Nick Meves abeb0236d8 Strip X-Forwarded auth headers from whitelisted paths (#624) ... * Strip X-Forwarded auth headers from whitelisted paths For any paths that match skip-auth-regex, strip normal X-Forwarded headers that would be sent based on pass-user-headers or pass-access-token settings. This prevents malicious injecting of authentication headers through the skip-auth-regex paths in cases where the regex might be misconfigured and too open. Control this behavior with --skip-auth-strip-headers flag. This flag is set to TRUE by default (this is secure by default, but potentially breaks some legacy configurations). Only x-Forwarded headers stripped, left the Authorization header untouched. * Strip authorization header if it would be set * Improve TestStripAuthHeaders test table * Improve --skip-auth-strip-headers flag documentation		2020-07-14 23:46:44 +01:00
..
ip	Move RealClientIP code to IP packages	2020-05-23 15:17:41 +01:00
options	Strip X-Forwarded auth headers from whitelisted paths (#624)	2020-07-14 23:46:44 +01:00
sessions	Reduce SessionState size better with MessagePack + LZ4 (#632)	2020-07-13 20:56:05 +01:00