diff --git a/404.html b/404.html
index 3a306633..a024e3f3 100644
--- a/404.html
+++ b/404.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Page Not Found | OAuth2 Proxy</title><meta data-react-helmet="true" property="og:title" content="Page Not Found | OAuth2 Proxy"><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/404.html"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_tag" content="default"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/404.html"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/404.html" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/404.html" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/">7.3.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper"><main class="container margin-vert--xl"><div class="row"><div class="col col--6 col--offset-3"><h1 class="hero__title">Page Not Found</h1><p>We could not find what you were looking for.</p><p>Please contact the owner of the site that linked you to the original URL and let them know their link is broken.</p></div></div></main></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/assets/js/357fe94d.5f902a23.js b/assets/js/357fe94d.5f902a23.js
new file mode 100644
index 00000000..86e3f795
--- /dev/null
+++ b/assets/js/357fe94d.5f902a23.js
@@ -0,0 +1 @@
+"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[9267],{3905:function(e,t,o){o.d(t,{Zo:function(){return c},kt:function(){return h}});var a=o(7294);function n(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}function r(e,t){var o=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),o.push.apply(o,a)}return o}function i(e){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{};t%2?r(Object(o),!0).forEach((function(t){n(e,t,o[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(o)):r(Object(o)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(o,t))}))}return e}function l(e,t){if(null==e)return{};var o,a,n=function(e,t){if(null==e)return{};var o,a,n={},r=Object.keys(e);for(a=0;a<r.length;a++)o=r[a],t.indexOf(o)>=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a<r.length;a++)o=r[a],t.indexOf(o)>=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},c=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||u[h]||r;return o?a.createElement(m,i(i({ref:t},c),{},{components:o})):a.createElement(m,i({ref:t},c))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s<r;s++)i[s]=o[s];return a.createElement.apply(null,i)}return a.createElement.apply(null,o)}d.displayName="MDXCreateElement"},3647:function(e,t,o){o.r(t),o.d(t,{frontMatter:function(){return l},contentTitle:function(){return p},metadata:function(){return s},toc:function(){return c},default:function(){return d}});var a=o(7462),n=o(3366),r=(o(7294),o(3905)),i=["components"],l={id:"oauth_provider",title:"OAuth Provider Configuration"},p=void 0,s={unversionedId:"configuration/oauth_provider",id:"configuration/oauth_provider",title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/docs/configuration/auth.md",sourceDirName:"configuration",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md",tags:[],version:"current",frontMatter:{id:"oauth_provider",title:"OAuth Provider Configuration"},sidebar:"docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/next/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[{value:"Restrict auth to specific Google groups on your domain. (optional)",id:"restrict-auth-to-specific-google-groups-on-your-domain-optional",children:[],level:4}],level:3},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[],level:3},{value:"ADFS Auth Provider",id:"adfs-auth-provider",children:[],level:3},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[],level:3},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[],level:3},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[],level:3},{value:"Keycloak OIDC Auth Provider",id:"keycloak-oidc-auth-provider",children:[],level:3},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[],level:3},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[],level:3},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[],level:3},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[{value:"Dex",id:"dex",children:[],level:4},{value:"Okta",id:"okta",children:[],level:4},{value:"Okta - localhost",id:"okta---localhost",children:[],level:4}],level:3},{value:"login.gov Provider",id:"logingov-provider",children:[{value:"Skip OIDC discovery",id:"skip-oidc-discovery",children:[],level:4}],level:3},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[],level:3},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[],level:3},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[],level:3},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[],level:3},{value:"Email Authentication",id:"email-authentication",children:[],level:2},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[],level:2}],u={toc:c};function d(e){var t=e.components,o=(0,n.Z)(e,i);return(0,r.kt)("wrapper",(0,a.Z)({},u,o,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),(0,r.kt)("p",null,"Valid providers are :"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#google-auth-provider"},"Google")," ",(0,r.kt)("em",{parentName:"li"},"default")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#azure-auth-provider"},"Azure")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#adfs-auth-provider"},"ADFS")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#facebook-auth-provider"},"Facebook")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#github-auth-provider"},"GitHub")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#keycloak-auth-provider"},"Keycloak")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#gitlab-auth-provider"},"GitLab")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#linkedin-auth-provider"},"LinkedIn")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#microsoft-azure-ad-provider"},"Microsoft Azure AD")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#openid-connect-provider"},"OpenID Connect")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#logingov-provider"},"login.gov")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#nextcloud-provider"},"Nextcloud")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#digitalocean-auth-provider"},"DigitalOcean")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#bitbucket-auth-provider"},"Bitbucket")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#gitea-auth-provider"},"Gitea"))),(0,r.kt)("p",null,"The provider can be selected using the ",(0,r.kt)("inlineCode",{parentName:"p"},"provider")," configuration value."),(0,r.kt)("p",null,"Please note that not all providers support all claims. The ",(0,r.kt)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),(0,r.kt)("h3",{id:"google-auth-provider"},"Google Auth Provider"),(0,r.kt)("p",null,"For Google, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://console.developers.google.com/project"},"https://console.developers.google.com/project")),(0,r.kt)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),(0,r.kt)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"API Manager"')),(0,r.kt)("li",{parentName:"ol"},"In the left Nav pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"Credentials"')),(0,r.kt)("li",{parentName:"ol"},"In the center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",(0,r.kt)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),(0,r.kt)("li",{parentName:"ol"},"In the center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"Credentials"')," tab.",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Open the ",(0,r.kt)("strong",{parentName:"li"},'"New credentials"')," drop down"),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"OAuth client ID"')),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"Web application"')),(0,r.kt)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),(0,r.kt)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),(0,r.kt)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"Create"')))),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Client ID")," and ",(0,r.kt)("strong",{parentName:"li"},"Client Secret"))),(0,r.kt)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),(0,r.kt)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a service account: ",(0,r.kt)("a",{parentName:"li",href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"},"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),(0,r.kt)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),(0,r.kt)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),(0,r.kt)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),(0,r.kt)("li",{parentName:"ol"},"Follow the steps on ",(0,r.kt)("a",{parentName:"li",href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"},"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),(0,r.kt)("ol",{start:6},(0,r.kt)("li",{parentName:"ol"},"Follow the steps on ",(0,r.kt)("a",{parentName:"li",href:"https://support.google.com/a/answer/60757"},"https://support.google.com/a/answer/60757")," to enable Admin API access."),(0,r.kt)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),(0,r.kt)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),(0,r.kt)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),(0,r.kt)("li",{parentName:"ol"},"Restart oauth2-proxy.")),(0,r.kt)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),(0,r.kt)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Add an application: go to ",(0,r.kt)("a",{parentName:"li",href:"https://portal.azure.com"},"https://portal.azure.com"),", choose ",(0,r.kt)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",(0,r.kt)("strong",{parentName:"li"},'"App registrations"')," and then click on ",(0,r.kt)("strong",{parentName:"li"},'"New app registration"'),"."),(0,r.kt)("li",{parentName:"ol"},"Pick a name and choose ",(0,r.kt)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",(0,r.kt)("strong",{parentName:"li"},'"Create"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",(0,r.kt)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"API Permissions"')," page of the app, click on ",(0,r.kt)("strong",{parentName:"li"},'"Add a permission"'),", then select ",(0,r.kt)("strong",{parentName:"li"},'"Microsoft Graph"'),", then ",(0,r.kt)("strong",{parentName:"li"},'"Delegated permissions"')," and finally check the ",(0,r.kt)("strong",{parentName:"li"},'"openid (Sign users in)"')," permission. Hit ",(0,r.kt)("strong",{parentName:"li"},'"Save"')," and then on ",(0,r.kt)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this).",(0,r.kt)("br",null),'**IMPORTANT**: Even if this permission is listed with **"Admin consent required=No"** the consent might actually be required, due to AAD policies you won\'t be able to see. If you get a **"Need admin approval"** during login, most likely this is what you\'re missing!'),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=azure\n --client-id=<application ID from step 3>\n --client-secret=<value from step 6>\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),(0,r.kt)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),(0,r.kt)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=adfs\n --client-id=<application ID from step 3>\n --client-secret=<value from step 3>\n")),(0,r.kt)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",(0,r.kt)("a",{parentName:"p",href:"#keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider")," if possible."))),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider=keycloak\n --client-id=<client you have created>\n --client-secret=<your client\'s secret>\n --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"\n --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"\n --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n --keycloak-group=<first_allowed_user_group>\n --keycloak-group=<second_allowed_user_group>\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental', ",(0,r.kt)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," and ",(0,r.kt)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=keycloak-oidc\n --client-id=<your client's id>\n --client-secret=<your client's secret>\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>\n --allowed-role=<realm role name> // Optional, required realm role\n --allowed-role=<client id>:<client role name> // Optional, required client role\n")),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url="<your gitlab url>"\n')),(0,r.kt)("p",null,"If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth."),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id <from nextcloud admin>\n -client-secret <from nextcloud admin>\n -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=<Client ID>\n --client-secret=<Client Secret>\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=<Client ID>\n --client-secret=<Client Secret>\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https://<proxied host>/oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]);
\ No newline at end of file
diff --git a/assets/js/357fe94d.ae9d55f6.js b/assets/js/357fe94d.ae9d55f6.js
deleted file mode 100644
index 0b986951..00000000
--- a/assets/js/357fe94d.ae9d55f6.js
+++ /dev/null
@@ -1 +0,0 @@
-"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[9267],{3905:function(e,t,o){o.d(t,{Zo:function(){return c},kt:function(){return h}});var a=o(7294);function n(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}function r(e,t){var o=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),o.push.apply(o,a)}return o}function i(e){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{};t%2?r(Object(o),!0).forEach((function(t){n(e,t,o[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(o)):r(Object(o)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(o,t))}))}return e}function l(e,t){if(null==e)return{};var o,a,n=function(e,t){if(null==e)return{};var o,a,n={},r=Object.keys(e);for(a=0;a<r.length;a++)o=r[a],t.indexOf(o)>=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a<r.length;a++)o=r[a],t.indexOf(o)>=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},c=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||u[h]||r;return o?a.createElement(m,i(i({ref:t},c),{},{components:o})):a.createElement(m,i({ref:t},c))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s<r;s++)i[s]=o[s];return a.createElement.apply(null,i)}return a.createElement.apply(null,o)}d.displayName="MDXCreateElement"},3647:function(e,t,o){o.r(t),o.d(t,{frontMatter:function(){return l},contentTitle:function(){return p},metadata:function(){return s},toc:function(){return c},default:function(){return d}});var a=o(7462),n=o(3366),r=(o(7294),o(3905)),i=["components"],l={id:"oauth_provider",title:"OAuth Provider Configuration"},p=void 0,s={unversionedId:"configuration/oauth_provider",id:"configuration/oauth_provider",title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/docs/configuration/auth.md",sourceDirName:"configuration",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md",tags:[],version:"current",frontMatter:{id:"oauth_provider",title:"OAuth Provider Configuration"},sidebar:"docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/next/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/next/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[{value:"Restrict auth to specific Google groups on your domain. (optional)",id:"restrict-auth-to-specific-google-groups-on-your-domain-optional",children:[],level:4}],level:3},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[],level:3},{value:"ADFS Auth Provider",id:"adfs-auth-provider",children:[],level:3},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[],level:3},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[],level:3},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[],level:3},{value:"Keycloak OIDC Auth Provider",id:"keycloak-oidc-auth-provider",children:[],level:3},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[],level:3},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[],level:3},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[],level:3},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[{value:"Dex",id:"dex",children:[],level:4},{value:"Okta",id:"okta",children:[],level:4},{value:"Okta - localhost",id:"okta---localhost",children:[],level:4}],level:3},{value:"login.gov Provider",id:"logingov-provider",children:[{value:"Skip OIDC discovery",id:"skip-oidc-discovery",children:[],level:4}],level:3},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[],level:3},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[],level:3},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[],level:3},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[],level:3},{value:"Email Authentication",id:"email-authentication",children:[],level:2},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[],level:2}],u={toc:c};function d(e){var t=e.components,o=(0,n.Z)(e,i);return(0,r.kt)("wrapper",(0,a.Z)({},u,o,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),(0,r.kt)("p",null,"Valid providers are :"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#google-auth-provider"},"Google")," ",(0,r.kt)("em",{parentName:"li"},"default")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#azure-auth-provider"},"Azure")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#adfs-auth-provider"},"ADFS")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#facebook-auth-provider"},"Facebook")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#github-auth-provider"},"GitHub")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#keycloak-auth-provider"},"Keycloak")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#gitlab-auth-provider"},"GitLab")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#linkedin-auth-provider"},"LinkedIn")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#microsoft-azure-ad-provider"},"Microsoft Azure AD")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#openid-connect-provider"},"OpenID Connect")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#logingov-provider"},"login.gov")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#nextcloud-provider"},"Nextcloud")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#digitalocean-auth-provider"},"DigitalOcean")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#bitbucket-auth-provider"},"Bitbucket")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#gitea-auth-provider"},"Gitea"))),(0,r.kt)("p",null,"The provider can be selected using the ",(0,r.kt)("inlineCode",{parentName:"p"},"provider")," configuration value."),(0,r.kt)("p",null,"Please note that not all providers support all claims. The ",(0,r.kt)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),(0,r.kt)("h3",{id:"google-auth-provider"},"Google Auth Provider"),(0,r.kt)("p",null,"For Google, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://console.developers.google.com/project"},"https://console.developers.google.com/project")),(0,r.kt)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),(0,r.kt)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"API Manager"')),(0,r.kt)("li",{parentName:"ol"},"In the left Nav pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"Credentials"')),(0,r.kt)("li",{parentName:"ol"},"In the center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",(0,r.kt)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),(0,r.kt)("li",{parentName:"ol"},"In the center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"Credentials"')," tab.",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Open the ",(0,r.kt)("strong",{parentName:"li"},'"New credentials"')," drop down"),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"OAuth client ID"')),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"Web application"')),(0,r.kt)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),(0,r.kt)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),(0,r.kt)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"Create"')))),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Client ID")," and ",(0,r.kt)("strong",{parentName:"li"},"Client Secret"))),(0,r.kt)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),(0,r.kt)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a service account: ",(0,r.kt)("a",{parentName:"li",href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"},"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),(0,r.kt)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),(0,r.kt)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),(0,r.kt)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),(0,r.kt)("li",{parentName:"ol"},"Follow the steps on ",(0,r.kt)("a",{parentName:"li",href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"},"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),(0,r.kt)("ol",{start:6},(0,r.kt)("li",{parentName:"ol"},"Follow the steps on ",(0,r.kt)("a",{parentName:"li",href:"https://support.google.com/a/answer/60757"},"https://support.google.com/a/answer/60757")," to enable Admin API access."),(0,r.kt)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),(0,r.kt)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),(0,r.kt)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),(0,r.kt)("li",{parentName:"ol"},"Restart oauth2-proxy.")),(0,r.kt)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),(0,r.kt)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Add an application: go to ",(0,r.kt)("a",{parentName:"li",href:"https://portal.azure.com"},"https://portal.azure.com"),", choose ",(0,r.kt)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",(0,r.kt)("strong",{parentName:"li"},'"App registrations"')," and then click on ",(0,r.kt)("strong",{parentName:"li"},'"New app registration"'),"."),(0,r.kt)("li",{parentName:"ol"},"Pick a name and choose ",(0,r.kt)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",(0,r.kt)("strong",{parentName:"li"},'"Create"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",(0,r.kt)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",(0,r.kt)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",(0,r.kt)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",(0,r.kt)("strong",{parentName:"li"},'"Save"')," and then then on ",(0,r.kt)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=azure\n --client-id=<application ID from step 3>\n --client-secret=<value from step 6>\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),(0,r.kt)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),(0,r.kt)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=adfs\n --client-id=<application ID from step 3>\n --client-secret=<value from step 3>\n")),(0,r.kt)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",(0,r.kt)("a",{parentName:"p",href:"#keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider")," if possible."))),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider=keycloak\n --client-id=<client you have created>\n --client-secret=<your client\'s secret>\n --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"\n --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"\n --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n --keycloak-group=<first_allowed_user_group>\n --keycloak-group=<second_allowed_user_group>\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental', ",(0,r.kt)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," and ",(0,r.kt)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=keycloak-oidc\n --client-id=<your client's id>\n --client-secret=<your client's secret>\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>\n --allowed-role=<realm role name> // Optional, required realm role\n --allowed-role=<client id>:<client role name> // Optional, required client role\n")),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url="<your gitlab url>"\n')),(0,r.kt)("p",null,"If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth."),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id <from nextcloud admin>\n -client-secret <from nextcloud admin>\n -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=<Client ID>\n --client-secret=<Client Secret>\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=<Client ID>\n --client-secret=<Client Secret>\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https://<proxied host>/oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]);
