lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-20 04:57:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: add #162 changelog entry and rollback cookie note

Browse Source 
Add the #162 fix to the changelog. Document that a rollback to v1.0.25 or
earlier invalidates sessions, because those releases cannot read the
encrypted cookies from v1.0.26. Tell operators which cookies to delete.

Claude-Session: https://claude.ai/code/session_01G1d1n1BrHHHw8dBUkbiBPC
This commit is contained in:
lukaszraczylo
2026-09-28 15:32:19 +01:00
parent 937776516d
commit 7ae75d2523
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+5
View File
@@ -121,6 +121,11 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
### Fixed
- SSE and WebSocket requests now get the configured `headers`, as normal
requests do. The last release sent only `X-Forwarded-User` on these
requests, so a backend that checks a shared-secret header answered `401`
on WebSocket upgrades. The same requests now also honor back-channel and
front-channel logout (`middleware.go`, #162).
- The opaque bearer path rejects a token that `RevokeToken` added to the
blacklist, for example at logout. It also rejects an opaque token whose
`nbf` is in the future (`bearer_auth.go`).