mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2025-04-21 12:17:22 +02:00
35 lines
14 KiB
HTML
35 lines
14 KiB
HTML
<!doctype html>
|
|
<html class="docs-version-7.3.x" lang="en" dir="ltr">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<meta name="generator" content="Docusaurus v2.0.0-beta.15">
|
|
<title data-react-helmet="true">Security | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security"><meta data-react-helmet="true" name="docusaurus_locale" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="7.3.x"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-7.3.x"><meta data-react-helmet="true" property="og:title" content="Security | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="OAuth2 Proxy is a community project."><meta data-react-helmet="true" property="og:description" content="OAuth2 Proxy is a community project."><link data-react-helmet="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security" hreflang="en"><link data-react-helmet="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.19258e03.css">
|
|
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.d94296bf.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/assets/js/main.a264f451.js" as="script">
|
|
</head>
|
|
<body>
|
|
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
|
<div role="region"><a href="#" class="skipToContent_ZgBM">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--light_TfLj"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_W2Cr themedImage--dark_oUvU"></div><b class="navbar__title">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" href="/oauth2-proxy/docs/">7.3.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/community/security">Next</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/community/security">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/community/security">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/community/security">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/community/security">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/community/security">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_I5OW"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></span></a><div class="toggle_Pssr toggle_TdHA toggleDisabled_jDku"><div class="toggleTrack_SSoT" role="button" tabindex="-1"><div class="toggleTrackCheck_XobZ"><span class="toggleIcon_eZtF">🌜</span></div><div class="toggleTrackX_YkSC"><span class="toggleIcon_eZtF">🌞</span></div><div class="toggleTrackThumb_uRm4"></div></div><input type="checkbox" class="toggleScreenReader_JnkT" aria-label="Switch between dark and light mode"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_P2Lg"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_RiI4" type="button"></button><aside class="theme-doc-sidebar-container docSidebarContainer_rKC_"><div class="sidebar_CW9Y"><nav class="menu thin-scrollbar menu_SkdO"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist hasHref_VCh3" href="/oauth2-proxy/docs/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active hasHref_VCh3" aria-current="page" href="/oauth2-proxy/docs/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/community/security">Security</a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_TCnq"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_DM6M"><div class="docItemContainer_vinB"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->7.3.x</span><div class="tocCollapsible_jdIR theme-doc-toc-mobile tocMobile_TmEX"><button type="button" class="clean-btn tocCollapsibleButton_Fzxq">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Security</h1></header><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>OAuth2 Proxy is a community project.
|
|
Maintainers do not work on this project full time, and as such,
|
|
while we endeavour to respond to disclosures as quickly as possible,
|
|
this may take longer than in projects with corporate sponsorship.</p></div></div><h2 class="anchor anchorWithStickyNavbar_mojV" id="security-disclosures">Security Disclosures<a class="hash-link" href="#security-disclosures" title="Direct link to heading"></a></h2><div class="admonition admonition-important alert alert--info"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"></path></svg></span>important</h5></div><div class="admonition-content"><p>If you believe you have found a vulnerability within OAuth2 Proxy or any of its
|
|
dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
|
|
any details publicly.</p></div></div><p>Security disclosures MUST be done in private.
|
|
If you have found an issue that you would like to bring to the attention of the
|
|
maintenance team for OAuth2 Proxy, please compose an email and send it to the
|
|
list of maintainers in our <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS" target="_blank" rel="noopener noreferrer">MAINTAINERS</a> file.</p><p>Please include as much detail as possible.
|
|
Ideally, your disclosure should include:</p><ul><li>A reproducible case that can be used to demonstrate the exploit</li><li>How you discovered this vulnerability</li><li>A potential fix for the issue (if you have thought of one)</li><li>Versions affected (if not present in master)</li><li>Your GitHub ID</li></ul><h3 class="anchor anchorWithStickyNavbar_mojV" id="how-will-we-respond-to-disclosures">How will we respond to disclosures?<a class="hash-link" href="#how-will-we-respond-to-disclosures" title="Direct link to heading"></a></h3><p>We use <a href="https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories" target="_blank" rel="noopener noreferrer">GitHub Security Advisories</a>
|
|
to privately discuss fixes for disclosed vulnerabilities.
|
|
If you include a GitHub ID with your disclosure we will add you as a collaborator
|
|
for the advisory so that you can join the discussion and validate any fixes
|
|
we may propose.</p><p>For minor issues and previously disclosed vulnerabilities (typically for
|
|
dependencies), we may use regular PRs for fixes and forego the security advisory.</p><p>Once a fix has been agreed upon, we will merge the fix and create a new release.
|
|
If we have multiple security issues in flight simultaneously, we may delay
|
|
merging fixes until all patches are ready.
|
|
We may also backport the fix to previous releases,
|
|
but this will be at the discretion of the maintainers.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.3.x/community/security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_dcUD" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_foO9"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/features/endpoints"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Endpoints</div></a></div><div class="pagination-nav__item pagination-nav__item--next"></div></nav></div></div><div class="col col--3"><div class="tableOfContents_cNA8 thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#security-disclosures" class="table-of-contents__link toc-highlight">Security Disclosures</a><ul><li><a href="#how-will-we-respond-to-disclosures" class="table-of-contents__link toc-highlight">How will we respond to disclosures?</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 OAuth2 Proxy.</div></div></div></footer></div>
|
|
<script src="/oauth2-proxy/assets/js/runtime~main.d94296bf.js"></script>
|
|
<script src="/oauth2-proxy/assets/js/main.a264f451.js"></script>
|
|
</body>
|
|
</html> |