\ No newline at end of file
diff --git a/assets/js/runtime~main.7c12ab0b.js b/assets/js/runtime~main.f8aa34b6.js
similarity index 99%
rename from assets/js/runtime~main.7c12ab0b.js
rename to assets/js/runtime~main.f8aa34b6.js
index 70c0959f..73599659 100644
--- a/assets/js/runtime~main.7c12ab0b.js
+++ b/assets/js/runtime~main.f8aa34b6.js
@@ -1 +1 @@
-!function(){"use strict";var e,c,f,t,a,r={},n={};function b(e){var c=n[e];if(void 0!==c)return c.exports;var f=n[e]={id:e,loaded:!1,exports:{}};return r[e].call(f.exports,f,f.exports,b),f.loaded=!0,f.exports}b.m=r,b.c=n,e=[],b.O=function(c,f,t,a){if(!f){var r=1/0;for(u=0;u<e.length;u++){f=e[u][0],t=e[u][1],a=e[u][2];for(var n=!0,d=0;d<f.length;d++)(!1&a||r>=a)&&Object.keys(b.O).every((function(e){return b.O[e](f[d])}))?f.splice(d--,1):(n=!1,a<r&&(r=a));if(n){e.splice(u--,1);var o=t();void 0!==o&&(c=o)}}return c}a=a||0;for(var u=e.length;u>0&&e[u-1][2]>a;u--)e[u]=e[u-1];e[u]=[f,t,a]},b.n=function(e){var c=e&&e.__esModule?function(){return e.default}:function(){return e};return b.d(c,{a:c}),c},f=Object.getPrototypeOf?function(e){return Object.getPrototypeOf(e)}:function(e){return e.__proto__},b.t=function(e,t){if(1&t&&(e=this(e)),8&t)return e;if("object"==typeof e&&e){if(4&t&&e.__esModule)return e;if(16&t&&"function"==typeof e.then)return e}var a=Object.create(null);b.r(a);var r={};c=c||[null,f({}),f([]),f(f)];for(var n=2&t&&e;"object"==typeof n&&!~c.indexOf(n);n=f(n))Object.getOwnPropertyNames(n).forEach((function(c){r[c]=function(){return e[c]}}));return r.default=function(){return e},b.d(a,r),a},b.d=function(e,c){for(var f in c)b.o(c,f)&&!b.o(e,f)&&Object.defineProperty(e,f,{enumerable:!0,get:c[f]})},b.f={},b.e=function(e){return Promise.all(Object.keys(b.f).reduce((function(c,f){return b.f[f](e,c),c}),[]))},b.u=function(e){return"assets/js/"+({53:"935f2afb",268:"9c6b37b9",507:"8f68f251",707:"76aee1e9",811:"e8c74efb",1351:"7dcecc8d",1365:"b9702c11",1487:"adcdd4d2",1558:"efec474a",1898:"1999cd7b",2098:"92147208",2114:"6f497b56",2158:"35234f08",2260:"d4a2a59c",2439:"cd4a49c1",2593:"300a9996",2598:"5a047177",2608:"9ac82b89",2822:"94285305",2844:"f3976560",2871:"a37c03cb",3085:"1f391b9e",3217:"3b8c55ea",3291:"230aeb34",3358:"be200c4b",3608:"9e4087bc",3782:"a1bbfb14",3843:"ecc333f0",3938:"65a49553",4042:"08659987",4189:"3def9002",4431:"001ca130",4472:"f4c9d322",4998:"7b04b1d5",5144:"1737cda1",5322:"00691219",5410:"9b9cfcc1",5437:"f98fc388",5845:"243cbd97",5874:"ea7cbf6d",5995:"cecf159a",6042:"fb908f49",6119:"efc9be4b",6482:"7874e99f",6760:"0721a2c0",7165:"3b8e2d60",7240:"0f425520",7250:"41de83de",7401:"63d69a63",7559:"d8b74189",7595:"42326c77",7826:"f5839aac",7918:"17896441",8249:"585bdad0",8338:"de718920",8447:"ade45c9a",8500:"acde588d",8555:"cbc8963c",8583:"9f61b932",8724:"edfc6e1b",8873:"b89e1cb0",8967:"3fa022c7",9267:"357fe94d",9512:"a991188b",9514:"1be78505",9692:"2c77072c",9890:"8c826f25"}[e]||e)+"."+{53:"4a3f1d92",268:"0902753e",507:"e6059b29",707:"198d514c",811:"6f3ea057",1351:"02aac3e1",1365:"47e2487f",1487:"f89f4cb4",1558:"350b66c2",1898:"67af2e9d",2098:"93096b74",2114:"d1fafb1d",2158:"75b00d70",2260:"4cf62a79",2439:"64c15b9f",2593:"f753e41d",2598:"1f48e99a",2608:"844c4c60",2822:"1f5fc964",2844:"2cb9bfe2",2871:"4fbaf920",3085:"e29f8c90",3217:"6001cf90",3291:"9e93a797",3358:"0994fc5b",3608:"fcc33365",3782:"191e1df5",3843:"f0614c4d",3938:"6efe1128",4042:"ccf8ea0d",4189:"0566d6b8",4431:"df12b21c",4472:"114701fa",4608:"2c7b7ade",4998:"d117d167",5144:"d5f061d0",5322:"1534c076",5410:"37c53500",5437:"3b0c1664",5845:"547fc342",5874:"7aaa7faa",5897:"ca6e53fd",5995:"90b73e88",6042:"120ce48b",6119:"f8f89998",6482:"ffe18382",6760:"ffdc7189",7165:"7229dec3",7240:"5a0f919a",7250:"41ba64ac",7401:"bbcebc27",7559:"4b70dd77",7595:"8e971b20",7826:"b034b05a",7918:"b571fd1c",8249:"91728ed2",8338:"cd0c4637",8447:"fb2dab7b",8500:"017a6535",8555:"4522119e",8583:"b7164f76",8724:"25fb710b",8873:"d176f819",8967:"d245265c",9267:"ae9d55f6",9512:"d0024de2",9514:"7b2cd06e",9692:"fd996257",9890:"e65a6b95"}[e]+".js"},b.miniCssF=function(e){return"assets/css/styles.19258e03.css"},b.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),b.o=function(e,c){return Object.prototype.hasOwnProperty.call(e,c)},t={},a="docusaurus:",b.l=function(e,c,f,r){if(t[e])t[e].push(c);else{var n,d;if(void 0!==f)for(var o=document.getElementsByTagName("script"),u=0;u<o.length;u++){var i=o[u];if(i.getAttribute("src")==e||i.getAttribute("data-webpack")==a+f){n=i;break}}n||(d=!0,(n=document.createElement("script")).charset="utf-8",n.timeout=120,b.nc&&n.setAttribute("nonce",b.nc),n.setAttribute("data-webpack",a+f),n.src=e),t[e]=[c];var s=function(c,f){n.onerror=n.onload=null,clearTimeout(l);var a=t[e];if(delete t[e],n.parentNode&&n.parentNode.removeChild(n),a&&a.forEach((function(e){return e(f)})),c)return c(f)},l=setTimeout(s.bind(null,void 0,{type:"timeout",target:n}),12e4);n.onerror=s.bind(null,n.onerror),n.onload=s.bind(null,n.onload),d&&document.head.appendChild(n)}},b.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},b.p="/oauth2-proxy/",b.gca=function(e){return e={17896441:"7918",92147208:"2098",94285305:"2822","935f2afb":"53","9c6b37b9":"268","8f68f251":"507","76aee1e9":"707",e8c74efb:"811","7dcecc8d":"1351",b9702c11:"1365",adcdd4d2:"1487",efec474a:"1558","1999cd7b":"1898","6f497b56":"2114","35234f08":"2158",d4a2a59c:"2260",cd4a49c1:"2439","300a9996":"2593","5a047177":"2598","9ac82b89":"2608",f3976560:"2844",a37c03cb:"2871","1f391b9e":"3085","3b8c55ea":"3217","230aeb34":"3291",be200c4b:"3358","9e4087bc":"3608",a1bbfb14:"3782",ecc333f0:"3843","65a49553":"3938","08659987":"4042","3def9002":"4189","001ca130":"4431",f4c9d322:"4472","7b04b1d5":"4998","1737cda1":"5144","00691219":"5322","9b9cfcc1":"5410",f98fc388:"5437","243cbd97":"5845",ea7cbf6d:"5874",cecf159a:"5995",fb908f49:"6042",efc9be4b:"6119","7874e99f":"6482","0721a2c0":"6760","3b8e2d60":"7165","0f425520":"7240","41de83de":"7250","63d69a63":"7401",d8b74189:"7559","42326c77":"7595",f5839aac:"7826","585bdad0":"8249",de718920:"8338",ade45c9a:"8447",acde588d:"8500",cbc8963c:"8555","9f61b932":"8583",edfc6e1b:"8724",b89e1cb0:"8873","3fa022c7":"8967","357fe94d":"9267",a991188b:"9512","1be78505":"9514","2c77072c":"9692","8c826f25":"9890"}[e]||e,b.p+b.u(e)},function(){var e={1303:0,532:0};b.f.j=function(c,f){var t=b.o(e,c)?e[c]:void 0;if(0!==t)if(t)f.push(t[2]);else if(/^(1303|532)$/.test(c))e[c]=0;else{var a=new Promise((function(f,a){t=e[c]=[f,a]}));f.push(t[2]=a);var r=b.p+b.u(c),n=new Error;b.l(r,(function(f){if(b.o(e,c)&&(0!==(t=e[c])&&(e[c]=void 0),t)){var a=f&&("load"===f.type?"missing":f.type),r=f&&f.target&&f.target.src;n.message="Loading chunk "+c+" failed.\n("+a+": "+r+")",n.name="ChunkLoadError",n.type=a,n.request=r,t[1](n)}}),"chunk-"+c,c)}},b.O.j=function(c){return 0===e[c]};var c=function(c,f){var t,a,r=f[0],n=f[1],d=f[2],o=0;if(r.some((function(c){return 0!==e[c]}))){for(t in n)b.o(n,t)&&(b.m[t]=n[t]);if(d)var u=d(b)}for(c&&c(f);o<r.length;o++)a=r[o],b.o(e,a)&&e[a]&&e[a][0](),e[a]=0;return b.O(u)},f=self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[];f.forEach(c.bind(null,0)),f.push=c.bind(null,f.push.bind(f))}()}();
\ No newline at end of file
+!function(){"use strict";var e,c,f,t,a,r={},n={};function b(e){var c=n[e];if(void 0!==c)return c.exports;var f=n[e]={id:e,loaded:!1,exports:{}};return r[e].call(f.exports,f,f.exports,b),f.loaded=!0,f.exports}b.m=r,b.c=n,e=[],b.O=function(c,f,t,a){if(!f){var r=1/0;for(u=0;u<e.length;u++){f=e[u][0],t=e[u][1],a=e[u][2];for(var n=!0,d=0;d<f.length;d++)(!1&a||r>=a)&&Object.keys(b.O).every((function(e){return b.O[e](f[d])}))?f.splice(d--,1):(n=!1,a<r&&(r=a));if(n){e.splice(u--,1);var o=t();void 0!==o&&(c=o)}}return c}a=a||0;for(var u=e.length;u>0&&e[u-1][2]>a;u--)e[u]=e[u-1];e[u]=[f,t,a]},b.n=function(e){var c=e&&e.__esModule?function(){return e.default}:function(){return e};return b.d(c,{a:c}),c},f=Object.getPrototypeOf?function(e){return Object.getPrototypeOf(e)}:function(e){return e.__proto__},b.t=function(e,t){if(1&t&&(e=this(e)),8&t)return e;if("object"==typeof e&&e){if(4&t&&e.__esModule)return e;if(16&t&&"function"==typeof e.then)return e}var a=Object.create(null);b.r(a);var r={};c=c||[null,f({}),f([]),f(f)];for(var n=2&t&&e;"object"==typeof n&&!~c.indexOf(n);n=f(n))Object.getOwnPropertyNames(n).forEach((function(c){r[c]=function(){return e[c]}}));return r.default=function(){return e},b.d(a,r),a},b.d=function(e,c){for(var f in c)b.o(c,f)&&!b.o(e,f)&&Object.defineProperty(e,f,{enumerable:!0,get:c[f]})},b.f={},b.e=function(e){return Promise.all(Object.keys(b.f).reduce((function(c,f){return b.f[f](e,c),c}),[]))},b.u=function(e){return"assets/js/"+({53:"935f2afb",268:"9c6b37b9",507:"8f68f251",707:"76aee1e9",811:"e8c74efb",1351:"7dcecc8d",1365:"b9702c11",1487:"adcdd4d2",1558:"efec474a",1898:"1999cd7b",2098:"92147208",2114:"6f497b56",2158:"35234f08",2260:"d4a2a59c",2439:"cd4a49c1",2593:"300a9996",2598:"5a047177",2608:"9ac82b89",2822:"94285305",2844:"f3976560",2871:"a37c03cb",3085:"1f391b9e",3217:"3b8c55ea",3291:"230aeb34",3358:"be200c4b",3608:"9e4087bc",3782:"a1bbfb14",3843:"ecc333f0",3938:"65a49553",4042:"08659987",4189:"3def9002",4431:"001ca130",4472:"f4c9d322",4998:"7b04b1d5",5144:"1737cda1",5322:"00691219",5410:"9b9cfcc1",5437:"f98fc388",5845:"243cbd97",5874:"ea7cbf6d",5995:"cecf159a",6042:"fb908f49",6119:"efc9be4b",6482:"7874e99f",6760:"0721a2c0",7165:"3b8e2d60",7240:"0f425520",7250:"41de83de",7401:"63d69a63",7559:"d8b74189",7595:"42326c77",7826:"f5839aac",7918:"17896441",8249:"585bdad0",8338:"de718920",8447:"ade45c9a",8500:"acde588d",8555:"cbc8963c",8583:"9f61b932",8724:"edfc6e1b",8873:"b89e1cb0",8967:"3fa022c7",9267:"357fe94d",9512:"a991188b",9514:"1be78505",9692:"2c77072c",9890:"8c826f25"}[e]||e)+"."+{53:"4a3f1d92",268:"0902753e",507:"e6059b29",707:"198d514c",811:"6f3ea057",1351:"02aac3e1",1365:"47e2487f",1487:"f89f4cb4",1558:"350b66c2",1898:"67af2e9d",2098:"93096b74",2114:"d1fafb1d",2158:"75b00d70",2260:"4cf62a79",2439:"64c15b9f",2593:"f753e41d",2598:"1f48e99a",2608:"844c4c60",2822:"1f5fc964",2844:"2cb9bfe2",2871:"4fbaf920",3085:"e29f8c90",3217:"6001cf90",3291:"9e93a797",3358:"0994fc5b",3608:"fcc33365",3782:"191e1df5",3843:"f0614c4d",3938:"6efe1128",4042:"ccf8ea0d",4189:"0566d6b8",4431:"df12b21c",4472:"114701fa",4608:"2c7b7ade",4998:"d117d167",5144:"d5f061d0",5322:"1534c076",5410:"37c53500",5437:"3b0c1664",5845:"547fc342",5874:"7aaa7faa",5897:"ca6e53fd",5995:"90b73e88",6042:"120ce48b",6119:"f8f89998",6482:"ffe18382",6760:"ffdc7189",7165:"7229dec3",7240:"5a0f919a",7250:"41ba64ac",7401:"bbcebc27",7559:"4b70dd77",7595:"8e971b20",7826:"b034b05a",7918:"b571fd1c",8249:"91728ed2",8338:"cd0c4637",8447:"fb2dab7b",8500:"017a6535",8555:"4522119e",8583:"b7164f76",8724:"25fb710b",8873:"d176f819",8967:"d245265c",9267:"5f902a23",9512:"d0024de2",9514:"7b2cd06e",9692:"fd996257",9890:"e65a6b95"}[e]+".js"},b.miniCssF=function(e){return"assets/css/styles.19258e03.css"},b.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),b.o=function(e,c){return Object.prototype.hasOwnProperty.call(e,c)},t={},a="docusaurus:",b.l=function(e,c,f,r){if(t[e])t[e].push(c);else{var n,d;if(void 0!==f)for(var o=document.getElementsByTagName("script"),u=0;u<o.length;u++){var i=o[u];if(i.getAttribute("src")==e||i.getAttribute("data-webpack")==a+f){n=i;break}}n||(d=!0,(n=document.createElement("script")).charset="utf-8",n.timeout=120,b.nc&&n.setAttribute("nonce",b.nc),n.setAttribute("data-webpack",a+f),n.src=e),t[e]=[c];var s=function(c,f){n.onerror=n.onload=null,clearTimeout(l);var a=t[e];if(delete t[e],n.parentNode&&n.parentNode.removeChild(n),a&&a.forEach((function(e){return e(f)})),c)return c(f)},l=setTimeout(s.bind(null,void 0,{type:"timeout",target:n}),12e4);n.onerror=s.bind(null,n.onerror),n.onload=s.bind(null,n.onload),d&&document.head.appendChild(n)}},b.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},b.p="/oauth2-proxy/",b.gca=function(e){return e={17896441:"7918",92147208:"2098",94285305:"2822","935f2afb":"53","9c6b37b9":"268","8f68f251":"507","76aee1e9":"707",e8c74efb:"811","7dcecc8d":"1351",b9702c11:"1365",adcdd4d2:"1487",efec474a:"1558","1999cd7b":"1898","6f497b56":"2114","35234f08":"2158",d4a2a59c:"2260",cd4a49c1:"2439","300a9996":"2593","5a047177":"2598","9ac82b89":"2608",f3976560:"2844",a37c03cb:"2871","1f391b9e":"3085","3b8c55ea":"3217","230aeb34":"3291",be200c4b:"3358","9e4087bc":"3608",a1bbfb14:"3782",ecc333f0:"3843","65a49553":"3938","08659987":"4042","3def9002":"4189","001ca130":"4431",f4c9d322:"4472","7b04b1d5":"4998","1737cda1":"5144","00691219":"5322","9b9cfcc1":"5410",f98fc388:"5437","243cbd97":"5845",ea7cbf6d:"5874",cecf159a:"5995",fb908f49:"6042",efc9be4b:"6119","7874e99f":"6482","0721a2c0":"6760","3b8e2d60":"7165","0f425520":"7240","41de83de":"7250","63d69a63":"7401",d8b74189:"7559","42326c77":"7595",f5839aac:"7826","585bdad0":"8249",de718920:"8338",ade45c9a:"8447",acde588d:"8500",cbc8963c:"8555","9f61b932":"8583",edfc6e1b:"8724",b89e1cb0:"8873","3fa022c7":"8967","357fe94d":"9267",a991188b:"9512","1be78505":"9514","2c77072c":"9692","8c826f25":"9890"}[e]||e,b.p+b.u(e)},function(){var e={1303:0,532:0};b.f.j=function(c,f){var t=b.o(e,c)?e[c]:void 0;if(0!==t)if(t)f.push(t[2]);else if(/^(1303|532)$/.test(c))e[c]=0;else{var a=new Promise((function(f,a){t=e[c]=[f,a]}));f.push(t[2]=a);var r=b.p+b.u(c),n=new Error;b.l(r,(function(f){if(b.o(e,c)&&(0!==(t=e[c])&&(e[c]=void 0),t)){var a=f&&("load"===f.type?"missing":f.type),r=f&&f.target&&f.target.src;n.message="Loading chunk "+c+" failed.\n("+a+": "+r+")",n.name="ChunkLoadError",n.type=a,n.request=r,t[1](n)}}),"chunk-"+c,c)}},b.O.j=function(c){return 0===e[c]};var c=function(c,f){var t,a,r=f[0],n=f[1],d=f[2],o=0;if(r.some((function(c){return 0!==e[c]}))){for(t in n)b.o(n,t)&&(b.m[t]=n[t]);if(d)var u=d(b)}for(c&&c(f);o<r.length;o++)a=r[o],b.o(e,a)&&e[a]&&e[a][0](),e[a]=0;return b.O(u)},f=self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[];f.forEach(c.bind(null,0)),f.push=c.bind(null,f.push.bind(f))}()}();
\ No newline at end of file
diff --git a/blog/archive/index.html b/blog/archive/index.html
index 9dd97e0c..c7cf4685 100644
--- a/blog/archive/index.html
+++ b/blog/archive/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Archive | OAuth2 Proxy</title><meta data-react-helmet="true" property="og:title" content="Archive | OAuth2 Proxy"><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="description" content="Archive"><meta data-react-helmet="true" property="og:description" content="Archive"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/blog/archive"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_tag" content="default"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/blog/archive"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/blog/archive" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/blog/archive" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/">7.3.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper"><header class="hero hero--primary"><div class="container"><h1 class="hero__title">Archive</h1><p class="hero__subtitle">Archive</p></div></header><main></main></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/behaviour/index.html b/docs/6.1.x/behaviour/index.html
index a48aa148..014c9ef9 100644
--- a/docs/6.1.x/behaviour/index.html
+++ b/docs/6.1.x/behaviour/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/behaviour" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/behaviour">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/behaviour">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/behaviour">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>6.1.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/behaviour">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->6.1.x</span><div class="theme-doc-markdown markdown"><header><h1>Behaviour</h1></header><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy's session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/6.1.x/features/endpoints">endpoints</a>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/behaviour.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/community/security/index.html b/docs/6.1.x/community/security/index.html
index ae52b9f3..0211281b 100644
--- a/docs/6.1.x/community/security/index.html
+++ b/docs/6.1.x/community/security/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/community/security" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay
merging fixes until all patches are ready.
We may also backport the fix to previous releases,
but this will be at the discretion of the maintainers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/community/security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Request Signatures</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link toc-highlight">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link toc-highlight">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/oauth_provider/index.html b/docs/6.1.x/configuration/oauth_provider/index.html
index 9ea688bc..27c5c824 100644
--- a/docs/6.1.x/configuration/oauth_provider/index.html
+++ b/docs/6.1.x/configuration/oauth_provider/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/oauth_provider" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -46,7 +46,7 @@ to setup the client id and client secret. Your "Redirection URI" will
<code>Provider</code> instance. Add a new <code>case</code> to
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
new <code>Provider</code>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/auth.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link toc-highlight">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link toc-highlight">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link toc-highlight">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link toc-highlight">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link toc-highlight">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link toc-highlight">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link toc-highlight">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link toc-highlight">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link toc-highlight">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link toc-highlight">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link toc-highlight">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link toc-highlight">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link toc-highlight">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link toc-highlight">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link toc-highlight">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link toc-highlight">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/overview/index.html b/docs/6.1.x/configuration/overview/index.html
index dc23acd3..d1663d23 100644
--- a/docs/6.1.x/configuration/overview/index.html
+++ b/docs/6.1.x/configuration/overview/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/overview" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -20,7 +20,7 @@ The default format is configured as follows:</p><div class="codeBlockContainer_I
The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for request logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestDuration</td><td>0.001</td><td>The time in seconds that a request took to process.</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>RequestURI</td><td>"/oauth2/auth"</td><td>The URI path of the request.</td></tr><tr><td>ResponseSize</td><td>12</td><td>The size in bytes of the response.</td></tr><tr><td>StatusCode</td><td>200</td><td>The HTTP status code of the response.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>Upstream</td><td>-</td><td>The upstream data of the HTTP request.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="standard-log-format">Standard Log Format<a class="hash-link" href="#standard-log-format" title="Direct link to heading">​</a></h3><p>All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you require a different format than that, you can configure it with the <code>--standard-logging-format</code> flag. The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[{{.Timestamp}}] [{{.File}}] {{.Message}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for standard logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>File</td><td>main.go:40</td><td>The file and line number of the logging statement.</td></tr><tr><td>Message</td><td>HTTP: listening on 127.0.0.1:4180</td><td>The details of the log statement.</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-nginx-auth_request-directive">Configuring for use with the Nginx <code>auth_request</code> directive<a class="hash-link" href="#configuring-for-use-with-the-nginx-auth_request-directive" title="Direct link to heading">​</a></h2><p>The <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" target="_blank" rel="noopener noreferrer">Nginx <code>auth_request</code> directive</a> allows Nginx to authenticate requests via the oauth2-proxy's <code>/auth</code> endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:</p><div class="codeBlockContainer_I0IT language-nginx theme-code-block"><div class="codeBlockContent_wNvx nginx"><pre tabindex="0" class="prism-code language-nginx codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name ...;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> include ssl/ssl.conf;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location /oauth2/ {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Auth-Request-Redirect $request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or, if you are handling multiple domains:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location = /oauth2/auth {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # nginx auth_request includes headers but not body</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Content-Length "";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass_request_body off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request /oauth2/auth;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> error_page 401 = /oauth2/sign_in;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # pass information via X-User and X-Email headers to backend,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # requires running with --set-xauthrequest flag</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $user $upstream_http_x_auth_request_user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $email $upstream_http_x_auth_request_email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-User $user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Email $email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --pass-access-token, this will pass the token to the backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $token $upstream_http_x_auth_request_access_token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Access-Token $token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --cookie-refresh, this is needed for it to work with auth_request</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie $upstream_http_set_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # limit and so the OAuth2 Proxy splits these into multiple parts.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Extract the Cookie attributes from the first Set-Cookie header and append them</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # to the second part ($upstream_cookie_* variables only contain the raw cookie content)</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie ~* "(; .*)") {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_0 $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Send both Set-Cookie headers now if there was a second part</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie_name_upstream_1) {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_0;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://backend/;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or "root /path/to/site;" or "fastcgi_pass ..." etc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>When you use ingress-nginx in Kubernetes, you MUST use <code>kubernetes/ingress-nginx</code> (which includes the Lua module) and the following configuration snippet for your <code>Ingress</code>.
