||e)},o.oe=function(e){throw console.error(e),e};var b=window.webpackJsonp=window.webpackJsonp||[],d=b.push.bind(b);b.push=c,b=b.slice();for(var u=0;u<b.length;u++)c(b[u]);var i=d;r()}([]);
\ No newline at end of file
diff --git a/runtime~main.b90e804b.js b/runtime~main.b90e804b.js
new file mode 100644
index 00000000..aebd0190
--- /dev/null
+++ b/runtime~main.b90e804b.js
@@ -0,0 +1 @@
+!function(e){function r(r){for(var c,f,o=r[0],b=r[1],d=r[2],u=0,l=[];u<o.length;u++)f=o[u],Object.prototype.hasOwnProperty.call(t,f)&&t[f]&&l.push(t[f][0]),t[f]=0;for(c in b)Object.prototype.hasOwnProperty.call(b,c)&&(e[c]=b[c]);for(i&&i(r);l.length;)l.shift()();return n.push.apply(n,d||[]),a()}function a(){for(var e,r=0;r<n.length;r++){for(var a=n[r],c=!0,f=1;f<a.length;f++){var b=a[f];0!==t[b]&&(c=!1)}c&&(n.splice(r--,1),e=o(o.s=a[0]))}return e}var c={},t={37:0},n=[];function f(e){return o.p+""+({3:"001ca130",4:"00691219",5:"0721a2c0",6:"0f425520",7:"17896441",8:"230aeb34",9:"35234f08",10:"357fe94d",11:"3b8c55ea",12:"3def9002",13:"3fa022c7",14:"42326c77",15:"585bdad0",16:"5a047177",17:"6f497b56",18:"7b04b1d5",19:"7dcecc8d",20:"8c826f25",21:"935f2afb",22:"94285305",23:"9f61b932",24:"a37c03cb",25:"a991188b",26:"ade45c9a",27:"b89e1cb0",28:"be200c4b",29:"cd4a49c1",30:"ea7cbf6d",31:"edfc6e1b",32:"efc9be4b",33:"f3976560",34:"f4c9d322",35:"f5839aac"}[e]||e)+"."+{1:"07b9992e",2:"cd1a0941",3:"e0bd119c",4:"947d552d",5:"31d87bed",6:"f6f59f9b",7:"8a8027b4",8:"b0a8f7b9",9:"b5c25545",10:"283fb6a4",11:"8319a862",12:"32c43efe",13:"f2bf9899",14:"cbfbbe21",15:"ccaae809",16:"4377cd87",17:"a16212fe",18:"6efeb7d7",19:"818ddd0c",20:"cf4971b6",21:"b9b6fa4f",22:"c77ada9e",23:"18ede719",24:"cd2174f2",25:"462763a5",26:"6b8ce017",27:"4d7a9b41",28:"2b4796e9",29:"6b38e80e",30:"ef6dfe15",31:"b4905114",32:"9410a42e",33:"c5ee70f7",34:"8594a982",35:"a11a203a",38:"f7098cec",39:"a8bc1f06",40:"6add7124"}[e]+".js"}function o(r){if(c[r])return c[r].exports;var a=c[r]={i:r,l:!1,exports:{}};return e[r].call(a.exports,a,a.exports,o),a.l=!0,a.exports}o.e=function(e){var r=[],a=t[e];if(0!==a)if(a)r.push(a[2]);else{var c=new Promise((function(r,c){a=t[e]=[r,c]}));r.push(a[2]=c);var n,b=document.createElement("script");b.charset="utf-8",b.timeout=120,o.nc&&b.setAttribute("nonce",o.nc),b.src=f(e);var d=new Error;n=function(r){b.onerror=b.onload=null,clearTimeout(u);var a=t[e];if(0!==a){if(a){var c=r&&("load"===r.type?"missing":r.type),n=r&&r.target&&r.target.src;d.message="Loading chunk "+e+" failed.\n("+c+": "+n+")",d.name="ChunkLoadError",d.type=c,d.request=n,a[1](d)}t[e]=void 0}};var u=setTimeout((function(){n({type:"timeout",target:b})}),12e4);b.onerror=b.onload=n,document.head.appendChild(b)}return Promise.all(r)},o.m=e,o.c=c,o.d=function(e,r,a){o.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:a})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,r){if(1&r&&(e=o(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var a=Object.create(null);if(o.r(a),Object.defineProperty(a,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var c in e)o.d(a,c,function(r){return e[r]}.bind(null,c));return a},o.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(r,"a",r),r},o.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},o.p="/oauth2-proxy/",o.gca=function(e){return f(e={17896441:"7",94285305:"22","001ca130":"3","00691219":"4","0721a2c0":"5","0f425520":"6","230aeb34":"8","35234f08":"9","357fe94d":"10","3b8c55ea":"11","3def9002":"12","3fa022c7":"13","42326c77":"14","585bdad0":"15","5a047177":"16","6f497b56":"17","7b04b1d5":"18","7dcecc8d":"19","8c826f25":"20","935f2afb":"21","9f61b932":"23",a37c03cb:"24",a991188b:"25",ade45c9a:"26",b89e1cb0:"27",be200c4b:"28",cd4a49c1:"29",ea7cbf6d:"30",edfc6e1b:"31",efc9be4b:"32",f3976560:"33",f4c9d322:"34",f5839aac:"35"}[e]||e)},o.oe=function(e){throw console.error(e),e};var b=window.webpackJsonp=window.webpackJsonp||[],d=b.push.bind(b);b.push=r,b=b.slice();for(var u=0;u<b.length;u++)r(b[u]);var i=d;a()}([]);
\ No newline at end of file
diff --git a/sitemap.xml b/sitemap.xml
index 1790fb3b..15a8bbae 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -1 +1 @@
-<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:news="http://www.google.com/schemas/sitemap-news/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:mobile="http://www.google.com/schemas/sitemap-mobile/1.0" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1" xmlns:video="http://www.google.com/schemas/sitemap-video/1.1"><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/request_signatures</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/features/request_signatures</loc><changefreq>weekly</changefreq><priority>0.5</priority></url></urlset>
\ No newline at end of file
+<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:news="http://www.google.com/schemas/sitemap-news/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:mobile="http://www.google.com/schemas/sitemap-mobile/1.0" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1" xmlns:video="http://www.google.com/schemas/sitemap-video/1.1"><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints</loc><changefreq>weekly</changefreq><priority>0.5</priority></url><url><loc>https://oauth2-proxy.github.io/oauth2-proxy/docs/features/request_signatures</loc><changefreq>weekly</changefreq><priority>0.5</priority></url></urlset>
\ No newline at end of file