lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-18 04:47:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: add #162 changelog entry and rollback cookie note

Browse Source 
Add the #162 fix to the changelog. Document that a rollback to v1.0.25 or
earlier invalidates sessions, because those releases cannot read the
encrypted cookies from v1.0.26. Tell operators which cookies to delete.

Claude-Session: https://claude.ai/code/session_01G1d1n1BrHHHw8dBUkbiBPC
This commit is contained in:
lukaszraczylo
2026-09-28 15:32:19 +01:00
parent 937776516d
commit 7ae75d2523
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8
View File
@@ -162,6 +162,14 @@ Full reference in [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
(previously signed only) and their cryptographic lifetime tracks
`sessionMaxAge` (previously a fixed 30 days). Existing cookies become invalid
on upgrade, so users re-authenticate one time.
- **A rollback to v1.0.25 or earlier also invalidates sessions.** Those
releases cannot read the encrypted cookies that v1.0.26 and later issue.
They log `securecookie: the value is not valid` and `No state in
callback`, and the browser loops through the login. After a rollback, tell
users to delete
the `_oidc_raczylo_*` cookies (or the cookies with your `cookiePrefix`)
for the affected hosts. The cookies are `HttpOnly`, so users must delete
them in the browser site-data settings.
- **Invalid configuration now fails closed at startup** instead of being
silently accepted: a `sessionEncryptionKey` shorter than 32 bytes, a
`rateLimit` below 10, a missing `callbackURL`, or a non-HTTPS remote