Variables set with <code>auth_request_set</code> are not <code>set</code>-able in plain nginx config when the location is processed via <code>proxy_pass</code> and then may only be processed by Lua.
Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)"> auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ngx.var.name_upstream_1 ~= "" then</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">"Set-Cookie"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match("(; .</span><span class="token important">*)")</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> end</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".</p><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/overview.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link toc-highlight">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link toc-highlight">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link toc-highlight">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link toc-highlight">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link toc-highlight">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link toc-highlight">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link toc-highlight">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link toc-highlight">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link toc-highlight">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link toc-highlight">Configuring for use with the Nginx <code>auth_request</code> directive</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/session_storage/index.html b/docs/6.1.x/configuration/session_storage/index.html
index 8d8c74f9..6b52d5d2 100644
--- a/docs/6.1.x/configuration/session_storage/index.html
+++ b/docs/6.1.x/configuration/session_storage/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -26,7 +26,7 @@ disclosure.</p><h4 class="anchor anchorWithStickyNavbar_mojV" id="usage">Usage<a
<code>--redis-use-sentinel=true</code> flag, as well as configure the flags <code>--redis-sentinel-master-name</code>
and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/configuration/tls/index.html b/docs/6.1.x/configuration/tls/index.html
index faa9eb08..d3405260 100644
--- a/docs/6.1.x/configuration/tls/index.html
+++ b/docs/6.1.x/configuration/tls/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/configuration/tls" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use <c
<code>oauth2-proxy</code> will then authenticate requests for an upstream application. The external endpoint for this example
would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx config follows. Note the use of <code>Strict-Transport-Security</code> header to pin requests to SSL
via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 default ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name internal.yourcompany.com;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /path/to/cert.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /path/to/cert.key;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Strict-Transport-Security max-age=2592000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_connect_timeout 1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_send_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="codeBlockContainer_I0IT language-bash theme-code-block"><div class="codeBlockContent_wNvx bash"><pre tabindex="0" class="prism-code language-bash codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">"yourcompany.com"</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/tls.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/features/endpoints/index.html b/docs/6.1.x/features/endpoints/index.html
index ffaafbbf..e28a5342 100644
--- a/docs/6.1.x/features/endpoints/index.html
+++ b/docs/6.1.x/features/endpoints/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/endpoints" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/features/endpoints">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/features/endpoints">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/features/endpoints">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>6.1.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->6.1.x</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Endpoints</h1></header><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user's email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/6.1.x/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3 class="anchor anchorWithStickyNavbar_mojV" id="sign-out">Sign out<a class="hash-link" href="#sign-out" title="Direct link to heading">​</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">...</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>(The "sign_out_page" should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/6.1.x/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/endpoints.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/request_signatures"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Request Signatures</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link toc-highlight">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/features/request_signatures/index.html b/docs/6.1.x/features/request_signatures/index.html
index 76ee85fb..b1c79ba7 100644
--- a/docs/6.1.x/features/request_signatures/index.html
+++ b/docs/6.1.x/features/request_signatures/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Request Signatures | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Request Signatures | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:description" content="If signature_key is defined, proxied requests will be signed with the"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/features/request_signatures" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -18,7 +18,7 @@ in <code>oauthproxy.go</code></a>.</p><p><code>signature_key</code> must be of t
following:</p><ul><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html" target="_blank" rel="noopener noreferrer">Amazon Web Services: Signing and Authenticating REST
Requests</a></li><li><a href="http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/" target="_blank" rel="noopener noreferrer">rc3.org: Using HMAC to authenticate Web service
requests</a></li></ul></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/features/request_signatures.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/6.1.x/index.html b/docs/6.1.x/index.html
index 1e0dbdac..d63a75ee 100644
--- a/docs/6.1.x/index.html
+++ b/docs/6.1.x/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="6.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-6.1.x"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1. Choose how to deploy:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/6.1.x/" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/6.1.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/6.1.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/configuration/tls">TLS Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/endpoints">Endpoints</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/6.1.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/6.1.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>6.1.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->6.1.x</span><div class="theme-doc-markdown markdown"><header><h1>Installation</h1></header><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v6.1.1</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt 2>&1 | grep OK</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/6.1.x/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/6.1.x/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/installation.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/6.1.x/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/behaviour/index.html b/docs/7.0.x/behaviour/index.html
index 11446c09..b8c32fdf 100644
--- a/docs/7.0.x/behaviour/index.html
+++ b/docs/7.0.x/behaviour/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/behaviour"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/behaviour"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/behaviour" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/behaviour" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/behaviour">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/behaviour">7.1.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.0.x/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.0.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/7.0.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/features/endpoints">Endpoints</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.0.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/behaviour">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.0.x</span><div class="theme-doc-markdown markdown"><header><h1>Behaviour</h1></header><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy's session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/7.0.x/features/endpoints">endpoints</a>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/behaviour.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/community/security/index.html b/docs/7.0.x/community/security/index.html
index b512f42c..133a866f 100644
--- a/docs/7.0.x/community/security/index.html
+++ b/docs/7.0.x/community/security/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/community/security"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/community/security"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/community/security" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/community/security" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay
merging fixes until all patches are ready.
We may also backport the fix to previous releases,
but this will be at the discretion of the maintainers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/community/security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/features/request_signatures"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Request Signatures</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link toc-highlight">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link toc-highlight">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/configuration/alpha-config/index.html b/docs/7.0.x/configuration/alpha-config/index.html
index 0aaadeab..df3e4dc5 100644
--- a/docs/7.0.x/configuration/alpha-config/index.html
+++ b/docs/7.0.x/configuration/alpha-config/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Alpha Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/alpha-config"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Alpha Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:description" content="This page contains documentation for alpha features."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/alpha-config"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/alpha-config" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/alpha-config" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -35,7 +35,7 @@ response header.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description
make up the header value</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr><tr><td><code>claim</code></td><td><em>string</em></td><td>Claim is the name of the claim in the session that the value should be<br>loaded from.</td></tr><tr><td><code>prefix</code></td><td><em>string</em></td><td>Prefix is an optional prefix that will be prepended to the value of the<br>claim if it is non-empty.</td></tr><tr><td><code>basicAuthPassword</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>BasicAuthPassword converts this claim into a basic auth header.<br>Note the value of claim will become the basic auth username and the<br>basicAuthPassword will be used as the password value.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="secretsource">SecretSource<a class="hash-link" href="#secretsource" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#claimsource">ClaimSource</a>, <a href="#headervalue">HeaderValue</a>)</p><p>SecretSource references an individual secret value.
Only one source within the struct should be defined at any time.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstream">Upstream<a class="hash-link" href="#upstream" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#upstreams">Upstreams</a>)</p><p>Upstream represents the configuration for an upstream server.
Requests will be proxied to this upstream if the path matches the request path.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the upstream.<br>This value is required for all upstreams.</td></tr><tr><td><code>path</code></td><td><em>string</em></td><td>Path is used to map requests to the upstream server.<br>The closest match will take precedence and all Paths must be unique.</td></tr><tr><td><code>uri</code></td><td><em>string</em></td><td>The URI of the upstream server. This may be an HTTP(S) server of a File<br>based URL. It may include a path, in which case all requests will be served<br>under that path.<br>Eg:<br>- http://localhost:8080<br>- <a href="https://service.localhost" target="_blank" rel="noopener noreferrer">https://service.localhost</a><br>- <a href="https://service.localhost/path" target="_blank" rel="noopener noreferrer">https://service.localhost/path</a><br>- file://host/path<br>If the URI's path is "/base" and the incoming request was for "/dir",<br>the upstream request will be for "/base/dir".</td></tr><tr><td><code>insecureSkipTLSVerify</code></td><td><em>bool</em></td><td>InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br>This option is insecure and will allow potential Man-In-The-Middle attacks<br>betweem OAuth2 Proxy and the usptream server.<br>Defaults to false.</td></tr><tr><td><code>static</code></td><td><em>bool</em></td><td>Static will make all requests to this upstream have a static response.<br>The response will have a body of "Authenticated" and a response code<br>matching StaticCode.<br>If StaticCode is not set, the response will return a 200 response.</td></tr><tr><td><code>staticCode</code></td><td><em>int</em></td><td>StaticCode determines the response code for the Static response.<br>This option can only be used with Static enabled.</td></tr><tr><td><code>flushInterval</code></td><td><em><a href="#duration">Duration</a></em></td><td>FlushInterval is the period between flushing the response buffer when<br>streaming response from the upstream.<br>Defaults to 1 second.</td></tr><tr><td><code>passHostHeader</code></td><td><em>bool</em></td><td>PassHostHeader determines whether the request host header should be proxied<br>to the upstream server.<br>Defaults to true.</td></tr><tr><td><code>proxyWebSockets</code></td><td><em>bool</em></td><td>ProxyWebSockets enables proxying of websockets to upstream servers<br>Defaults to true.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstreams">Upstreams<a class="hash-link" href="#upstreams" title="Direct link to heading">​</a></h3><h4 class="anchor anchorWithStickyNavbar_mojV" id="upstream-alias">(<a href="#upstream">[]Upstream</a> alias)<a class="hash-link" href="#upstream-alias" title="Direct link to heading">​</a></h4><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Upstreams is a collection of definitions for upstream servers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/alpha_config.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#using-alpha-configuration" class="table-of-contents__link toc-highlight">Using Alpha Configuration</a><ul><li><a href="#converting-configuration-to-the-new-structure" class="table-of-contents__link toc-highlight">Converting configuration to the new structure</a></li></ul></li><li><a href="#removed-options" class="table-of-contents__link toc-highlight">Removed options</a></li><li><a href="#configuration-reference" class="table-of-contents__link toc-highlight">Configuration Reference</a><ul><li><a href="#alphaoptions" class="table-of-contents__link toc-highlight">AlphaOptions</a></li><li><a href="#claimsource" class="table-of-contents__link toc-highlight">ClaimSource</a></li><li><a href="#duration" class="table-of-contents__link toc-highlight">Duration</a></li><li><a href="#header" class="table-of-contents__link toc-highlight">Header</a></li><li><a href="#headervalue" class="table-of-contents__link toc-highlight">HeaderValue</a></li><li><a href="#secretsource" class="table-of-contents__link toc-highlight">SecretSource</a></li><li><a href="#upstream" class="table-of-contents__link toc-highlight">Upstream</a></li><li><a href="#upstreams" class="table-of-contents__link toc-highlight">Upstreams</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/configuration/oauth_provider/index.html b/docs/7.0.x/configuration/oauth_provider/index.html
index 1ac2bb93..4d5d5d61 100644
--- a/docs/7.0.x/configuration/oauth_provider/index.html
+++ b/docs/7.0.x/configuration/oauth_provider/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/oauth_provider" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/oauth_provider" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will
<code>Provider</code> instance. Add a new <code>case</code> to
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
new <code>Provider</code>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/auth.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link toc-highlight">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link toc-highlight">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link toc-highlight">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link toc-highlight">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link toc-highlight">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link toc-highlight">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link toc-highlight">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link toc-highlight">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link toc-highlight">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link toc-highlight">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link toc-highlight">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link toc-highlight">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link toc-highlight">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link toc-highlight">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link toc-highlight">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link toc-highlight">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/configuration/overview/index.html b/docs/7.0.x/configuration/overview/index.html
index 9f2f9da4..2ed4c192 100644
--- a/docs/7.0.x/configuration/overview/index.html
+++ b/docs/7.0.x/configuration/overview/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/overview"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/overview"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/overview" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/overview" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -20,7 +20,7 @@ The default format is configured as follows:</p><div class="codeBlockContainer_I
The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for request logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestDuration</td><td>0.001</td><td>The time in seconds that a request took to process.</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>RequestURI</td><td>"/oauth2/auth"</td><td>The URI path of the request.</td></tr><tr><td>ResponseSize</td><td>12</td><td>The size in bytes of the response.</td></tr><tr><td>StatusCode</td><td>200</td><td>The HTTP status code of the response.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>Upstream</td><td>-</td><td>The upstream data of the HTTP request.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="standard-log-format">Standard Log Format<a class="hash-link" href="#standard-log-format" title="Direct link to heading">​</a></h3><p>All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you require a different format than that, you can configure it with the <code>--standard-logging-format</code> flag. The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[{{.Timestamp}}] [{{.File}}] {{.Message}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for standard logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>File</td><td>main.go:40</td><td>The file and line number of the logging statement.</td></tr><tr><td>Message</td><td>HTTP: listening on 127.0.0.1:4180</td><td>The details of the log statement.</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-nginx-auth_request-directive">Configuring for use with the Nginx <code>auth_request</code> directive<a class="hash-link" href="#configuring-for-use-with-the-nginx-auth_request-directive" title="Direct link to heading">​</a></h2><p>The <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" target="_blank" rel="noopener noreferrer">Nginx <code>auth_request</code> directive</a> allows Nginx to authenticate requests via the oauth2-proxy's <code>/auth</code> endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:</p><div class="codeBlockContainer_I0IT language-nginx theme-code-block"><div class="codeBlockContent_wNvx nginx"><pre tabindex="0" class="prism-code language-nginx codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name ...;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> include ssl/ssl.conf;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location /oauth2/ {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Auth-Request-Redirect $request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or, if you are handling multiple domains:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location = /oauth2/auth {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # nginx auth_request includes headers but not body</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Content-Length "";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass_request_body off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request /oauth2/auth;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> error_page 401 = /oauth2/sign_in;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # pass information via X-User and X-Email headers to backend,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # requires running with --set-xauthrequest flag</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $user $upstream_http_x_auth_request_user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $email $upstream_http_x_auth_request_email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-User $user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Email $email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --pass-access-token, this will pass the token to the backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $token $upstream_http_x_auth_request_access_token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Access-Token $token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --cookie-refresh, this is needed for it to work with auth_request</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie $upstream_http_set_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # limit and so the OAuth2 Proxy splits these into multiple parts.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Extract the Cookie attributes from the first Set-Cookie header and append them</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # to the second part ($upstream_cookie_* variables only contain the raw cookie content)</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie ~* "(; .*)") {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_0 $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Send both Set-Cookie headers now if there was a second part</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie_name_upstream_1) {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_0;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://backend/;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or "root /path/to/site;" or "fastcgi_pass ..." etc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>When you use ingress-nginx in Kubernetes, you MUST use <code>kubernetes/ingress-nginx</code> (which includes the Lua module) and the following configuration snippet for your <code>Ingress</code>.
Variables set with <code>auth_request_set</code> are not <code>set</code>-able in plain nginx config when the location is processed via <code>proxy_pass</code> and then may only be processed by Lua.
Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)"> auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ngx.var.name_upstream_1 ~= "" then</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">"Set-Cookie"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match("(; .</span><span class="token important">*)")</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> end</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".</p><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-traefik-v2-forwardauth-middleware">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware<a class="hash-link" href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" title="Direct link to heading">​</a></h2><p><strong>This option requires <code>--reverse-proxy</code> option to be set.</strong></p><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-401-errors-middleware">ForwardAuth with 401 errors middleware<a class="hash-link" href="#forwardauth-with-401-errors-middleware" title="Direct link to heading">​</a></h3><p>The <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> allows Traefik to authenticate requests via the oauth2-proxy's <code>/oauth2/auth</code> endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">errors</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">status</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"401-403"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">query</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"/oauth2/sign_in"</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-static-upstreams-configuration">ForwardAuth with static upstreams configuration<a class="hash-link" href="#forwardauth-with-static-upstreams-configuration" title="Direct link to heading">​</a></h3><p>Redirect to sign_in functionality provided without the use of <code>errors</code> middleware with <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> pointing to oauth2-proxy service's <code>/</code> endpoint</p><p><strong>Following options need to be set on <code>oauth2-proxy</code>:</strong></p><ul><li><code>--upstream=static://202</code>: Configures a static response for authenticated sessions</li><li><code>--reverseproxy=true</code>: Enables the use of <code>X-Forwarded-*</code> headers to determine redirects correctly</li></ul><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># redirects all unauthenticated to oauth2 signin</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">wo</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># unauthenticated session will return a 401</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services-oauth2-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth2-proxy-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`oauth.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/overview.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link toc-highlight">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link toc-highlight">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link toc-highlight">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link toc-highlight">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link toc-highlight">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link toc-highlight">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link toc-highlight">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link toc-highlight">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link toc-highlight">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link toc-highlight">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link toc-highlight">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link toc-highlight">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link toc-highlight">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/configuration/session_storage/index.html b/docs/7.0.x/configuration/session_storage/index.html
index 97b2413c..754533e7 100644
--- a/docs/7.0.x/configuration/session_storage/index.html
+++ b/docs/7.0.x/configuration/session_storage/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/session_storage"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/session_storage"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/session_storage" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -26,7 +26,7 @@ disclosure.</p><h4 class="anchor anchorWithStickyNavbar_mojV" id="usage">Usage<a
<code>--redis-use-sentinel=true</code> flag, as well as configure the flags <code>--redis-sentinel-master-name</code>
and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/configuration/tls/index.html b/docs/7.0.x/configuration/tls/index.html
index f0a4c833..f93e49d1 100644
--- a/docs/7.0.x/configuration/tls/index.html
+++ b/docs/7.0.x/configuration/tls/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/tls"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/tls"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/tls" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/configuration/tls" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use <c
<code>oauth2-proxy</code> will then authenticate requests for an upstream application. The external endpoint for this example
would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx config follows. Note the use of <code>Strict-Transport-Security</code> header to pin requests to SSL
via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 default ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name internal.yourcompany.com;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /path/to/cert.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /path/to/cert.key;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Strict-Transport-Security max-age=2592000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_connect_timeout 1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_send_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="codeBlockContainer_I0IT language-bash theme-code-block"><div class="codeBlockContent_wNvx bash"><pre tabindex="0" class="prism-code language-bash codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">"yourcompany.com"</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/tls.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/alpha-config"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Alpha Configuration</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/features/endpoints/index.html b/docs/7.0.x/features/endpoints/index.html
index e765ee48..de3d21b2 100644
--- a/docs/7.0.x/features/endpoints/index.html
+++ b/docs/7.0.x/features/endpoints/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/endpoints"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/endpoints"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/endpoints" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/endpoints" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/features/endpoints">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/features/endpoints">7.1.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.0.x/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.0.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.0.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/7.0.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/7.0.x/features/endpoints">Endpoints</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.0.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.0.x</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Endpoints</h1></header><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user's email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/7.0.x/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3 class="anchor anchorWithStickyNavbar_mojV" id="sign-out">Sign out<a class="hash-link" href="#sign-out" title="Direct link to heading">​</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">...</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>(The "sign_out_page" should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/7.0.x/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/endpoints.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/features/request_signatures"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Request Signatures</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link toc-highlight">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/features/request_signatures/index.html b/docs/7.0.x/features/request_signatures/index.html
index 33760b6b..bec72261 100644
--- a/docs/7.0.x/features/request_signatures/index.html
+++ b/docs/7.0.x/features/request_signatures/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Request Signatures | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Request Signatures | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="If signature_key is defined, proxied requests will be signed with the"><meta data-react-helmet="true" property="og:description" content="If signature_key is defined, proxied requests will be signed with the"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -18,7 +18,7 @@ in <code>oauthproxy.go</code></a>.</p><p><code>signature_key</code> must be of t
following:</p><ul><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html" target="_blank" rel="noopener noreferrer">Amazon Web Services: Signing and Authenticating REST
Requests</a></li><li><a href="http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/" target="_blank" rel="noopener noreferrer">rc3.org: Using HMAC to authenticate Web service
requests</a></li></ul></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/features/request_signatures.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.0.x/index.html b/docs/7.0.x/index.html
index e4fe4c54..12a6ee68 100644
--- a/docs/7.0.x/index.html
+++ b/docs/7.0.x/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.0.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.0.x"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1. Choose how to deploy:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/7.0.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.0.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/features/endpoints">Endpoints</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/features/request_signatures">Request Signatures</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.0.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.0.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.0.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.0.x</span><div class="theme-doc-markdown markdown"><header><h1>Installation</h1></header><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.0.1</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt 2>&1 | grep OK</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/7.0.x/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/7.0.x/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/7.0.x/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/installation.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.0.x/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/behaviour/index.html b/docs/7.1.x/behaviour/index.html
index dae02838..028e17ee 100644
--- a/docs/7.1.x/behaviour/index.html
+++ b/docs/7.1.x/behaviour/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/behaviour"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/behaviour"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/behaviour" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/behaviour" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/behaviour">7.2.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.1.x/behaviour">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.1.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/7.1.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.1.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/behaviour">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.1.x</span><div class="theme-doc-markdown markdown"><header><h1>Behaviour</h1></header><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy's session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/7.1.x/features/endpoints">endpoints</a>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/behaviour.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/community/security/index.html b/docs/7.1.x/community/security/index.html
index 26a6d2f1..4d543e15 100644
--- a/docs/7.1.x/community/security/index.html
+++ b/docs/7.1.x/community/security/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/community/security"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/community/security"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/community/security" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/community/security" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay
merging fixes until all patches are ready.
