From 7ae75d252332de314f9dae403c641d65447e5300 Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Mon, 28 Sep 2026 15:32:19 +0100 Subject: [PATCH] docs: add #162 changelog entry and rollback cookie note Add the #162 fix to the changelog. Document that a rollback to v1.0.25 or earlier invalidates sessions, because those releases cannot read the encrypted cookies from v1.0.26. Tell operators which cookies to delete. Claude-Session: https://claude.ai/code/session_01G1d1n1BrHHHw8dBUkbiBPC --- CHANGELOG.md | 5 +++++ README.md | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 512625e..d5c8a43 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -121,6 +121,11 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Fixed +- SSE and WebSocket requests now get the configured `headers`, as normal + requests do. The last release sent only `X-Forwarded-User` on these + requests, so a backend that checks a shared-secret header answered `401` + on WebSocket upgrades. The same requests now also honor back-channel and + front-channel logout (`middleware.go`, #162). - The opaque bearer path rejects a token that `RevokeToken` added to the blacklist, for example at logout. It also rejects an opaque token whose `nbf` is in the future (`bearer_auth.go`). diff --git a/README.md b/README.md index 6fc8065..485a720 100644 --- a/README.md +++ b/README.md @@ -162,6 +162,14 @@ Full reference in [docs/CONFIGURATION.md](docs/CONFIGURATION.md). (previously signed only) and their cryptographic lifetime tracks `sessionMaxAge` (previously a fixed 30 days). Existing cookies become invalid on upgrade, so users re-authenticate one time. +- **A rollback to v1.0.25 or earlier also invalidates sessions.** Those + releases cannot read the encrypted cookies that v1.0.26 and later issue. + They log `securecookie: the value is not valid` and `No state in + callback`, and the browser loops through the login. After a rollback, tell + users to delete + the `_oidc_raczylo_*` cookies (or the cookies with your `cookiePrefix`) + for the affected hosts. The cookies are `HttpOnly`, so users must delete + them in the browser site-data settings. - **Invalid configuration now fails closed at startup** instead of being silently accepted: a `sessionEncryptionKey` shorter than 32 bytes, a `rateLimit` below 10, a missing `callbackURL`, or a non-HTTPS remote