You've already forked oauth2-proxy
mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2025-07-15 01:44:22 +02:00
fix footnote parsing error
This commit is contained in:
tuunit
@ -90,7 +90,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
|
||||
| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
|
||||
| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
|
||||
| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
|
||||
| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
|
||||
| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
|
||||
@ -189,12 +189,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
|
||||
| `--validate-url` | string | Access token validation endpoint | |
|
||||
| `--version` | n/a | print version string | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`) \[[2](#footnote2)\] | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`) [^2] | |
|
||||
| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
|
||||
|
||||
\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
|
||||
\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
|
||||
See below for provider specific options
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
### Command Line Options
|
||||
|
||||
| Option | Type | Description | Default |
|
||||
| ------ | ---- | ----------- | ------- |
|
||||
| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
|
||||
| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
|
||||
| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
|
||||
| `--auth-logging` | bool | Log authentication attempts | true |
|
||||
@ -35,7 +35,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
|
||||
| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
|
||||
| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
|
||||
| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
|
||||
| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
|
||||
| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
|
||||
@ -141,12 +141,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
|
||||
| `--validate-url` | string | Access token validation endpoint | |
|
||||
| `--version` | n/a | print version string | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`) \[[2](#footnote2)\] | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`) [^2] | |
|
||||
| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
|
||||
|
||||
\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
|
||||
\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
|
||||
See below for provider specific options
|
||||
|
||||
@ -206,7 +206,7 @@ The default format is configured as follows:
|
||||
Available variables for auth logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Message | Authenticated via OAuth2 | The details of the auth attempt. |
|
||||
@ -235,7 +235,7 @@ The default format is configured as follows:
|
||||
Available variables for request logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Protocol | HTTP/1.0 | The request protocol. |
|
||||
@ -266,7 +266,7 @@ If you require a different format than that, you can configure it with the `--st
|
||||
Available variables for standard logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------- | --------------------------------- | -------------------------------------------------- |
|
||||
| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
|
||||
| File | main.go:40 | The file and line number of the logging statement. |
|
||||
| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
|
||||
|
||||
@ -73,7 +73,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
### Command Line Options
|
||||
|
||||
| Option | Type | Description | Default |
|
||||
| ------ | ---- | ----------- | ------- |
|
||||
| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
|
||||
| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
|
||||
| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
|
||||
| `--auth-logging` | bool | Log authentication attempts | true |
|
||||
@ -90,7 +90,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
|
||||
| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
|
||||
| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
|
||||
| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
|
||||
| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
|
||||
| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
|
||||
@ -196,12 +196,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
|
||||
| `--validate-url` | string | Access token validation endpoint | |
|
||||
| `--version` | n/a | print version string | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`) \[[2](#footnote2)\] | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`) [^2] | |
|
||||
| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
|
||||
|
||||
\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
|
||||
\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
|
||||
See below for provider specific options
|
||||
|
||||
@ -261,7 +261,7 @@ The default format is configured as follows:
|
||||
Available variables for auth logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Message | Authenticated via OAuth2 | The details of the auth attempt. |
|
||||
@ -290,7 +290,7 @@ The default format is configured as follows:
|
||||
Available variables for request logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Protocol | HTTP/1.0 | The request protocol. |
|
||||
@ -321,7 +321,7 @@ If you require a different format than that, you can configure it with the `--st
|
||||
Available variables for standard logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------- | --------------------------------- | -------------------------------------------------- |
|
||||
| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
|
||||
| File | main.go:40 | The file and line number of the logging statement. |
|
||||
| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
|
||||
|
||||
@ -73,7 +73,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
### Command Line Options
|
||||
|
||||
| Option | Type | Description | Default |
|
||||
| ------ | ---- | ----------- | ------- |
|
||||
| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
|
||||
| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
|
||||
| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
|
||||
| `--auth-logging` | bool | Log authentication attempts | true |
|
||||
@ -91,7 +91,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
|
||||
| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
|
||||
| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
|
||||
| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
|
||||
| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
|
||||
| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
|
||||
@ -201,12 +201,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
|
||||
| `--validate-url` | string | Access token validation endpoint | |
|
||||
| `--version` | n/a | print version string | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) \[[2](#footnote2)\] | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) [^2] | |
|
||||
| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
|
||||
|
||||
\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
|
||||
\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
|
||||
See below for provider specific options
|
||||
|
||||
@ -266,7 +266,7 @@ The default format is configured as follows:
|
||||
Available variables for auth logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Message | Authenticated via OAuth2 | The details of the auth attempt. |
|
||||
@ -295,7 +295,7 @@ The default format is configured as follows:
|
||||
Available variables for request logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Protocol | HTTP/1.0 | The request protocol. |
|
||||
@ -326,7 +326,7 @@ If you require a different format than that, you can configure it with the `--st
|
||||
Available variables for standard logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------- | --------------------------------- | -------------------------------------------------- |
|
||||
| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
|
||||
| File | main.go:40 | The file and line number of the logging statement. |
|
||||
| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
|
||||
|
||||
@ -73,7 +73,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
### Command Line Options
|
||||
|
||||
| Option | Type | Description | Default |
|
||||
| ------ | ---- | ----------- | ------- |
|
||||
| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
|
||||
| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
|
||||
| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
|
||||
| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
|
||||
@ -92,7 +92,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
|
||||
| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
|
||||
| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
|
||||
| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
|
||||
| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
|
||||
| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
|
||||
@ -206,12 +206,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
|
||||
| `--validate-url` | string | Access token validation endpoint | |
|
||||
| `--version` | n/a | print version string | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) \[[2](#footnote2)\] | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) [^2] | |
|
||||
| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
|
||||
|
||||
\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
|
||||
\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
|
||||
See below for provider specific options
|
||||
|
||||
@ -271,7 +271,7 @@ The default format is configured as follows:
|
||||
Available variables for auth logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Message | Authenticated via OAuth2 | The details of the auth attempt. |
|
||||
@ -300,7 +300,7 @@ The default format is configured as follows:
|
||||
Available variables for request logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Protocol | HTTP/1.0 | The request protocol. |
|
||||
@ -331,7 +331,7 @@ If you require a different format than that, you can configure it with the `--st
|
||||
Available variables for standard logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------- | --------------------------------- | -------------------------------------------------- |
|
||||
| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
|
||||
| File | main.go:40 | The file and line number of the logging statement. |
|
||||
| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
|
||||
|
||||
@ -73,7 +73,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
### Command Line Options
|
||||
|
||||
| Option | Type | Description | Default |
|
||||
| ------ | ---- | ----------- | ------- |
|
||||
| ---------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
|
||||
| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
|
||||
| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
|
||||
| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
|
||||
@ -92,7 +92,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
|
||||
| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
|
||||
| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
|
||||
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
|
||||
| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
|
||||
| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
|
||||
| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
|
||||
@ -209,12 +209,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
|
||||
| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
|
||||
| `--validate-url` | string | Access token validation endpoint | |
|
||||
| `--version` | n/a | print version string | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) \[[2](#footnote2)\] | |
|
||||
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) [^2] | |
|
||||
| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
|
||||
|
||||
\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
|
||||
|
||||
\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
|
||||
|
||||
See below for provider specific options
|
||||
|
||||
@ -274,7 +274,7 @@ The default format is configured as follows:
|
||||
Available variables for auth logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Message | Authenticated via OAuth2 | The details of the auth attempt. |
|
||||
@ -303,7 +303,7 @@ The default format is configured as follows:
|
||||
Available variables for request logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
|
||||
| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
|
||||
| Host | domain.com | The value of the Host header. |
|
||||
| Protocol | HTTP/1.0 | The request protocol. |
|
||||
@ -334,7 +334,7 @@ If you require a different format than that, you can configure it with the `--st
|
||||
Available variables for standard logging:
|
||||
|
||||
| Variable | Example | Description |
|
||||
| --- | --- | --- |
|
||||
| --------- | --------------------------------- | -------------------------------------------------- |
|
||||
| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
|
||||
| File | main.go:40 | The file and line number of the logging statement. |
|
||||
| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
|
||||
|
||||
Reference in New Issue
Block a user