We may also backport the fix to previous releases,
but this will be at the discretion of the maintainers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/community/security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link toc-highlight">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link toc-highlight">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/configuration/alpha-config/index.html b/docs/7.1.x/configuration/alpha-config/index.html
index 9934d387..663c0cc2 100644
--- a/docs/7.1.x/configuration/alpha-config/index.html
+++ b/docs/7.1.x/configuration/alpha-config/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Alpha Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/alpha-config"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="Alpha Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:description" content="This page contains documentation for alpha features."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/alpha-config"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/alpha-config" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/alpha-config" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -35,7 +35,7 @@ response header.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description
make up the header value</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr><tr><td><code>claim</code></td><td><em>string</em></td><td>Claim is the name of the claim in the session that the value should be<br>loaded from.</td></tr><tr><td><code>prefix</code></td><td><em>string</em></td><td>Prefix is an optional prefix that will be prepended to the value of the<br>claim if it is non-empty.</td></tr><tr><td><code>basicAuthPassword</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>BasicAuthPassword converts this claim into a basic auth header.<br>Note the value of claim will become the basic auth username and the<br>basicAuthPassword will be used as the password value.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="secretsource">SecretSource<a class="hash-link" href="#secretsource" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#claimsource">ClaimSource</a>, <a href="#headervalue">HeaderValue</a>, <a href="#tls">TLS</a>)</p><p>SecretSource references an individual secret value.
Only one source within the struct should be defined at any time.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="server">Server<a class="hash-link" href="#server" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Server represents the configuration for an HTTP(S) server</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>BindAddress</code></td><td><em>string</em></td><td>BindAddress is the address on which to serve traffic.<br>Leave blank or set to "-" to disable.</td></tr><tr><td><code>SecureBindAddress</code></td><td><em>string</em></td><td>SecureBindAddress is the address on which to serve secure traffic.<br>Leave blank or set to "-" to disable.</td></tr><tr><td><code>TLS</code></td><td><em><a href="#tls">TLS</a></em></td><td>TLS contains the information for loading the certificate and key for the<br>secure traffic.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="tls">TLS<a class="hash-link" href="#tls" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#server">Server</a>)</p><p>TLS contains the information for loading a TLS certifcate and key.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>Key</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>Key is the TLS key data to use.<br>Typically this will come from a file.</td></tr><tr><td><code>Cert</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>Cert is the TLS certificate data to use.<br>Typically this will come from a file.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstream">Upstream<a class="hash-link" href="#upstream" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#upstreams">Upstreams</a>)</p><p>Upstream represents the configuration for an upstream server.
Requests will be proxied to this upstream if the path matches the request path.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the upstream.<br>This value is required for all upstreams.</td></tr><tr><td><code>path</code></td><td><em>string</em></td><td>Path is used to map requests to the upstream server.<br>The closest match will take precedence and all Paths must be unique.</td></tr><tr><td><code>uri</code></td><td><em>string</em></td><td>The URI of the upstream server. This may be an HTTP(S) server of a File<br>based URL. It may include a path, in which case all requests will be served<br>under that path.<br>Eg:<br>- http://localhost:8080<br>- <a href="https://service.localhost" target="_blank" rel="noopener noreferrer">https://service.localhost</a><br>- <a href="https://service.localhost/path" target="_blank" rel="noopener noreferrer">https://service.localhost/path</a><br>- file://host/path<br>If the URI's path is "/base" and the incoming request was for "/dir",<br>the upstream request will be for "/base/dir".</td></tr><tr><td><code>insecureSkipTLSVerify</code></td><td><em>bool</em></td><td>InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br>This option is insecure and will allow potential Man-In-The-Middle attacks<br>betweem OAuth2 Proxy and the usptream server.<br>Defaults to false.</td></tr><tr><td><code>static</code></td><td><em>bool</em></td><td>Static will make all requests to this upstream have a static response.<br>The response will have a body of "Authenticated" and a response code<br>matching StaticCode.<br>If StaticCode is not set, the response will return a 200 response.</td></tr><tr><td><code>staticCode</code></td><td><em>int</em></td><td>StaticCode determines the response code for the Static response.<br>This option can only be used with Static enabled.</td></tr><tr><td><code>flushInterval</code></td><td><em><a href="#duration">Duration</a></em></td><td>FlushInterval is the period between flushing the response buffer when<br>streaming response from the upstream.<br>Defaults to 1 second.</td></tr><tr><td><code>passHostHeader</code></td><td><em>bool</em></td><td>PassHostHeader determines whether the request host header should be proxied<br>to the upstream server.<br>Defaults to true.</td></tr><tr><td><code>proxyWebSockets</code></td><td><em>bool</em></td><td>ProxyWebSockets enables proxying of websockets to upstream servers<br>Defaults to true.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstreams">Upstreams<a class="hash-link" href="#upstreams" title="Direct link to heading">​</a></h3><h4 class="anchor anchorWithStickyNavbar_mojV" id="upstream-alias">(<a href="#upstream">[]Upstream</a> alias)<a class="hash-link" href="#upstream-alias" title="Direct link to heading">​</a></h4><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Upstreams is a collection of definitions for upstream servers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/configuration/alpha_config.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#using-alpha-configuration" class="table-of-contents__link toc-highlight">Using Alpha Configuration</a><ul><li><a href="#converting-configuration-to-the-new-structure" class="table-of-contents__link toc-highlight">Converting configuration to the new structure</a></li></ul></li><li><a href="#removed-options" class="table-of-contents__link toc-highlight">Removed options</a></li><li><a href="#configuration-reference" class="table-of-contents__link toc-highlight">Configuration Reference</a><ul><li><a href="#alphaoptions" class="table-of-contents__link toc-highlight">AlphaOptions</a></li><li><a href="#claimsource" class="table-of-contents__link toc-highlight">ClaimSource</a></li><li><a href="#duration" class="table-of-contents__link toc-highlight">Duration</a></li><li><a href="#header" class="table-of-contents__link toc-highlight">Header</a></li><li><a href="#headervalue" class="table-of-contents__link toc-highlight">HeaderValue</a></li><li><a href="#secretsource" class="table-of-contents__link toc-highlight">SecretSource</a></li><li><a href="#server" class="table-of-contents__link toc-highlight">Server</a></li><li><a href="#tls" class="table-of-contents__link toc-highlight">TLS</a></li><li><a href="#upstream" class="table-of-contents__link toc-highlight">Upstream</a></li><li><a href="#upstreams" class="table-of-contents__link toc-highlight">Upstreams</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/configuration/oauth_provider/index.html b/docs/7.1.x/configuration/oauth_provider/index.html
index 3e59186d..9e32a4b5 100644
--- a/docs/7.1.x/configuration/oauth_provider/index.html
+++ b/docs/7.1.x/configuration/oauth_provider/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/oauth_provider"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/oauth_provider"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/oauth_provider" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/oauth_provider" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will
<code>Provider</code> instance. Add a new <code>case</code> to
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
new <code>Provider</code>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/configuration/auth.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link toc-highlight">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link toc-highlight">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link toc-highlight">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link toc-highlight">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link toc-highlight">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link toc-highlight">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link toc-highlight">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link toc-highlight">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link toc-highlight">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link toc-highlight">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link toc-highlight">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link toc-highlight">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link toc-highlight">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link toc-highlight">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link toc-highlight">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link toc-highlight">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/configuration/overview/index.html b/docs/7.1.x/configuration/overview/index.html
index 7aa69e04..53675206 100644
--- a/docs/7.1.x/configuration/overview/index.html
+++ b/docs/7.1.x/configuration/overview/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/overview"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/overview"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/overview" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/overview" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -20,7 +20,7 @@ The default format is configured as follows:</p><div class="codeBlockContainer_I
The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for request logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestDuration</td><td>0.001</td><td>The time in seconds that a request took to process.</td></tr><tr><td>RequestID</td><td>00010203-0405-4607-8809-0a0b0c0d0e0f</td><td>The request ID pulled from the <code>--request-id-header</code>. Random UUID if empty</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>RequestURI</td><td>"/oauth2/auth"</td><td>The URI path of the request.</td></tr><tr><td>ResponseSize</td><td>12</td><td>The size in bytes of the response.</td></tr><tr><td>StatusCode</td><td>200</td><td>The HTTP status code of the response.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>Upstream</td><td>-</td><td>The upstream data of the HTTP request.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="standard-log-format">Standard Log Format<a class="hash-link" href="#standard-log-format" title="Direct link to heading">​</a></h3><p>All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you require a different format than that, you can configure it with the <code>--standard-logging-format</code> flag. The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[{{.Timestamp}}] [{{.File}}] {{.Message}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for standard logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>File</td><td>main.go:40</td><td>The file and line number of the logging statement.</td></tr><tr><td>Message</td><td>HTTP: listening on 127.0.0.1:4180</td><td>The details of the log statement.</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-nginx-auth_request-directive">Configuring for use with the Nginx <code>auth_request</code> directive<a class="hash-link" href="#configuring-for-use-with-the-nginx-auth_request-directive" title="Direct link to heading">​</a></h2><p>The <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" target="_blank" rel="noopener noreferrer">Nginx <code>auth_request</code> directive</a> allows Nginx to authenticate requests via the oauth2-proxy's <code>/auth</code> endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:</p><div class="codeBlockContainer_I0IT language-nginx theme-code-block"><div class="codeBlockContent_wNvx nginx"><pre tabindex="0" class="prism-code language-nginx codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name ...;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> include ssl/ssl.conf;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location /oauth2/ {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Auth-Request-Redirect $request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or, if you are handling multiple domains:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location = /oauth2/auth {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # nginx auth_request includes headers but not body</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Content-Length "";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass_request_body off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request /oauth2/auth;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> error_page 401 = /oauth2/sign_in;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # pass information via X-User and X-Email headers to backend,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # requires running with --set-xauthrequest flag</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $user $upstream_http_x_auth_request_user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $email $upstream_http_x_auth_request_email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-User $user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Email $email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --pass-access-token, this will pass the token to the backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $token $upstream_http_x_auth_request_access_token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Access-Token $token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --cookie-refresh, this is needed for it to work with auth_request</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie $upstream_http_set_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # limit and so the OAuth2 Proxy splits these into multiple parts.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Extract the Cookie attributes from the first Set-Cookie header and append them</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # to the second part ($upstream_cookie_* variables only contain the raw cookie content)</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie ~* "(; .*)") {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_0 $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Send both Set-Cookie headers now if there was a second part</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie_name_upstream_1) {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_0;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://backend/;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or "root /path/to/site;" or "fastcgi_pass ..." etc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>When you use ingress-nginx in Kubernetes, you MUST use <code>kubernetes/ingress-nginx</code> (which includes the Lua module) and the following configuration snippet for your <code>Ingress</code>.
Variables set with <code>auth_request_set</code> are not <code>set</code>-able in plain nginx config when the location is processed via <code>proxy_pass</code> and then may only be processed by Lua.
Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)"> auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ngx.var.name_upstream_1 ~= "" then</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">"Set-Cookie"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match("(; .</span><span class="token important">*)")</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> end</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".</p><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-traefik-v2-forwardauth-middleware">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware<a class="hash-link" href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" title="Direct link to heading">​</a></h2><p><strong>This option requires <code>--reverse-proxy</code> option to be set.</strong></p><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-401-errors-middleware">ForwardAuth with 401 errors middleware<a class="hash-link" href="#forwardauth-with-401-errors-middleware" title="Direct link to heading">​</a></h3><p>The <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> allows Traefik to authenticate requests via the oauth2-proxy's <code>/oauth2/auth</code> endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">errors</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">status</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"401-403"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">query</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"/oauth2/sign_in"</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-static-upstreams-configuration">ForwardAuth with static upstreams configuration<a class="hash-link" href="#forwardauth-with-static-upstreams-configuration" title="Direct link to heading">​</a></h3><p>Redirect to sign_in functionality provided without the use of <code>errors</code> middleware with <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> pointing to oauth2-proxy service's <code>/</code> endpoint</p><p><strong>Following options need to be set on <code>oauth2-proxy</code>:</strong></p><ul><li><code>--upstream=static://202</code>: Configures a static response for authenticated sessions</li><li><code>--reverseproxy=true</code>: Enables the use of <code>X-Forwarded-*</code> headers to determine redirects correctly</li></ul><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># redirects all unauthenticated to oauth2 signin</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">wo</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># unauthenticated session will return a 401</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services-oauth2-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth2-proxy-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`oauth.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/configuration/overview.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link toc-highlight">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link toc-highlight">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link toc-highlight">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link toc-highlight">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link toc-highlight">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link toc-highlight">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link toc-highlight">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link toc-highlight">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link toc-highlight">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link toc-highlight">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link toc-highlight">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link toc-highlight">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link toc-highlight">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/configuration/session_storage/index.html b/docs/7.1.x/configuration/session_storage/index.html
index a36a4b48..7c53c1b1 100644
--- a/docs/7.1.x/configuration/session_storage/index.html
+++ b/docs/7.1.x/configuration/session_storage/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/session_storage"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/session_storage"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/session_storage" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -26,7 +26,7 @@ disclosure.</p><h4 class="anchor anchorWithStickyNavbar_mojV" id="usage">Usage<a
<code>--redis-use-sentinel=true</code> flag, as well as configure the flags <code>--redis-sentinel-master-name</code>
and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/configuration/tls/index.html b/docs/7.1.x/configuration/tls/index.html
index 4e07a4cf..376238a5 100644
--- a/docs/7.1.x/configuration/tls/index.html
+++ b/docs/7.1.x/configuration/tls/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/tls"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/tls"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/tls" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/configuration/tls" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use <c
<code>oauth2-proxy</code> will then authenticate requests for an upstream application. The external endpoint for this example
would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx config follows. Note the use of <code>Strict-Transport-Security</code> header to pin requests to SSL
via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 default ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name internal.yourcompany.com;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /path/to/cert.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /path/to/cert.key;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Strict-Transport-Security max-age=2592000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_connect_timeout 1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_send_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="codeBlockContainer_I0IT language-bash theme-code-block"><div class="codeBlockContent_wNvx bash"><pre tabindex="0" class="prism-code language-bash codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">"yourcompany.com"</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/configuration/tls.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/alpha-config"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Alpha Configuration</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/features/endpoints/index.html b/docs/7.1.x/features/endpoints/index.html
index e4b5bfb1..8bf6dff3 100644
--- a/docs/7.1.x/features/endpoints/index.html
+++ b/docs/7.1.x/features/endpoints/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/features/endpoints"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/features/endpoints"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/features/endpoints" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/features/endpoints" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/features/endpoints">7.2.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.1.x/features/endpoints">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.1.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.1.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/7.1.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/7.1.x/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.1.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.1.x</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Endpoints</h1></header><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by <code>--metrics-address</code>, disabled by default</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user's email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/7.1.x/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3 class="anchor anchorWithStickyNavbar_mojV" id="sign-out">Sign out<a class="hash-link" href="#sign-out" title="Direct link to heading">​</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">...</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>(The "sign_out_page" should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/7.1.x/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/features/endpoints.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link toc-highlight">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.1.x/index.html b/docs/7.1.x/index.html
index 14bd1950..b8a060b2 100644
--- a/docs/7.1.x/index.html
+++ b/docs/7.1.x/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.1.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.1.x"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1. Choose how to deploy:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.1.x/" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/7.1.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.1.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.1.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.1.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.1.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.1.x</span><div class="theme-doc-markdown markdown"><header><h1>Installation</h1></header><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.1.3</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p><p>d. Using a <a href="https://github.com/oauth2-proxy/manifests" target="_blank" rel="noopener noreferrer">Kubernetes manifest</a> (Helm)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt 2>&1 | grep OK</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/7.1.x/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/7.1.x/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/7.1.x/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.1.x/installation.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.1.x/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/behaviour/index.html b/docs/7.2.x/behaviour/index.html
index 399f1149..29513076 100644
--- a/docs/7.2.x/behaviour/index.html
+++ b/docs/7.2.x/behaviour/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/behaviour"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/behaviour"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/behaviour" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/behaviour" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.3.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.2.x/behaviour">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/behaviour">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.2.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/7.2.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.2.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/behaviour">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.2.x</span><div class="theme-doc-markdown markdown"><header><h1>Behaviour</h1></header><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy's session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/7.2.x/features/endpoints">endpoints</a>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/behaviour.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/community/security/index.html b/docs/7.2.x/community/security/index.html
index 6fcaf459..b96c202c 100644
--- a/docs/7.2.x/community/security/index.html
+++ b/docs/7.2.x/community/security/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/community/security"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/community/security"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/community/security" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/community/security" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay
merging fixes until all patches are ready.
We may also backport the fix to previous releases,
but this will be at the discretion of the maintainers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/community/security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link toc-highlight">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link toc-highlight">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/configuration/alpha-config/index.html b/docs/7.2.x/configuration/alpha-config/index.html
index adb9b55f..331aea87 100644
--- a/docs/7.2.x/configuration/alpha-config/index.html
+++ b/docs/7.2.x/configuration/alpha-config/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Alpha Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/alpha-config"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="Alpha Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:description" content="This page contains documentation for alpha features."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/alpha-config"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/alpha-config" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/alpha-config" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -35,7 +35,7 @@ response header.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description
make up the header value</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr><tr><td><code>claim</code></td><td><em>string</em></td><td>Claim is the name of the claim in the session that the value should be<br>loaded from.</td></tr><tr><td><code>prefix</code></td><td><em>string</em></td><td>Prefix is an optional prefix that will be prepended to the value of the<br>claim if it is non-empty.</td></tr><tr><td><code>basicAuthPassword</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>BasicAuthPassword converts this claim into a basic auth header.<br>Note the value of claim will become the basic auth username and the<br>basicAuthPassword will be used as the password value.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="keycloakoptions">KeycloakOptions<a class="hash-link" href="#keycloakoptions" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#provider">Provider</a>)</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>groups</code></td><td><em>[]string</em></td><td>Group enables to restrict login to members of indicated group</td></tr><tr><td><code>roles</code></td><td><em>[]string</em></td><td>Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="logingovoptions">LoginGovOptions<a class="hash-link" href="#logingovoptions" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#provider">Provider</a>)</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>jwtKey</code></td><td><em>string</em></td><td>JWTKey is a private key in PEM format used to sign JWT,</td></tr><tr><td><code>jwtKeyFile</code></td><td><em>string</em></td><td>JWTKeyFile is a path to the private key file in PEM format used to sign the JWT</td></tr><tr><td><code>pubjwkURL</code></td><td><em>string</em></td><td>PubJWKURL is the JWK pubkey access endpoint</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="oidcoptions">OIDCOptions<a class="hash-link" href="#oidcoptions" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#provider">Provider</a>)</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>issuerURL</code></td><td><em>string</em></td><td>IssuerURL is the OpenID Connect issuer URL<br>eg: <a href="https://accounts.google.com" target="_blank" rel="noopener noreferrer">https://accounts.google.com</a></td></tr><tr><td><code>insecureAllowUnverifiedEmail</code></td><td><em>bool</em></td><td>InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified<br>default set to 'false'</td></tr><tr><td><code>insecureSkipIssuerVerification</code></td><td><em>bool</em></td><td>InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL<br>default set to 'false'</td></tr><tr><td><code>insecureSkipNonce</code></td><td><em>bool</em></td><td>InsecureSkipNonce skips verifying the ID Token's nonce claim that must match<br>the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked<br>after the initial OAuth redeem & subsequent token refreshes.<br>default set to 'true'<br>Warning: In a future release, this will change to 'false' by default for enhanced security.</td></tr><tr><td><code>skipDiscovery</code></td><td><em>bool</em></td><td>SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints<br>default set to 'false'</td></tr><tr><td><code>jwksURL</code></td><td><em>string</em></td><td>JwksURL is the OpenID Connect JWKS URL<br>eg: <a href="https://www.googleapis.com/oauth2/v3/certs" target="_blank" rel="noopener noreferrer">https://www.googleapis.com/oauth2/v3/certs</a></td></tr><tr><td><code>emailClaim</code></td><td><em>string</em></td><td>EmailClaim indicates which claim contains the user email,<br>default set to 'email'</td></tr><tr><td><code>groupsClaim</code></td><td><em>string</em></td><td>GroupsClaim indicates which claim contains the user groups<br>default set to 'groups'</td></tr><tr><td><code>userIDClaim</code></td><td><em>string</em></td><td>UserIDClaim indicates which claim contains the user ID<br>default set to 'email'</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="provider">Provider<a class="hash-link" href="#provider" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#providers">Providers</a>)</p><p>Provider holds all configuration for a single provider</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>clientID</code></td><td><em>string</em></td><td>ClientID is the OAuth Client ID that is defined in the provider<br>This value is required for all providers.</td></tr><tr><td><code>clientSecret</code></td><td><em>string</em></td><td>ClientSecret is the OAuth Client Secret that is defined in the provider<br>This value is required for all providers.</td></tr><tr><td><code>clientSecretFile</code></td><td><em>string</em></td><td>ClientSecretFile is the name of the file<br>containing the OAuth Client Secret, it will be used if ClientSecret is not set.</td></tr><tr><td><code>keycloakConfig</code></td><td><em><a href="#keycloakoptions">KeycloakOptions</a></em></td><td>KeycloakConfig holds all configurations for Keycloak provider.</td></tr><tr><td><code>azureConfig</code></td><td><em><a href="#azureoptions">AzureOptions</a></em></td><td>AzureConfig holds all configurations for Azure provider.</td></tr><tr><td><code>ADFSConfig</code></td><td><em><a href="#adfsoptions">ADFSOptions</a></em></td><td>ADFSConfig holds all configurations for ADFS provider.</td></tr><tr><td><code>bitbucketConfig</code></td><td><em><a href="#bitbucketoptions">BitbucketOptions</a></em></td><td>BitbucketConfig holds all configurations for Bitbucket provider.</td></tr><tr><td><code>githubConfig</code></td><td><em><a href="#githuboptions">GitHubOptions</a></em></td><td>GitHubConfig holds all configurations for GitHubC provider.</td></tr><tr><td><code>gitlabConfig</code></td><td><em><a href="#gitlaboptions">GitLabOptions</a></em></td><td>GitLabConfig holds all configurations for GitLab provider.</td></tr><tr><td><code>googleConfig</code></td><td><em><a href="#googleoptions">GoogleOptions</a></em></td><td>GoogleConfig holds all configurations for Google provider.</td></tr><tr><td><code>oidcConfig</code></td><td><em><a href="#oidcoptions">OIDCOptions</a></em></td><td>OIDCConfig holds all configurations for OIDC provider<br>or providers utilize OIDC configurations.</td></tr><tr><td><code>loginGovConfig</code></td><td><em><a href="#logingovoptions">LoginGovOptions</a></em></td><td>LoginGovConfig holds all configurations for LoginGov provider.</td></tr><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the provider.<br>This value is required for all providers.</td></tr><tr><td><code>provider</code></td><td><em>string</em></td><td>Type is the OAuth provider<br>must be set from the supported providers group,<br>otherwise 'Google' is set as default</td></tr><tr><td><code>name</code></td><td><em>string</em></td><td>Name is the providers display name<br>if set, it will be shown to the users in the login page.</td></tr><tr><td><code>caFiles</code></td><td><em>[]string</em></td><td>CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.<br>If not specified, the default Go trust sources are used instead</td></tr><tr><td><code>loginURL</code></td><td><em>string</em></td><td>LoginURL is the authentication endpoint</td></tr><tr><td><code>redeemURL</code></td><td><em>string</em></td><td>RedeemURL is the token redemption endpoint</td></tr><tr><td><code>profileURL</code></td><td><em>string</em></td><td>ProfileURL is the profile access endpoint</td></tr><tr><td><code>resource</code></td><td><em>string</em></td><td>ProtectedResource is the resource that is protected (Azure AD and ADFS only)</td></tr><tr><td><code>validateURL</code></td><td><em>string</em></td><td>ValidateURL is the access token validation endpoint</td></tr><tr><td><code>scope</code></td><td><em>string</em></td><td>Scope is the OAuth scope specification</td></tr><tr><td><code>prompt</code></td><td><em>string</em></td><td>Prompt is OIDC prompt</td></tr><tr><td><code>approvalPrompt</code></td><td><em>string</em></td><td>ApprovalPrompt is the OAuth approval_prompt<br>default is set to 'force'</td></tr><tr><td><code>allowedGroups</code></td><td><em>[]string</em></td><td>AllowedGroups is a list of restrict logins to members of this group</td></tr><tr><td><code>acrValues</code></td><td><em>string</em></td><td>AcrValues is a string of acr values</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="providers">Providers<a class="hash-link" href="#providers" title="Direct link to heading">​</a></h3><h4 class="anchor anchorWithStickyNavbar_mojV" id="provider-alias">(<a href="#provider">[]Provider</a> alias)<a class="hash-link" href="#provider-alias" title="Direct link to heading">​</a></h4><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Providers is a collection of definitions for providers.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="secretsource">SecretSource<a class="hash-link" href="#secretsource" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#claimsource">ClaimSource</a>, <a href="#headervalue">HeaderValue</a>, <a href="#tls">TLS</a>)</p><p>SecretSource references an individual secret value.
Only one source within the struct should be defined at any time.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>[]byte</em></td><td>Value expects a base64 encoded string value.</td></tr><tr><td><code>fromEnv</code></td><td><em>string</em></td><td>FromEnv expects the name of an environment variable.</td></tr><tr><td><code>fromFile</code></td><td><em>string</em></td><td>FromFile expects a path to a file containing the secret value.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="server">Server<a class="hash-link" href="#server" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>Server represents the configuration for an HTTP(S) server</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>BindAddress</code></td><td><em>string</em></td><td>BindAddress is the address on which to serve traffic.<br>Leave blank or set to "-" to disable.</td></tr><tr><td><code>SecureBindAddress</code></td><td><em>string</em></td><td>SecureBindAddress is the address on which to serve secure traffic.<br>Leave blank or set to "-" to disable.</td></tr><tr><td><code>TLS</code></td><td><em><a href="#tls">TLS</a></em></td><td>TLS contains the information for loading the certificate and key for the<br>secure traffic.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="tls">TLS<a class="hash-link" href="#tls" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#server">Server</a>)</p><p>TLS contains the information for loading a TLS certifcate and key.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>Key</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>Key is the TLS key data to use.<br>Typically this will come from a file.</td></tr><tr><td><code>Cert</code></td><td><em><a href="#secretsource">SecretSource</a></em></td><td>Cert is the TLS certificate data to use.<br>Typically this will come from a file.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstream">Upstream<a class="hash-link" href="#upstream" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#upstreamconfig">UpstreamConfig</a>)</p><p>Upstream represents the configuration for an upstream server.
Requests will be proxied to this upstream if the path matches the request path.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the upstream.<br>This value is required for all upstreams.</td></tr><tr><td><code>path</code></td><td><em>string</em></td><td>Path is used to map requests to the upstream server.<br>The closest match will take precedence and all Paths must be unique.<br>Path can also take a pattern when used with RewriteTarget.<br>Path segments can be captured and matched using regular experessions.<br>Eg:<br>- <code>^/foo$</code>: Match only the explicit path <code>/foo</code><br>- <code>^/bar/$</code>: Match any path prefixed with <code>/bar/</code><br>- <code>^/baz/(.*)$</code>: Match any path prefixed with <code>/baz</code> and capture the remaining path for use with RewriteTarget</td></tr><tr><td><code>rewriteTarget</code></td><td><em>string</em></td><td>RewriteTarget allows users to rewrite the request path before it is sent to<br>the upstream server.<br>Use the Path to capture segments for reuse within the rewrite target.<br>Eg: With a Path of <code>^/baz/(.*)</code>, a RewriteTarget of <code>/foo/$1</code> would rewrite<br>the request <code>/baz/abc/123</code> to <code>/foo/abc/123</code> before proxying to the<br>upstream server.</td></tr><tr><td><code>uri</code></td><td><em>string</em></td><td>The URI of the upstream server. This may be an HTTP(S) server of a File<br>based URL. It may include a path, in which case all requests will be served<br>under that path.<br>Eg:<br>- http://localhost:8080<br>- <a href="https://service.localhost" target="_blank" rel="noopener noreferrer">https://service.localhost</a><br>- <a href="https://service.localhost/path" target="_blank" rel="noopener noreferrer">https://service.localhost/path</a><br>- file://host/path<br>If the URI's path is "/base" and the incoming request was for "/dir",<br>the upstream request will be for "/base/dir".</td></tr><tr><td><code>insecureSkipTLSVerify</code></td><td><em>bool</em></td><td>InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br>This option is insecure and will allow potential Man-In-The-Middle attacks<br>betweem OAuth2 Proxy and the usptream server.<br>Defaults to false.</td></tr><tr><td><code>static</code></td><td><em>bool</em></td><td>Static will make all requests to this upstream have a static response.<br>The response will have a body of "Authenticated" and a response code<br>matching StaticCode.<br>If StaticCode is not set, the response will return a 200 response.</td></tr><tr><td><code>staticCode</code></td><td><em>int</em></td><td>StaticCode determines the response code for the Static response.<br>This option can only be used with Static enabled.</td></tr><tr><td><code>flushInterval</code></td><td><em><a href="#duration">Duration</a></em></td><td>FlushInterval is the period between flushing the response buffer when<br>streaming response from the upstream.<br>Defaults to 1 second.</td></tr><tr><td><code>passHostHeader</code></td><td><em>bool</em></td><td>PassHostHeader determines whether the request host header should be proxied<br>to the upstream server.<br>Defaults to true.</td></tr><tr><td><code>proxyWebSockets</code></td><td><em>bool</em></td><td>ProxyWebSockets enables proxying of websockets to upstream servers<br>Defaults to true.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstreamconfig">UpstreamConfig<a class="hash-link" href="#upstreamconfig" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>UpstreamConfig is a collection of definitions for upstream servers.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>proxyRawPath</code></td><td><em>bool</em></td><td>ProxyRawPath will pass the raw url path to upstream allowing for url's<br>like: "/%2F/" which would otherwise be redirected to "/"</td></tr><tr><td><code>upstreams</code></td><td><em><a href="#upstream">[]Upstream</a></em></td><td>Upstreams represents the configuration for the upstream servers.<br>Requests will be proxied to this upstream if the path matches the request path.</td></tr></tbody></table></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/alpha_config.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#using-alpha-configuration" class="table-of-contents__link toc-highlight">Using Alpha Configuration</a><ul><li><a href="#converting-configuration-to-the-new-structure" class="table-of-contents__link toc-highlight">Converting configuration to the new structure</a></li></ul></li><li><a href="#removed-options" class="table-of-contents__link toc-highlight">Removed options</a></li><li><a href="#configuration-reference" class="table-of-contents__link toc-highlight">Configuration Reference</a><ul><li><a href="#adfsoptions" class="table-of-contents__link toc-highlight">ADFSOptions</a></li><li><a href="#alphaoptions" class="table-of-contents__link toc-highlight">AlphaOptions</a></li><li><a href="#azureoptions" class="table-of-contents__link toc-highlight">AzureOptions</a></li><li><a href="#bitbucketoptions" class="table-of-contents__link toc-highlight">BitbucketOptions</a></li><li><a href="#claimsource" class="table-of-contents__link toc-highlight">ClaimSource</a></li><li><a href="#duration" class="table-of-contents__link toc-highlight">Duration</a></li><li><a href="#githuboptions" class="table-of-contents__link toc-highlight">GitHubOptions</a></li><li><a href="#gitlaboptions" class="table-of-contents__link toc-highlight">GitLabOptions</a></li><li><a href="#googleoptions" class="table-of-contents__link toc-highlight">GoogleOptions</a></li><li><a href="#header" class="table-of-contents__link toc-highlight">Header</a></li><li><a href="#headervalue" class="table-of-contents__link toc-highlight">HeaderValue</a></li><li><a href="#keycloakoptions" class="table-of-contents__link toc-highlight">KeycloakOptions</a></li><li><a href="#logingovoptions" class="table-of-contents__link toc-highlight">LoginGovOptions</a></li><li><a href="#oidcoptions" class="table-of-contents__link toc-highlight">OIDCOptions</a></li><li><a href="#provider" class="table-of-contents__link toc-highlight">Provider</a></li><li><a href="#providers" class="table-of-contents__link toc-highlight">Providers</a></li><li><a href="#secretsource" class="table-of-contents__link toc-highlight">SecretSource</a></li><li><a href="#server" class="table-of-contents__link toc-highlight">Server</a></li><li><a href="#tls" class="table-of-contents__link toc-highlight">TLS</a></li><li><a href="#upstream" class="table-of-contents__link toc-highlight">Upstream</a></li><li><a href="#upstreamconfig" class="table-of-contents__link toc-highlight">UpstreamConfig</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/configuration/oauth_provider/index.html b/docs/7.2.x/configuration/oauth_provider/index.html
index 3767afd2..9d0f9462 100644
--- a/docs/7.2.x/configuration/oauth_provider/index.html
+++ b/docs/7.2.x/configuration/oauth_provider/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/oauth_provider"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/oauth_provider"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/oauth_provider" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/oauth_provider" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will
<code>Provider</code> instance. Add a new <code>case</code> to
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
new <code>Provider</code>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/auth.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link toc-highlight">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link toc-highlight">Azure Auth Provider</a></li><li><a href="#adfs-auth-provider" class="table-of-contents__link toc-highlight">ADFS Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link toc-highlight">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link toc-highlight">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link toc-highlight">Keycloak Auth Provider</a></li><li><a href="#keycloak-oidc-auth-provider" class="table-of-contents__link toc-highlight">Keycloak OIDC Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link toc-highlight">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link toc-highlight">LinkedIn Auth Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link toc-highlight">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link toc-highlight">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link toc-highlight">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link toc-highlight">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link toc-highlight">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link toc-highlight">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link toc-highlight">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link toc-highlight">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/configuration/overview/index.html b/docs/7.2.x/configuration/overview/index.html
index af503344..347d2163 100644
--- a/docs/7.2.x/configuration/overview/index.html
+++ b/docs/7.2.x/configuration/overview/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -20,7 +20,7 @@ The default format is configured as follows:</p><div class="codeBlockContainer_I
The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for request logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestDuration</td><td>0.001</td><td>The time in seconds that a request took to process.</td></tr><tr><td>RequestID</td><td>00010203-0405-4607-8809-0a0b0c0d0e0f</td><td>The request ID pulled from the <code>--request-id-header</code>. Random UUID if empty</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>RequestURI</td><td>"/oauth2/auth"</td><td>The URI path of the request.</td></tr><tr><td>ResponseSize</td><td>12</td><td>The size in bytes of the response.</td></tr><tr><td>StatusCode</td><td>200</td><td>The HTTP status code of the response.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>Upstream</td><td>-</td><td>The upstream data of the HTTP request.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="standard-log-format">Standard Log Format<a class="hash-link" href="#standard-log-format" title="Direct link to heading">​</a></h3><p>All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you require a different format than that, you can configure it with the <code>--standard-logging-format</code> flag. The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[{{.Timestamp}}] [{{.File}}] {{.Message}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for standard logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>File</td><td>main.go:40</td><td>The file and line number of the logging statement.</td></tr><tr><td>Message</td><td>HTTP: listening on 127.0.0.1:4180</td><td>The details of the log statement.</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-nginx-auth_request-directive">Configuring for use with the Nginx <code>auth_request</code> directive<a class="hash-link" href="#configuring-for-use-with-the-nginx-auth_request-directive" title="Direct link to heading">​</a></h2><p>The <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" target="_blank" rel="noopener noreferrer">Nginx <code>auth_request</code> directive</a> allows Nginx to authenticate requests via the oauth2-proxy's <code>/auth</code> endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:</p><div class="codeBlockContainer_I0IT language-nginx theme-code-block"><div class="codeBlockContent_wNvx nginx"><pre tabindex="0" class="prism-code language-nginx codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name ...;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> include ssl/ssl.conf;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location /oauth2/ {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Auth-Request-Redirect $request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or, if you are handling multiple domains:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location = /oauth2/auth {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # nginx auth_request includes headers but not body</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Content-Length "";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass_request_body off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request /oauth2/auth;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> error_page 401 = /oauth2/sign_in;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # pass information via X-User and X-Email headers to backend,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # requires running with --set-xauthrequest flag</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $user $upstream_http_x_auth_request_user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $email $upstream_http_x_auth_request_email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-User $user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Email $email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --pass-access-token, this will pass the token to the backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $token $upstream_http_x_auth_request_access_token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Access-Token $token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --cookie-refresh, this is needed for it to work with auth_request</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie $upstream_http_set_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # limit and so the OAuth2 Proxy splits these into multiple parts.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Extract the Cookie attributes from the first Set-Cookie header and append them</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # to the second part ($upstream_cookie_* variables only contain the raw cookie content)</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie ~* "(; .*)") {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_0 $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Send both Set-Cookie headers now if there was a second part</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie_name_upstream_1) {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_0;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://backend/;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or "root /path/to/site;" or "fastcgi_pass ..." etc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>When you use ingress-nginx in Kubernetes, you MUST use <code>kubernetes/ingress-nginx</code> (which includes the Lua module) and the following configuration snippet for your <code>Ingress</code>.
Variables set with <code>auth_request_set</code> are not <code>set</code>-able in plain nginx config when the location is processed via <code>proxy_pass</code> and then may only be processed by Lua.
Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)"> auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ngx.var.name_upstream_1 ~= "" then</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">"Set-Cookie"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match("(; .</span><span class="token important">*)")</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> end</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".</p><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-traefik-v2-forwardauth-middleware">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware<a class="hash-link" href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" title="Direct link to heading">​</a></h2><p><strong>This option requires <code>--reverse-proxy</code> option to be set.</strong></p><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-401-errors-middleware">ForwardAuth with 401 errors middleware<a class="hash-link" href="#forwardauth-with-401-errors-middleware" title="Direct link to heading">​</a></h3><p>The <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> allows Traefik to authenticate requests via the oauth2-proxy's <code>/oauth2/auth</code> endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">errors</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">status</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"401-403"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">query</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"/oauth2/sign_in"</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-static-upstreams-configuration">ForwardAuth with static upstreams configuration<a class="hash-link" href="#forwardauth-with-static-upstreams-configuration" title="Direct link to heading">​</a></h3><p>Redirect to sign_in functionality provided without the use of <code>errors</code> middleware with <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> pointing to oauth2-proxy service's <code>/</code> endpoint</p><p><strong>Following options need to be set on <code>oauth2-proxy</code>:</strong></p><ul><li><code>--upstream=static://202</code>: Configures a static response for authenticated sessions</li><li><code>--reverse-proxy=true</code>: Enables the use of <code>X-Forwarded-*</code> headers to determine redirects correctly</li></ul><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># redirects all unauthenticated to oauth2 signin</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">wo</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># unauthenticated session will return a 401</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services-oauth2-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth2-proxy-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`oauth.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/overview.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link toc-highlight">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link toc-highlight">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link toc-highlight">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link toc-highlight">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link toc-highlight">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link toc-highlight">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link toc-highlight">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link toc-highlight">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link toc-highlight">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link toc-highlight">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link toc-highlight">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link toc-highlight">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link toc-highlight">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/configuration/session_storage/index.html b/docs/7.2.x/configuration/session_storage/index.html
index a64790f7..e170fb98 100644
--- a/docs/7.2.x/configuration/session_storage/index.html
+++ b/docs/7.2.x/configuration/session_storage/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/session_storage"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/session_storage"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/session_storage" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -26,7 +26,7 @@ disclosure.</p><h4 class="anchor anchorWithStickyNavbar_mojV" id="usage">Usage<a
<code>--redis-use-sentinel=true</code> flag, as well as configure the flags <code>--redis-sentinel-master-name</code>
and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/configuration/tls/index.html b/docs/7.2.x/configuration/tls/index.html
index 6e59956b..a1892b48 100644
--- a/docs/7.2.x/configuration/tls/index.html
+++ b/docs/7.2.x/configuration/tls/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/tls"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations."><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/tls"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/tls" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/tls" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use <c
<code>oauth2-proxy</code> will then authenticate requests for an upstream application. The external endpoint for this example
would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx config follows. Note the use of <code>Strict-Transport-Security</code> header to pin requests to SSL
via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 default ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name internal.yourcompany.com;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /path/to/cert.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /path/to/cert.key;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Strict-Transport-Security max-age=2592000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_connect_timeout 1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_send_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="codeBlockContainer_I0IT language-bash theme-code-block"><div class="codeBlockContent_wNvx bash"><pre tabindex="0" class="prism-code language-bash codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">"yourcompany.com"</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/tls.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/alpha-config"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Alpha Configuration</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/features/endpoints/index.html b/docs/7.2.x/features/endpoints/index.html
index 13a78efc..8277d2cc 100644
--- a/docs/7.2.x/features/endpoints/index.html
+++ b/docs/7.2.x/features/endpoints/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/features/endpoints"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/features/endpoints"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/features/endpoints" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/features/endpoints" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.3.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.2.x/features/endpoints">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/features/endpoints">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.2.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.2.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.2.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.2.x</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Endpoints</h1></header><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by <code>--metrics-address</code>, disabled by default</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user's email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/7.2.x/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3 class="anchor anchorWithStickyNavbar_mojV" id="sign-out">Sign out<a class="hash-link" href="#sign-out" title="Direct link to heading">​</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">...</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>(The "sign_out_page" should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/7.2.x/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/features/endpoints.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link toc-highlight">Sign out</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/7.2.x/index.html b/docs/7.2.x/index.html
index a6c279cf..59d57e15 100644
--- a/docs/7.2.x/index.html
+++ b/docs/7.2.x/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.2.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1. Choose how to deploy:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/7.2.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.2.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/7.2.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.2.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.2.x</span><div class="theme-doc-markdown markdown"><header><h1>Installation</h1></header><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.2.1</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p><p>d. Using a <a href="https://github.com/oauth2-proxy/manifests" target="_blank" rel="noopener noreferrer">Kubernetes manifest</a> (Helm)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/7.2.x/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/7.2.x/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/installation.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/7.2.x/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/behaviour/index.html b/docs/behaviour/index.html
index 38d28b8c..4a88351c 100644
--- a/docs/behaviour/index.html
+++ b/docs/behaviour/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/behaviour" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/">7.3.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/behaviour">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/behaviour">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/behaviour">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.3.x</span><div class="theme-doc-markdown markdown"><header><h1>Behaviour</h1></header><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy's session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/features/endpoints">endpoints</a>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/behaviour.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/community/security/index.html b/docs/community/security/index.html
index 3d2ebee2..a678ba30 100644
--- a/docs/community/security/index.html
+++ b/docs/community/security/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay
merging fixes until all patches are ready.
We may also backport the fix to previous releases,
but this will be at the discretion of the maintainers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/community/security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link toc-highlight">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link toc-highlight">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/configuration/alpha-config/index.html b/docs/configuration/alpha-config/index.html
index d338a482..5c8dfe8d 100644
--- a/docs/configuration/alpha-config/index.html
+++ b/docs/configuration/alpha-config/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Alpha Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Alpha Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:description" content="This page contains documentation for alpha features."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/alpha-config" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -63,7 +63,7 @@ passed to the <code>/oauth2/start</code> endpoint are checked to determine wheth
they are valid overrides for the given parameter passed to the IdP's
login URL. Either Value or Pattern should be supplied, not both.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>string</em></td><td>A Value rule matches just this specific value</td></tr><tr><td><code>pattern</code></td><td><em>string</em></td><td>A Pattern rule gives a regular expression that must be matched by<br>some substring of the value. The expression is <em>not</em> automatically<br>anchored to the start and end of the value, if you <em>want</em> to restrict<br>the whole parameter value you must anchor it yourself with <code>^</code> and <code>$</code>.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstream">Upstream<a class="hash-link" href="#upstream" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#upstreamconfig">UpstreamConfig</a>)</p><p>Upstream represents the configuration for an upstream server.
Requests will be proxied to this upstream if the path matches the request path.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the upstream.<br>This value is required for all upstreams.</td></tr><tr><td><code>path</code></td><td><em>string</em></td><td>Path is used to map requests to the upstream server.<br>The closest match will take precedence and all Paths must be unique.<br>Path can also take a pattern when used with RewriteTarget.<br>Path segments can be captured and matched using regular experessions.<br>Eg:<br>- <code>^/foo$</code>: Match only the explicit path <code>/foo</code><br>- <code>^/bar/$</code>: Match any path prefixed with <code>/bar/</code><br>- <code>^/baz/(.*)$</code>: Match any path prefixed with <code>/baz</code> and capture the remaining path for use with RewriteTarget</td></tr><tr><td><code>rewriteTarget</code></td><td><em>string</em></td><td>RewriteTarget allows users to rewrite the request path before it is sent to<br>the upstream server.<br>Use the Path to capture segments for reuse within the rewrite target.<br>Eg: With a Path of <code>^/baz/(.*)</code>, a RewriteTarget of <code>/foo/$1</code> would rewrite<br>the request <code>/baz/abc/123</code> to <code>/foo/abc/123</code> before proxying to the<br>upstream server.</td></tr><tr><td><code>uri</code></td><td><em>string</em></td><td>The URI of the upstream server. This may be an HTTP(S) server of a File<br>based URL. It may include a path, in which case all requests will be served<br>under that path.<br>Eg:<br>- http://localhost:8080<br>- <a href="https://service.localhost" target="_blank" rel="noopener noreferrer">https://service.localhost</a><br>- <a href="https://service.localhost/path" target="_blank" rel="noopener noreferrer">https://service.localhost/path</a><br>- file://host/path<br>If the URI's path is "/base" and the incoming request was for "/dir",<br>the upstream request will be for "/base/dir".</td></tr><tr><td><code>insecureSkipTLSVerify</code></td><td><em>bool</em></td><td>InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br>This option is insecure and will allow potential Man-In-The-Middle attacks<br>betweem OAuth2 Proxy and the usptream server.<br>Defaults to false.</td></tr><tr><td><code>static</code></td><td><em>bool</em></td><td>Static will make all requests to this upstream have a static response.<br>The response will have a body of "Authenticated" and a response code<br>matching StaticCode.<br>If StaticCode is not set, the response will return a 200 response.</td></tr><tr><td><code>staticCode</code></td><td><em>int</em></td><td>StaticCode determines the response code for the Static response.<br>This option can only be used with Static enabled.</td></tr><tr><td><code>flushInterval</code></td><td><em><a href="#duration">Duration</a></em></td><td>FlushInterval is the period between flushing the response buffer when<br>streaming response from the upstream.<br>Defaults to 1 second.</td></tr><tr><td><code>passHostHeader</code></td><td><em>bool</em></td><td>PassHostHeader determines whether the request host header should be proxied<br>to the upstream server.<br>Defaults to true.</td></tr><tr><td><code>proxyWebSockets</code></td><td><em>bool</em></td><td>ProxyWebSockets enables proxying of websockets to upstream servers<br>Defaults to true.</td></tr><tr><td><code>timeout</code></td><td><em><a href="#duration">Duration</a></em></td><td>Timeout is the maximum duration the server will wait for a response from the upstream server.<br>Defaults to 30 seconds.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstreamconfig">UpstreamConfig<a class="hash-link" href="#upstreamconfig" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>UpstreamConfig is a collection of definitions for upstream servers.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>proxyRawPath</code></td><td><em>bool</em></td><td>ProxyRawPath will pass the raw url path to upstream allowing for url's<br>like: "/%2F/" which would otherwise be redirected to "/"</td></tr><tr><td><code>upstreams</code></td><td><em><a href="#upstream">[]Upstream</a></em></td><td>Upstreams represents the configuration for the upstream servers.<br>Requests will be proxied to this upstream if the path matches the request path.</td></tr></tbody></table></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/configuration/alpha_config.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#using-alpha-configuration" class="table-of-contents__link toc-highlight">Using Alpha Configuration</a><ul><li><a href="#converting-configuration-to-the-new-structure" class="table-of-contents__link toc-highlight">Converting configuration to the new structure</a></li></ul></li><li><a href="#removed-options" class="table-of-contents__link toc-highlight">Removed options</a></li><li><a href="#configuration-reference" class="table-of-contents__link toc-highlight">Configuration Reference</a><ul><li><a href="#adfsoptions" class="table-of-contents__link toc-highlight">ADFSOptions</a></li><li><a href="#alphaoptions" class="table-of-contents__link toc-highlight">AlphaOptions</a></li><li><a href="#azureoptions" class="table-of-contents__link toc-highlight">AzureOptions</a></li><li><a href="#bitbucketoptions" class="table-of-contents__link toc-highlight">BitbucketOptions</a></li><li><a href="#claimsource" class="table-of-contents__link toc-highlight">ClaimSource</a></li><li><a href="#duration" class="table-of-contents__link toc-highlight">Duration</a></li><li><a href="#githuboptions" class="table-of-contents__link toc-highlight">GitHubOptions</a></li><li><a href="#gitlaboptions" class="table-of-contents__link toc-highlight">GitLabOptions</a></li><li><a href="#googleoptions" class="table-of-contents__link toc-highlight">GoogleOptions</a></li><li><a href="#header" class="table-of-contents__link toc-highlight">Header</a></li><li><a href="#headervalue" class="table-of-contents__link toc-highlight">HeaderValue</a></li><li><a href="#keycloakoptions" class="table-of-contents__link toc-highlight">KeycloakOptions</a></li><li><a href="#logingovoptions" class="table-of-contents__link toc-highlight">LoginGovOptions</a></li><li><a href="#loginurlparameter" class="table-of-contents__link toc-highlight">LoginURLParameter</a></li><li><a href="#oidcoptions" class="table-of-contents__link toc-highlight">OIDCOptions</a></li><li><a href="#provider" class="table-of-contents__link toc-highlight">Provider</a></li><li><a href="#providertype" class="table-of-contents__link toc-highlight">ProviderType</a></li><li><a href="#providers" class="table-of-contents__link toc-highlight">Providers</a></li><li><a href="#secretsource" class="table-of-contents__link toc-highlight">SecretSource</a></li><li><a href="#server" class="table-of-contents__link toc-highlight">Server</a></li><li><a href="#tls" class="table-of-contents__link toc-highlight">TLS</a></li><li><a href="#urlparameterrule" class="table-of-contents__link toc-highlight">URLParameterRule</a></li><li><a href="#upstream" class="table-of-contents__link toc-highlight">Upstream</a></li><li><a href="#upstreamconfig" class="table-of-contents__link toc-highlight">UpstreamConfig</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/configuration/oauth_provider/index.html b/docs/configuration/oauth_provider/index.html
index c6de01f7..0ae4bb8e 100644
--- a/docs/configuration/oauth_provider/index.html
+++ b/docs/configuration/oauth_provider/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will
<code>Provider</code> instance. Add a new <code>case</code> to
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
new <code>Provider</code>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/configuration/auth.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link toc-highlight">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link toc-highlight">Azure Auth Provider</a></li><li><a href="#adfs-auth-provider" class="table-of-contents__link toc-highlight">ADFS Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link toc-highlight">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link toc-highlight">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link toc-highlight">Keycloak Auth Provider</a></li><li><a href="#keycloak-oidc-auth-provider" class="table-of-contents__link toc-highlight">Keycloak OIDC Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link toc-highlight">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link toc-highlight">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link toc-highlight">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link toc-highlight">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link toc-highlight">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link toc-highlight">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link toc-highlight">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link toc-highlight">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link toc-highlight">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link toc-highlight">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link toc-highlight">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/configuration/overview/index.html b/docs/configuration/overview/index.html
index 4efe5a67..049e742d 100644
--- a/docs/configuration/overview/index.html
+++ b/docs/configuration/overview/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -20,7 +20,7 @@ The default format is configured as follows:</p><div class="codeBlockContainer_I
The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for request logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestDuration</td><td>0.001</td><td>The time in seconds that a request took to process.</td></tr><tr><td>RequestID</td><td>00010203-0405-4607-8809-0a0b0c0d0e0f</td><td>The request ID pulled from the <code>--request-id-header</code>. Random UUID if empty</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>RequestURI</td><td>"/oauth2/auth"</td><td>The URI path of the request.</td></tr><tr><td>ResponseSize</td><td>12</td><td>The size in bytes of the response.</td></tr><tr><td>StatusCode</td><td>200</td><td>The HTTP status code of the response.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>Upstream</td><td>-</td><td>The upstream data of the HTTP request.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="standard-log-format">Standard Log Format<a class="hash-link" href="#standard-log-format" title="Direct link to heading">​</a></h3><p>All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you require a different format than that, you can configure it with the <code>--standard-logging-format</code> flag. The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[{{.Timestamp}}] [{{.File}}] {{.Message}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for standard logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>File</td><td>main.go:40</td><td>The file and line number of the logging statement.</td></tr><tr><td>Message</td><td>HTTP: listening on 127.0.0.1:4180</td><td>The details of the log statement.</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-nginx-auth_request-directive">Configuring for use with the Nginx <code>auth_request</code> directive<a class="hash-link" href="#configuring-for-use-with-the-nginx-auth_request-directive" title="Direct link to heading">​</a></h2><p>The <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" target="_blank" rel="noopener noreferrer">Nginx <code>auth_request</code> directive</a> allows Nginx to authenticate requests via the oauth2-proxy's <code>/auth</code> endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:</p><div class="codeBlockContainer_I0IT language-nginx theme-code-block"><div class="codeBlockContent_wNvx nginx"><pre tabindex="0" class="prism-code language-nginx codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name ...;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> include ssl/ssl.conf;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location /oauth2/ {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Auth-Request-Redirect $request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or, if you are handling multiple domains:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location = /oauth2/auth {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # nginx auth_request includes headers but not body</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Content-Length "";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass_request_body off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request /oauth2/auth;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> error_page 401 = /oauth2/sign_in;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # pass information via X-User and X-Email headers to backend,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # requires running with --set-xauthrequest flag</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $user $upstream_http_x_auth_request_user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $email $upstream_http_x_auth_request_email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-User $user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Email $email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --pass-access-token, this will pass the token to the backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $token $upstream_http_x_auth_request_access_token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Access-Token $token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --cookie-refresh, this is needed for it to work with auth_request</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie $upstream_http_set_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # limit and so the OAuth2 Proxy splits these into multiple parts.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Extract the Cookie attributes from the first Set-Cookie header and append them</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # to the second part ($upstream_cookie_* variables only contain the raw cookie content)</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie ~* "(; .*)") {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_0 $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Send both Set-Cookie headers now if there was a second part</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie_name_upstream_1) {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_0;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://backend/;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or "root /path/to/site;" or "fastcgi_pass ..." etc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>When you use ingress-nginx in Kubernetes, you MUST use <code>kubernetes/ingress-nginx</code> (which includes the Lua module) and the following configuration snippet for your <code>Ingress</code>.
Variables set with <code>auth_request_set</code> are not <code>set</code>-able in plain nginx config when the location is processed via <code>proxy_pass</code> and then may only be processed by Lua.
Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)"> auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ngx.var.name_upstream_1 ~= "" then</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">"Set-Cookie"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match("(; .</span><span class="token important">*)")</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> end</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".</p><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-traefik-v2-forwardauth-middleware">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware<a class="hash-link" href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" title="Direct link to heading">​</a></h2><p><strong>This option requires <code>--reverse-proxy</code> option to be set.</strong></p><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-401-errors-middleware">ForwardAuth with 401 errors middleware<a class="hash-link" href="#forwardauth-with-401-errors-middleware" title="Direct link to heading">​</a></h3><p>The <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> allows Traefik to authenticate requests via the oauth2-proxy's <code>/oauth2/auth</code> endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">errors</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">status</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"401-403"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">query</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"/oauth2/sign_in"</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-static-upstreams-configuration">ForwardAuth with static upstreams configuration<a class="hash-link" href="#forwardauth-with-static-upstreams-configuration" title="Direct link to heading">​</a></h3><p>Redirect to sign_in functionality provided without the use of <code>errors</code> middleware with <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> pointing to oauth2-proxy service's <code>/</code> endpoint</p><p><strong>Following options need to be set on <code>oauth2-proxy</code>:</strong></p><ul><li><code>--upstream=static://202</code>: Configures a static response for authenticated sessions</li><li><code>--reverse-proxy=true</code>: Enables the use of <code>X-Forwarded-*</code> headers to determine redirects correctly</li></ul><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># redirects all unauthenticated to oauth2 signin</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">wo</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># unauthenticated session will return a 401</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services-oauth2-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth2-proxy-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`oauth.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/configuration/overview.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link toc-highlight">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link toc-highlight">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link toc-highlight">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link toc-highlight">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link toc-highlight">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link toc-highlight">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link toc-highlight">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link toc-highlight">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link toc-highlight">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link toc-highlight">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link toc-highlight">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link toc-highlight">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link toc-highlight">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/configuration/session_storage/index.html b/docs/configuration/session_storage/index.html
index dc9f3544..5da26982 100644
--- a/docs/configuration/session_storage/index.html
+++ b/docs/configuration/session_storage/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -26,7 +26,7 @@ disclosure.</p><h4 class="anchor anchorWithStickyNavbar_mojV" id="usage">Usage<a
<code>--redis-use-sentinel=true</code> flag, as well as configure the flags <code>--redis-sentinel-master-name</code>
and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/configuration/tls/index.html b/docs/configuration/tls/index.html
index 81e4723f..5de81543 100644
--- a/docs/configuration/tls/index.html
+++ b/docs/configuration/tls/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations:"><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -19,7 +19,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use <c
<code>oauth2-proxy</code> will then authenticate requests for an upstream application. The external endpoint for this example
would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx config follows. Note the use of <code>Strict-Transport-Security</code> header to pin requests to SSL
via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 default ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name internal.yourcompany.com;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /path/to/cert.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /path/to/cert.key;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Strict-Transport-Security max-age=2592000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_connect_timeout 1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_send_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li><li><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="codeBlockContainer_I0IT language-bash theme-code-block"><div class="codeBlockContent_wNvx bash"><pre tabindex="0" class="prism-code language-bash codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">"yourcompany.com"</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/configuration/tls.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/alpha-config"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Alpha Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#terminate-tls-at-oauth2-proxy" class="table-of-contents__link toc-highlight">Terminate TLS at OAuth2 Proxy</a></li><li><a href="#terminate-tls-at-reverse-proxy-eg-nginx" class="table-of-contents__link toc-highlight">Terminate TLS at Reverse Proxy, e.g. Nginx</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/features/endpoints/index.html b/docs/features/endpoints/index.html
index b0a014aa..afafb788 100644
--- a/docs/features/endpoints/index.html
+++ b/docs/features/endpoints/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/">7.3.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/features/endpoints">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/features/endpoints">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/features/endpoints">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.3.x</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Endpoints</h1></header><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by <code>--metrics-address</code>, disabled by default</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user's email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3 class="anchor anchorWithStickyNavbar_mojV" id="sign-out">Sign out<a class="hash-link" href="#sign-out" title="Direct link to heading">​</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">...</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>(The "sign_out_page" should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="auth">Auth<a class="hash-link" href="#auth" title="Direct link to heading">​</a></h3><p>This endpoint returns 202 Accepted response or a 401 Unauthorized response.</p><p>It can be configured using the following query parameters query parameters:</p><ul><li><code>allowed_groups</code>: comma separated list of allowed groups</li><li><code>allowed_email_domains</code>: comma separated list of allowed email domains</li><li><code>allowed_emails</code>: comma separated list of allowed emails</li></ul></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/features/endpoints.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link toc-highlight">Sign out</a></li><li><a href="#auth" class="table-of-contents__link toc-highlight">Auth</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/index.html b/docs/index.html
index 6dd391ee..25d4b76a 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1. Choose how to deploy:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/">7.3.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.3.x</span><div class="theme-doc-markdown markdown"><header><h1>Installation</h1></header><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.3.0</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p><p>d. Using a <a href="https://github.com/oauth2-proxy/manifests" target="_blank" rel="noopener noreferrer">Kubernetes manifest</a> (Helm)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/installation.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/behaviour/index.html b/docs/next/behaviour/index.html
index f6049806..8d558843 100644
--- a/docs/next/behaviour/index.html
+++ b/docs/next/behaviour/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Behaviour | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Behaviour | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><meta data-react-helmet="true" property="og:description" content="1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/behaviour" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/behaviour">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/behaviour">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/behaviour">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/behaviour">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/behaviour">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/behaviour">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for <!-- -->OAuth2 Proxy<!-- --> <b>Next</b> version.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/behaviour">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->Next</span><div class="theme-doc-markdown markdown"><header><h1>Behaviour</h1></header><ol><li>Any request passing through the proxy (and not matched by <code>--skip-auth-regex</code>) is checked for the proxy's session cookie (<code>--cookie-name</code>) (or, if allowed, a JWT token - see <code>--skip-jwt-bearer-tokens</code>).</li><li>If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with <code>Accept: application/json</code>, in which case 401 Unauthorized is returned)</li><li>After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set</li><li>The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)</li></ol><p>Notice that the proxy also provides a number of useful <a href="/oauth2-proxy/docs/next/features/endpoints">endpoints</a>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/behaviour.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Installation</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/overview"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overview</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/community/security/index.html b/docs/next/community/security/index.html
index 148802cc..774f0710 100644
--- a/docs/next/community/security/index.html
+++ b/docs/next/community/security/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay
merging fixes until all patches are ready.
We may also backport the fix to previous releases,
but this will be at the discretion of the maintainers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/community/security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link toc-highlight">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link toc-highlight">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/configuration/alpha-config/index.html b/docs/next/configuration/alpha-config/index.html
index ef065ecd..4886b471 100644
--- a/docs/next/configuration/alpha-config/index.html
+++ b/docs/next/configuration/alpha-config/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Alpha Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Alpha Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="This page contains documentation for alpha features."><meta data-react-helmet="true" property="og:description" content="This page contains documentation for alpha features."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/alpha-config" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -63,7 +63,7 @@ passed to the <code>/oauth2/start</code> endpoint are checked to determine wheth
they are valid overrides for the given parameter passed to the IdP's
login URL. Either Value or Pattern should be supplied, not both.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>value</code></td><td><em>string</em></td><td>A Value rule matches just this specific value</td></tr><tr><td><code>pattern</code></td><td><em>string</em></td><td>A Pattern rule gives a regular expression that must be matched by<br>some substring of the value. The expression is <em>not</em> automatically<br>anchored to the start and end of the value, if you <em>want</em> to restrict<br>the whole parameter value you must anchor it yourself with <code>^</code> and <code>$</code>.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstream">Upstream<a class="hash-link" href="#upstream" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#upstreamconfig">UpstreamConfig</a>)</p><p>Upstream represents the configuration for an upstream server.
Requests will be proxied to this upstream if the path matches the request path.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>id</code></td><td><em>string</em></td><td>ID should be a unique identifier for the upstream.<br>This value is required for all upstreams.</td></tr><tr><td><code>path</code></td><td><em>string</em></td><td>Path is used to map requests to the upstream server.<br>The closest match will take precedence and all Paths must be unique.<br>Path can also take a pattern when used with RewriteTarget.<br>Path segments can be captured and matched using regular experessions.<br>Eg:<br>- <code>^/foo$</code>: Match only the explicit path <code>/foo</code><br>- <code>^/bar/$</code>: Match any path prefixed with <code>/bar/</code><br>- <code>^/baz/(.*)$</code>: Match any path prefixed with <code>/baz</code> and capture the remaining path for use with RewriteTarget</td></tr><tr><td><code>rewriteTarget</code></td><td><em>string</em></td><td>RewriteTarget allows users to rewrite the request path before it is sent to<br>the upstream server.<br>Use the Path to capture segments for reuse within the rewrite target.<br>Eg: With a Path of <code>^/baz/(.*)</code>, a RewriteTarget of <code>/foo/$1</code> would rewrite<br>the request <code>/baz/abc/123</code> to <code>/foo/abc/123</code> before proxying to the<br>upstream server.</td></tr><tr><td><code>uri</code></td><td><em>string</em></td><td>The URI of the upstream server. This may be an HTTP(S) server of a File<br>based URL. It may include a path, in which case all requests will be served<br>under that path.<br>Eg:<br>- http://localhost:8080<br>- <a href="https://service.localhost" target="_blank" rel="noopener noreferrer">https://service.localhost</a><br>- <a href="https://service.localhost/path" target="_blank" rel="noopener noreferrer">https://service.localhost/path</a><br>- file://host/path<br>If the URI's path is "/base" and the incoming request was for "/dir",<br>the upstream request will be for "/base/dir".</td></tr><tr><td><code>insecureSkipTLSVerify</code></td><td><em>bool</em></td><td>InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br>This option is insecure and will allow potential Man-In-The-Middle attacks<br>betweem OAuth2 Proxy and the usptream server.<br>Defaults to false.</td></tr><tr><td><code>static</code></td><td><em>bool</em></td><td>Static will make all requests to this upstream have a static response.<br>The response will have a body of "Authenticated" and a response code<br>matching StaticCode.<br>If StaticCode is not set, the response will return a 200 response.</td></tr><tr><td><code>staticCode</code></td><td><em>int</em></td><td>StaticCode determines the response code for the Static response.<br>This option can only be used with Static enabled.</td></tr><tr><td><code>flushInterval</code></td><td><em><a href="#duration">Duration</a></em></td><td>FlushInterval is the period between flushing the response buffer when<br>streaming response from the upstream.<br>Defaults to 1 second.</td></tr><tr><td><code>passHostHeader</code></td><td><em>bool</em></td><td>PassHostHeader determines whether the request host header should be proxied<br>to the upstream server.<br>Defaults to true.</td></tr><tr><td><code>proxyWebSockets</code></td><td><em>bool</em></td><td>ProxyWebSockets enables proxying of websockets to upstream servers<br>Defaults to true.</td></tr><tr><td><code>timeout</code></td><td><em><a href="#duration">Duration</a></em></td><td>Timeout is the maximum duration the server will wait for a response from the upstream server.<br>Defaults to 30 seconds.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="upstreamconfig">UpstreamConfig<a class="hash-link" href="#upstreamconfig" title="Direct link to heading">​</a></h3><p>(<strong>Appears on:</strong> <a href="#alphaoptions">AlphaOptions</a>)</p><p>UpstreamConfig is a collection of definitions for upstream servers.</p><table><thead><tr><th>Field</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>proxyRawPath</code></td><td><em>bool</em></td><td>ProxyRawPath will pass the raw url path to upstream allowing for url's<br>like: "/%2F/" which would otherwise be redirected to "/"</td></tr><tr><td><code>upstreams</code></td><td><em><a href="#upstream">[]Upstream</a></em></td><td>Upstreams represents the configuration for the upstream servers.<br>Requests will be proxied to this upstream if the path matches the request path.</td></tr></tbody></table></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/alpha_config.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/tls"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">TLS Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/features/endpoints"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Endpoints</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#using-alpha-configuration" class="table-of-contents__link toc-highlight">Using Alpha Configuration</a><ul><li><a href="#converting-configuration-to-the-new-structure" class="table-of-contents__link toc-highlight">Converting configuration to the new structure</a></li></ul></li><li><a href="#removed-options" class="table-of-contents__link toc-highlight">Removed options</a></li><li><a href="#configuration-reference" class="table-of-contents__link toc-highlight">Configuration Reference</a><ul><li><a href="#adfsoptions" class="table-of-contents__link toc-highlight">ADFSOptions</a></li><li><a href="#alphaoptions" class="table-of-contents__link toc-highlight">AlphaOptions</a></li><li><a href="#azureoptions" class="table-of-contents__link toc-highlight">AzureOptions</a></li><li><a href="#bitbucketoptions" class="table-of-contents__link toc-highlight">BitbucketOptions</a></li><li><a href="#claimsource" class="table-of-contents__link toc-highlight">ClaimSource</a></li><li><a href="#duration" class="table-of-contents__link toc-highlight">Duration</a></li><li><a href="#githuboptions" class="table-of-contents__link toc-highlight">GitHubOptions</a></li><li><a href="#gitlaboptions" class="table-of-contents__link toc-highlight">GitLabOptions</a></li><li><a href="#googleoptions" class="table-of-contents__link toc-highlight">GoogleOptions</a></li><li><a href="#header" class="table-of-contents__link toc-highlight">Header</a></li><li><a href="#headervalue" class="table-of-contents__link toc-highlight">HeaderValue</a></li><li><a href="#keycloakoptions" class="table-of-contents__link toc-highlight">KeycloakOptions</a></li><li><a href="#logingovoptions" class="table-of-contents__link toc-highlight">LoginGovOptions</a></li><li><a href="#loginurlparameter" class="table-of-contents__link toc-highlight">LoginURLParameter</a></li><li><a href="#oidcoptions" class="table-of-contents__link toc-highlight">OIDCOptions</a></li><li><a href="#provider" class="table-of-contents__link toc-highlight">Provider</a></li><li><a href="#providertype" class="table-of-contents__link toc-highlight">ProviderType</a></li><li><a href="#providers" class="table-of-contents__link toc-highlight">Providers</a></li><li><a href="#secretsource" class="table-of-contents__link toc-highlight">SecretSource</a></li><li><a href="#server" class="table-of-contents__link toc-highlight">Server</a></li><li><a href="#tls" class="table-of-contents__link toc-highlight">TLS</a></li><li><a href="#urlparameterrule" class="table-of-contents__link toc-highlight">URLParameterRule</a></li><li><a href="#upstream" class="table-of-contents__link toc-highlight">Upstream</a></li><li><a href="#upstreamconfig" class="table-of-contents__link toc-highlight">UpstreamConfig</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/configuration/oauth_provider/index.html b/docs/next/configuration/oauth_provider/index.html
index b3a98ee0..65f7cf9b 100644
--- a/docs/next/configuration/oauth_provider/index.html
+++ b/docs/next/configuration/oauth_provider/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/oauth_provider">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/oauth_provider">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/configuration/oauth_provider">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/configuration/oauth_provider">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/oauth_provider">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/next/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for <!-- -->OAuth2 Proxy<!-- --> <b>Next</b> version.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/configuration/oauth_provider">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->Next</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>OAuth Provider Configuration</h1></header><p>You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run <code>oauth2-proxy</code> on.</p><p>Valid providers are :</p><ul><li><a href="#google-auth-provider">Google</a> <em>default</em></li><li><a href="#azure-auth-provider">Azure</a></li><li><a href="#adfs-auth-provider">ADFS</a></li><li><a href="#facebook-auth-provider">Facebook</a></li><li><a href="#github-auth-provider">GitHub</a></li><li><a href="#keycloak-auth-provider">Keycloak</a></li><li><a href="#gitlab-auth-provider">GitLab</a></li><li><a href="#linkedin-auth-provider">LinkedIn</a></li><li><a href="#microsoft-azure-ad-provider">Microsoft Azure AD</a></li><li><a href="#openid-connect-provider">OpenID Connect</a></li><li><a href="#logingov-provider">login.gov</a></li><li><a href="#nextcloud-provider">Nextcloud</a></li><li><a href="#digitalocean-auth-provider">DigitalOcean</a></li><li><a href="#bitbucket-auth-provider">Bitbucket</a></li><li><a href="#gitea-auth-provider">Gitea</a></li></ul><p>The provider can be selected using the <code>provider</code> configuration value.</p><p>Please note that not all providers support all claims. The <code>preferred_username</code> claim is currently only supported by the OpenID Connect provider.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="google-auth-provider">Google Auth Provider<a class="hash-link" href="#google-auth-provider" title="Direct link to heading">​</a></h3><p>For Google, the registration steps are:</p><ol><li>Create a new project: <a href="https://console.developers.google.com/project" target="_blank" rel="noopener noreferrer">https://console.developers.google.com/project</a></li><li>Choose the new project from the top right project dropdown (only if another project is selected)</li><li>In the project Dashboard center pane, choose <strong>"API Manager"</strong></li><li>In the left Nav pane, choose <strong>"Credentials"</strong></li><li>In the center pane, choose <strong>"OAuth consent screen"</strong> tab. Fill in <strong>"Product name shown to users"</strong> and hit save.</li><li>In the center pane, choose <strong>"Credentials"</strong> tab.<ul><li>Open the <strong>"New credentials"</strong> drop down</li><li>Choose <strong>"OAuth client ID"</strong></li><li>Choose <strong>"Web application"</strong></li><li>Application name is freeform, choose something appropriate</li><li>Authorized JavaScript origins is your domain ex: <code>https://internal.yourcompany.com</code></li><li>Authorized redirect URIs is the location of oauth2/callback ex: <code>https://internal.yourcompany.com/oauth2/callback</code></li><li>Choose <strong>"Create"</strong></li></ul></li><li>Take note of the <strong>Client ID</strong> and <strong>Client Secret</strong></li></ol><p>It's recommended to refresh sessions on a short interval (1h) with <code>cookie-refresh</code> setting which validates that the account is still authorized.</p><h4 class="anchor anchorWithStickyNavbar_mojV" id="restrict-auth-to-specific-google-groups-on-your-domain-optional">Restrict auth to specific Google groups on your domain. (optional)<a class="hash-link" href="#restrict-auth-to-specific-google-groups-on-your-domain-optional" title="Direct link to heading">​</a></h4><ol><li>Create a service account: <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount" target="_blank" rel="noopener noreferrer">https://developers.google.com/identity/protocols/OAuth2ServiceAccount</a> and make sure to download the json file.</li><li>Make note of the Client ID for a future step.</li><li>Under "APIs & Auth", choose APIs.</li><li>Click on Admin SDK and then Enable API.</li><li>Follow the steps on <a href="https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account" target="_blank" rel="noopener noreferrer">https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account</a> and give the client id from step 2 the following oauth scopes:</li></ol><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.group.readonly</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.user.readonly</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><ol start="6"><li>Follow the steps on <a href="https://support.google.com/a/answer/60757" target="_blank" rel="noopener noreferrer">https://support.google.com/a/answer/60757</a> to enable Admin API access.</li><li>Create or choose an existing administrative email address on the Gmail domain to assign to the <code>google-admin-email</code> flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.</li><li>Create or choose an existing email group and set that email to the <code>google-group</code> flag. You can pass multiple instances of this flag with different groups
-and the user will be checked against all the provided groups.</li><li>Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the <code>google-service-account-json</code> flag.</li><li>Restart oauth2-proxy.</li></ol><p>Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="azure-auth-provider">Azure Auth Provider<a class="hash-link" href="#azure-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Add an application: go to <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">https://portal.azure.com</a>, choose <strong>"Azure Active Directory"</strong> in the left menu, select <strong>"App registrations"</strong> and then click on <strong>"New app registration"</strong>.</li><li>Pick a name and choose <strong>"Webapp / API"</strong> as application type. Use <code>https://internal.yourcompany.com</code> as Sign-on URL. Click <strong>"Create"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Properties"</strong> page of the app, pick a logo and select <strong>"Multi-tenanted"</strong> if you want to allow users from multiple organizations to access your app. Note down the application ID. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Required Permissions"</strong> page of the app, click on <strong>"Windows Azure Active Directory"</strong> and then on <strong>"Access the directory as the signed in user"</strong>. Hit <strong>"Save"</strong> and then then on <strong>"Grant permissions"</strong> (you might need another admin to do this).</li><li>On the <strong>"Settings"</strong> / <strong>"Reply URLs"</strong> page of the app, add <code>https://internal.yourcompanycom/oauth2/callback</code> for each host that you want to protect by the oauth2 proxy. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Keys"</strong> page of the app, add a new key and note down the value after hitting <strong>"Save"</strong>.</li><li>Configure the proxy with</li></ol><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=azure</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<application ID from step 3></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<value from step 6></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --oidc-issuer-url=https://sts.windows.net/{tenant-id}/</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <a href="/oauth2-proxy/docs/next/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="adfs-auth-provider">ADFS Auth Provider<a class="hash-link" href="#adfs-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Open the ADFS administration console on your Windows Server and add a new Application Group</li><li>Provide a name for the integration, select Server Application from the Standalone applications section and click Next</li><li>Follow the wizard to get the client-id, client-secret and configure the application credentials</li><li>Configure the proxy with</li></ol><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=adfs</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<application ID from step 3></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<value from step 3></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <a href="/oauth2-proxy/docs/next/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="facebook-auth-provider">Facebook Auth Provider<a class="hash-link" href="#facebook-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Create a new FB App from <a href="https://developers.facebook.com/" target="_blank" rel="noopener noreferrer">https://developers.facebook.com/</a></li><li>Under FB Login, set your Valid OAuth redirect URIs to <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><h3 class="anchor anchorWithStickyNavbar_mojV" id="github-auth-provider">GitHub Auth Provider<a class="hash-link" href="#github-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Create a new project: <a href="https://github.com/settings/developers" target="_blank" rel="noopener noreferrer">https://github.com/settings/developers</a></li><li>Under <code>Authorization callback URL</code> enter the correct url ie <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><p>The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with <code>--email-domain=*</code></p><p>NOTE: When <code>--github-user</code> is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.</p><p>To restrict by organization only, include the following flag:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-org="": restrict logins to members of this organisation</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>To restrict within an organization to specific teams, include the following flag in addition to <code>-github-org</code>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-team="": restrict logins to members of any of these teams (slug), separated by a comma</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you'd like to allow access to users with <strong>read only</strong> access to a <strong>public</strong> repository you will need to provide a <a href="https://github.com/settings/tokens" target="_blank" rel="noopener noreferrer">token</a> for a user that has write access to the repository. The token must be created with at least the <code>public_repo</code> scope:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-token="": the token to use when verifying repository collaborators</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-user="": allow logins by username, separated by a comma</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you are using GitHub enterprise, make sure you set the following to the appropriate url:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-login-url="http(s)://<enterprise github host>/login/oauth/authorize"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-validate-url="http(s)://<enterprise github host>/api/v3"</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3 class="anchor anchorWithStickyNavbar_mojV" id="keycloak-auth-provider">Keycloak Auth Provider<a class="hash-link" href="#keycloak-auth-provider" title="Direct link to heading">​</a></h3><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>This is the legacy provider for Keycloak, use <a href="#keycloak-oidc-auth-provider">Keycloak OIDC Auth Provider</a> if possible.</p></div></div><ol><li>Create new client in your Keycloak realm with <strong>Access Type</strong> 'confidental' and <strong>Valid Redirect URIs</strong> '<a href="https://internal.yourcompany.com/oauth2/callback'" target="_blank" rel="noopener noreferrer">https://internal.yourcompany.com/oauth2/callback'</a></li><li>Take note of the Secret in the credential tab of the client</li><li>Create a mapper with <strong>Mapper Type</strong> 'Group Membership' and <strong>Token Claim Name</strong> 'groups'.</li></ol><p>Make sure you set the following to the appropriate url:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=keycloak</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<client you have created></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<your client's secret></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --keycloak-group=<first_allowed_user_group></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --keycloak-group=<second_allowed_user_group></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>For group based authorization, the optional <code>--keycloak-group</code> (legacy) or <code>--allowed-group</code> (global standard)
+and the user will be checked against all the provided groups.</li><li>Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the <code>google-service-account-json</code> flag.</li><li>Restart oauth2-proxy.</li></ol><p>Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="azure-auth-provider">Azure Auth Provider<a class="hash-link" href="#azure-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Add an application: go to <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">https://portal.azure.com</a>, choose <strong>"Azure Active Directory"</strong> in the left menu, select <strong>"App registrations"</strong> and then click on <strong>"New app registration"</strong>.</li><li>Pick a name and choose <strong>"Webapp / API"</strong> as application type. Use <code>https://internal.yourcompany.com</code> as Sign-on URL. Click <strong>"Create"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Properties"</strong> page of the app, pick a logo and select <strong>"Multi-tenanted"</strong> if you want to allow users from multiple organizations to access your app. Note down the application ID. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"API Permissions"</strong> page of the app, click on <strong>"Add a permission"</strong>, then select <strong>"Microsoft Graph"</strong>, then <strong>"Delegated permissions"</strong> and finally check the <strong>"openid (Sign users in)"</strong> permission. Hit <strong>"Save"</strong> and then on <strong>"Grant permissions"</strong> (you might need another admin to do this).<br>**IMPORTANT**: Even if this permission is listed with **"Admin consent required=No"** the consent might actually be required, due to AAD policies you won't be able to see. If you get a **"Need admin approval"** during login, most likely this is what you're missing!</li><li>On the <strong>"Settings"</strong> / <strong>"Reply URLs"</strong> page of the app, add <code>https://internal.yourcompanycom/oauth2/callback</code> for each host that you want to protect by the oauth2 proxy. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Keys"</strong> page of the app, add a new key and note down the value after hitting <strong>"Save"</strong>.</li><li>Configure the proxy with</li></ol><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=azure</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<application ID from step 3></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<value from step 6></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --oidc-issuer-url=https://sts.windows.net/{tenant-id}/</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <a href="/oauth2-proxy/docs/next/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="adfs-auth-provider">ADFS Auth Provider<a class="hash-link" href="#adfs-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Open the ADFS administration console on your Windows Server and add a new Application Group</li><li>Provide a name for the integration, select Server Application from the Standalone applications section and click Next</li><li>Follow the wizard to get the client-id, client-secret and configure the application credentials</li><li>Configure the proxy with</li></ol><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=adfs</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<application ID from step 3></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<value from step 3></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <a href="/oauth2-proxy/docs/next/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="facebook-auth-provider">Facebook Auth Provider<a class="hash-link" href="#facebook-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Create a new FB App from <a href="https://developers.facebook.com/" target="_blank" rel="noopener noreferrer">https://developers.facebook.com/</a></li><li>Under FB Login, set your Valid OAuth redirect URIs to <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><h3 class="anchor anchorWithStickyNavbar_mojV" id="github-auth-provider">GitHub Auth Provider<a class="hash-link" href="#github-auth-provider" title="Direct link to heading">​</a></h3><ol><li>Create a new project: <a href="https://github.com/settings/developers" target="_blank" rel="noopener noreferrer">https://github.com/settings/developers</a></li><li>Under <code>Authorization callback URL</code> enter the correct url ie <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><p>The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with <code>--email-domain=*</code></p><p>NOTE: When <code>--github-user</code> is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.</p><p>To restrict by organization only, include the following flag:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-org="": restrict logins to members of this organisation</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>To restrict within an organization to specific teams, include the following flag in addition to <code>-github-org</code>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-team="": restrict logins to members of any of these teams (slug), separated by a comma</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you'd like to allow access to users with <strong>read only</strong> access to a <strong>public</strong> repository you will need to provide a <a href="https://github.com/settings/tokens" target="_blank" rel="noopener noreferrer">token</a> for a user that has write access to the repository. The token must be created with at least the <code>public_repo</code> scope:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-token="": the token to use when verifying repository collaborators</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-github-user="": allow logins by username, separated by a comma</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you are using GitHub enterprise, make sure you set the following to the appropriate url:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-login-url="http(s)://<enterprise github host>/login/oauth/authorize"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-validate-url="http(s)://<enterprise github host>/api/v3"</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3 class="anchor anchorWithStickyNavbar_mojV" id="keycloak-auth-provider">Keycloak Auth Provider<a class="hash-link" href="#keycloak-auth-provider" title="Direct link to heading">​</a></h3><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>This is the legacy provider for Keycloak, use <a href="#keycloak-oidc-auth-provider">Keycloak OIDC Auth Provider</a> if possible.</p></div></div><ol><li>Create new client in your Keycloak realm with <strong>Access Type</strong> 'confidental' and <strong>Valid Redirect URIs</strong> '<a href="https://internal.yourcompany.com/oauth2/callback'" target="_blank" rel="noopener noreferrer">https://internal.yourcompany.com/oauth2/callback'</a></li><li>Take note of the Secret in the credential tab of the client</li><li>Create a mapper with <strong>Mapper Type</strong> 'Group Membership' and <strong>Token Claim Name</strong> 'groups'.</li></ol><p>Make sure you set the following to the appropriate url:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=keycloak</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<client you have created></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<your client's secret></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --keycloak-group=<first_allowed_user_group></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --keycloak-group=<second_allowed_user_group></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>For group based authorization, the optional <code>--keycloak-group</code> (legacy) or <code>--allowed-group</code> (global standard)
flags can be used to specify which groups to limit access to.</p><p>If these are unset but a <code>groups</code> mapper is set up above in step (3), the provider will still
populate the <code>X-Forwarded-Groups</code> header to your upstream server with the <code>groups</code> data in the
Keycloak userinfo endpoint response.</p><p>The group management in keycloak is using a tree. If you create a group named admin in keycloak
@@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will
<code>Provider</code> instance. Add a new <code>case</code> to
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
new <code>Provider</code>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link toc-highlight">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link toc-highlight">Azure Auth Provider</a></li><li><a href="#adfs-auth-provider" class="table-of-contents__link toc-highlight">ADFS Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link toc-highlight">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link toc-highlight">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link toc-highlight">Keycloak Auth Provider</a></li><li><a href="#keycloak-oidc-auth-provider" class="table-of-contents__link toc-highlight">Keycloak OIDC Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link toc-highlight">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link toc-highlight">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link toc-highlight">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link toc-highlight">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link toc-highlight">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link toc-highlight">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link toc-highlight">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link toc-highlight">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link toc-highlight">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link toc-highlight">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link toc-highlight">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/configuration/overview/index.html b/docs/next/configuration/overview/index.html
index 1f960730..a01798ce 100644
--- a/docs/next/configuration/overview/index.html
+++ b/docs/next/configuration/overview/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Overview | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><meta data-react-helmet="true" property="og:description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/overview" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -20,7 +20,7 @@ The default format is configured as follows:</p><div class="codeBlockContainer_I
The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for request logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestDuration</td><td>0.001</td><td>The time in seconds that a request took to process.</td></tr><tr><td>RequestID</td><td>00010203-0405-4607-8809-0a0b0c0d0e0f</td><td>The request ID pulled from the <code>--request-id-header</code>. Random UUID if empty</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>RequestURI</td><td>"/oauth2/auth"</td><td>The URI path of the request.</td></tr><tr><td>ResponseSize</td><td>12</td><td>The size in bytes of the response.</td></tr><tr><td>StatusCode</td><td>200</td><td>The HTTP status code of the response.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>Upstream</td><td>-</td><td>The upstream data of the HTTP request.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_mojV" id="standard-log-format">Standard Log Format<a class="hash-link" href="#standard-log-format" title="Direct link to heading">​</a></h3><p>All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE></span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>If you require a different format than that, you can configure it with the <code>--standard-logging-format</code> flag. The default format is configured as follows:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[{{.Timestamp}}] [{{.File}}] {{.Message}}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Available variables for standard logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>File</td><td>main.go:40</td><td>The file and line number of the logging statement.</td></tr><tr><td>Message</td><td>HTTP: listening on 127.0.0.1:4180</td><td>The details of the log statement.</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-nginx-auth_request-directive">Configuring for use with the Nginx <code>auth_request</code> directive<a class="hash-link" href="#configuring-for-use-with-the-nginx-auth_request-directive" title="Direct link to heading">​</a></h2><p>The <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" target="_blank" rel="noopener noreferrer">Nginx <code>auth_request</code> directive</a> allows Nginx to authenticate requests via the oauth2-proxy's <code>/auth</code> endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:</p><div class="codeBlockContainer_I0IT language-nginx theme-code-block"><div class="codeBlockContent_wNvx nginx"><pre tabindex="0" class="prism-code language-nginx codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name ...;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> include ssl/ssl.conf;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location /oauth2/ {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Auth-Request-Redirect $request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or, if you are handling multiple domains:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location = /oauth2/auth {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # nginx auth_request includes headers but not body</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Content-Length "";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass_request_body off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request /oauth2/auth;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> error_page 401 = /oauth2/sign_in;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # pass information via X-User and X-Email headers to backend,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # requires running with --set-xauthrequest flag</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $user $upstream_http_x_auth_request_user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $email $upstream_http_x_auth_request_email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-User $user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Email $email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --pass-access-token, this will pass the token to the backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $token $upstream_http_x_auth_request_access_token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Access-Token $token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --cookie-refresh, this is needed for it to work with auth_request</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie $upstream_http_set_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # limit and so the OAuth2 Proxy splits these into multiple parts.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Extract the Cookie attributes from the first Set-Cookie header and append them</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # to the second part ($upstream_cookie_* variables only contain the raw cookie content)</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie ~* "(; .*)") {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_0 $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Send both Set-Cookie headers now if there was a second part</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie_name_upstream_1) {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_0;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://backend/;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or "root /path/to/site;" or "fastcgi_pass ..." etc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>When you use ingress-nginx in Kubernetes, you MUST use <code>kubernetes/ingress-nginx</code> (which includes the Lua module) and the following configuration snippet for your <code>Ingress</code>.
Variables set with <code>auth_request_set</code> are not <code>set</code>-able in plain nginx config when the location is processed via <code>proxy_pass</code> and then may only be processed by Lua.
Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)"> auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ngx.var.name_upstream_1 ~= "" then</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">"Set-Cookie"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match("(; .</span><span class="token important">*)")</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> end</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".</p><h2 class="anchor anchorWithStickyNavbar_mojV" id="configuring-for-use-with-the-traefik-v2-forwardauth-middleware">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware<a class="hash-link" href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" title="Direct link to heading">​</a></h2><p><strong>This option requires <code>--reverse-proxy</code> option to be set.</strong></p><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-401-errors-middleware">ForwardAuth with 401 errors middleware<a class="hash-link" href="#forwardauth-with-401-errors-middleware" title="Direct link to heading">​</a></h3><p>The <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> allows Traefik to authenticate requests via the oauth2-proxy's <code>/oauth2/auth</code> endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:</p><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">errors</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">status</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"401-403"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">query</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"/oauth2/sign_in"</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3 class="anchor anchorWithStickyNavbar_mojV" id="forwardauth-with-static-upstreams-configuration">ForwardAuth with static upstreams configuration<a class="hash-link" href="#forwardauth-with-static-upstreams-configuration" title="Direct link to heading">​</a></h3><p>Redirect to sign_in functionality provided without the use of <code>errors</code> middleware with <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> pointing to oauth2-proxy service's <code>/</code> endpoint</p><p><strong>Following options need to be set on <code>oauth2-proxy</code>:</strong></p><ul><li><code>--upstream=static://202</code>: Configures a static response for authenticated sessions</li><li><code>--reverse-proxy=true</code>: Enables the use of <code>X-Forwarded-*</code> headers to determine redirects correctly</li></ul><div class="codeBlockContainer_I0IT language-yaml theme-code-block"><div class="codeBlockContent_wNvx yaml"><pre tabindex="0" class="prism-code language-yaml codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># redirects all unauthenticated to oauth2 signin</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">wo</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># unauthenticated session will return a 401</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services-oauth2-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth2-proxy-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`oauth.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Behaviour</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link toc-highlight">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link toc-highlight">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link toc-highlight">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link toc-highlight">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link toc-highlight">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link toc-highlight">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link toc-highlight">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link toc-highlight">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link toc-highlight">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link toc-highlight">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link toc-highlight">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link toc-highlight">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link toc-highlight">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/configuration/session_storage/index.html b/docs/next/configuration/session_storage/index.html
index 9c48f386..db776c62 100644
--- a/docs/next/configuration/session_storage/index.html
+++ b/docs/next/configuration/session_storage/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Session Storage | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><meta data-react-helmet="true" property="og:description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -28,7 +28,7 @@ and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Clu
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p><p>Note, if Redis timeout option is set to non-zero, the <code>--redis-connection-idle-timeout</code>
must be less than <a href="https://redis.io/docs/reference/clients/#client-timeouts" target="_blank" rel="noopener noreferrer">Redis timeout option</a>. For example: if either redis.conf includes
<code>timeout 15</code> or using <code>CONFIG SET timeout 15</code> the <code>--redis-connection-idle-timeout</code> must be at least <code>--redis-connection-idle-timeout=14</code></p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/configuration/tls/index.html b/docs/next/configuration/tls/index.html
index b7a70d48..329e433a 100644
--- a/docs/next/configuration/tls/index.html
+++ b/docs/next/configuration/tls/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">TLS Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="TLS Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="There are two recommended configurations:"><meta data-react-helmet="true" property="og:description" content="There are two recommended configurations:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/tls" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -19,7 +19,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use <c
<code>oauth2-proxy</code> will then authenticate requests for an upstream application. The external endpoint for this example
would be <code>https://internal.yourcompany.com/</code>.</p><p>An example Nginx config follows. Note the use of <code>Strict-Transport-Security</code> header to pin requests to SSL
via <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank" rel="noopener noreferrer">HSTS</a>:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 default ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name internal.yourcompany.com;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /path/to/cert.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /path/to/cert.key;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Strict-Transport-Security max-age=2592000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_connect_timeout 1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_send_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 30;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li><li><p>The command line to run <code>oauth2-proxy</code> in this configuration would look like this:</p><div class="codeBlockContainer_I0IT language-bash theme-code-block"><div class="codeBlockContent_wNvx bash"><pre tabindex="0" class="prism-code language-bash codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --email-domain</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token string" style="color:rgb(195, 232, 141)">"yourcompany.com"</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --upstream</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">http://127.0.0.1:8080/ </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secure</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --reverse-proxy</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">. </span><span class="token punctuation" style="color:rgb(199, 146, 234)">\</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token punctuation" style="color:rgb(199, 146, 234)">..</span><span class="token plain">.</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div></li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/tls.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/session_storage"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Session Storage</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/alpha-config"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Alpha Configuration</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#terminate-tls-at-oauth2-proxy" class="table-of-contents__link toc-highlight">Terminate TLS at OAuth2 Proxy</a></li><li><a href="#terminate-tls-at-reverse-proxy-eg-nginx" class="table-of-contents__link toc-highlight">Terminate TLS at Reverse Proxy, e.g. Nginx</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/features/endpoints/index.html b/docs/next/features/endpoints/index.html
index 6341e49b..1888544c 100644
--- a/docs/next/features/endpoints/index.html
+++ b/docs/next/features/endpoints/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Endpoints | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Endpoints | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/features/endpoints" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/features/endpoints">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/features/endpoints">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/features/endpoints">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/features/endpoints">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/features/endpoints">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/features/endpoints">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/next/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for <!-- -->OAuth2 Proxy<!-- --> <b>Next</b> version.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/features/endpoints">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->Next</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Endpoints</h1></header><p>OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The <code>/oauth2</code> prefix can be changed with the <code>--proxy-prefix</code> config variable.</p><ul><li>/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see <a href="http://www.robotstxt.org/" target="_blank" rel="noopener noreferrer">robotstxt.org</a> for more info</li><li>/ping - returns a 200 OK response, which is intended for use with health checks</li><li>/metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by <code>--metrics-address</code>, disabled by default</li><li>/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)</li><li>/oauth2/sign_out - this URL is used to clear the session cookie</li><li>/oauth2/start - a URL that will redirect to start the OAuth cycle</li><li>/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.</li><li>/oauth2/userinfo - the URL is used to return user's email from the session in JSON format.</li><li>/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the <a href="/oauth2-proxy/docs/next/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive">Nginx <code>auth_request</code> directive</a></li></ul><h3 class="anchor anchorWithStickyNavbar_mojV" id="sign-out">Sign out<a class="hash-link" href="#sign-out" title="Direct link to heading">​</a></h3><p>To sign the user out, redirect them to <code>/oauth2/sign_out</code>. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the <code>rd</code> query parameter, i.e. redirect the user to something like (notice the url-encoding!):</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Alternatively, include the redirect URL in the <code>X-Auth-Request-Redirect</code> header:</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">GET /oauth2/sign_out HTTP/1.1</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">...</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>(The "sign_out_page" should be the <a href="https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1" target="_blank" rel="noopener noreferrer"><code>end_session_endpoint</code></a> from <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" target="_blank" rel="noopener noreferrer">the metadata</a> if your OIDC provider supports Session Management and Discovery.)</p><p>BEWARE that the domain you want to redirect to (<code>my-oidc-provider.example.com</code> in the example) must be added to the <a href="/oauth2-proxy/docs/next/configuration/overview"><code>--whitelist-domain</code></a> configuration option otherwise the redirect will be ignored.</p><h3 class="anchor anchorWithStickyNavbar_mojV" id="auth">Auth<a class="hash-link" href="#auth" title="Direct link to heading">​</a></h3><p>This endpoint returns 202 Accepted response or a 401 Unauthorized response.</p><p>It can be configured using the following query parameters query parameters:</p><ul><li><code>allowed_groups</code>: comma separated list of allowed groups</li><li><code>allowed_email_domains</code>: comma separated list of allowed email domains</li><li><code>allowed_emails</code>: comma separated list of allowed emails</li></ul></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/endpoints.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/alpha-config"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Alpha Configuration</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/community/security"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Security</div></a></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#sign-out" class="table-of-contents__link toc-highlight">Sign out</a></li><li><a href="#auth" class="table-of-contents__link toc-highlight">Auth</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/docs/next/index.html b/docs/next/index.html
index c142455e..356423da 100644
--- a/docs/next/index.html
+++ b/docs/next/index.html
@@ -5,13 +5,13 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Installation | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="Installation | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="1. Choose how to deploy:"><meta data-react-helmet="true" property="og:description" content="1. Choose how to deploy:"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/next/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for <!-- -->OAuth2 Proxy<!-- --> <b>Next</b> version.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/">latest version</a></b> (<!-- -->7.3.x<!-- -->).</div></div><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->Next</span><div class="theme-doc-markdown markdown"><header><h1>Installation</h1></header><ol><li><p>Choose how to deploy:</p><p>a. Download <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases" target="_blank" rel="noopener noreferrer">Prebuilt Binary</a> (current release is <code>v7.3.0</code>)</p><p>b. Build with <code>$ go get github.com/oauth2-proxy/oauth2-proxy/v7</code> which will put the binary in <code>$GOPATH/bin</code></p><p>c. Using the prebuilt docker image <a href="https://quay.io/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer">quay.io/oauth2-proxy/oauth2-proxy</a> (AMD64, ARMv6 and ARM64 tags available)</p><p>d. Using a <a href="https://github.com/oauth2-proxy/manifests" target="_blank" rel="noopener noreferrer">Kubernetes manifest</a> (Helm)</p></li></ol><p>Prebuilt binaries can be validated by extracting the file and verifying it against the <code>sha256sum.txt</code> checksum file provided for each release starting with version <code>v3.0.0</code>.</p><div class="codeBlockContainer_I0IT theme-code-block"><div class="codeBlockContent_wNvx"><pre tabindex="0" class="prism-code language-text codeBlock_jd64 thin-scrollbar" style="color:#bfc7d5;background-color:#292d3e"><code class="codeBlockLines_mRuA"><span class="token-line" style="color:#bfc7d5"><span class="token plain">$ sha256sum -c sha256sum.txt</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oauth2-proxy-x.y.z.linux-amd64: OK</span><br></span></code></pre><button type="button" aria-label="Copy code to clipboard" class="copyButton_wuS7 clean-btn">Copy</button></div></div><ol start="2"><li><a href="/oauth2-proxy/docs/next/configuration/oauth_provider">Select a Provider and Register an OAuth Application with a Provider</a></li><li><a href="/oauth2-proxy/docs/next/configuration/overview">Configure OAuth2 Proxy using config file, command line options, or environment variables</a></li><li><a href="/oauth2-proxy/docs/next/configuration/tls">Configure SSL or Deploy behind a SSL endpoint</a> (example provided for Nginx)</li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/installation.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/behaviour"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Behaviour</div></a></div></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file
diff --git a/index.html b/index.html
index 26a7ae5e..65feec9c 100644
--- a/index.html
+++ b/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
<title data-react-helmet="true">Welcome to OAuth2 Proxy | OAuth2 Proxy</title><meta data-react-helmet="true" property="og:title" content="Welcome to OAuth2 Proxy | OAuth2 Proxy"><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy"><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_tag" content="default"><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/" hreflang="x-default"><script data-react-helmet="true">function maybeInsertBanner(){window.__DOCUSAURUS_INSERT_BASEURL_BANNER&&insertBanner()}function insertBanner(){var n=document.getElementById("docusaurus-base-url-issue-banner-container");if(n){n.innerHTML='\n<div id="docusaurus-base-url-issue-banner" style="border: thick solid red; background-color: rgb(255, 230, 179); margin: 20px; padding: 20px; font-size: 20px;">\n <p style="font-weight: bold; font-size: 30px;">Your Docusaurus site did not load properly.</p>\n <p>A very common reason is a wrong site <a href="https://docusaurus.io/docs/docusaurus.config.js/#baseurl" style="font-weight: bold;">baseUrl configuration</a>.</p>\n <p>Current configured baseUrl = <span style="font-weight: bold; color: red;">/oauth2-proxy/</span> </p>\n <p>We suggest trying baseUrl = <span id="docusaurus-base-url-issue-banner-suggestion-container" style="font-weight: bold; color: green;"></span></p>\n</div>\n';var e=document.getElementById("docusaurus-base-url-issue-banner-suggestion-container"),s=window.location.pathname,r="/"===s.substr(-1)?s:s+"/";e.innerHTML=r}}window.__DOCUSAURUS_INSERT_BASEURL_BANNER=!0,document.addEventListener("DOMContentLoaded",maybeInsertBanner)</script><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
-<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js" as="script">
+<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js" as="script">
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
</head>
<body>
@@ -14,7 +14,7 @@
to validate accounts by email, domain or group.</p><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>This repository was forked from <a href="https://github.com/bitly/oauth2_proxy" target="_blank" rel="noopener noreferrer">bitly/OAuth2_Proxy</a> on 27/11/2018.
Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.
A list of changes can be seen in the <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md" target="_blank" rel="noopener noreferrer">CHANGELOG</a>.</p></div></div><p><img alt="Sign In Page" src="/oauth2-proxy/assets/images/sign-in-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png" width="509" height="234"></p><h2 class="anchor anchorWithStickyNavbar_mojV" id="architecture">Architecture<a class="hash-link" href="#architecture" title="Direct link to heading">​</a></h2><p><img alt="OAuth2 Proxy Architecture" src="/oauth2-proxy/assets/images/architecture-08b382c30c02b227fa4c86cb158b600e.png" width="584" height="373"></p></div></div></main></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
-<script src="/oauth2-proxy/assets/js/runtime~main.7c12ab0b.js"></script>
+<script src="/oauth2-proxy/assets/js/runtime~main.f8aa34b6.js"></script>
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
</body>
</html>
\ No newline at end of file