lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-12 04:04:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: add #162 changelog entry and rollback cookie note

Browse Source 
Add the #162 fix to the changelog. Document that a rollback to v1.0.25 or
earlier invalidates sessions, because those releases cannot read the
encrypted cookies from v1.0.26. Tell operators which cookies to delete.

Claude-Session: https://claude.ai/code/session_01G1d1n1BrHHHw8dBUkbiBPC
This commit is contained in:
lukaszraczylo
2026-09-28 15:32:19 +01:00
parent 937776516d
commit 7ae75d2523
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+5
View File
@@ -121,6 +121,11 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
### Fixed ### Fixed
- SSE and WebSocket requests now get the configured `headers`, as normal
requests do. The last release sent only `X-Forwarded-User` on these
requests, so a backend that checks a shared-secret header answered `401`
on WebSocket upgrades. The same requests now also honor back-channel and
front-channel logout (`middleware.go`, #162).
- The opaque bearer path rejects a token that `RevokeToken` added to the - The opaque bearer path rejects a token that `RevokeToken` added to the
blacklist, for example at logout. It also rejects an opaque token whose blacklist, for example at logout. It also rejects an opaque token whose
`nbf` is in the future (`bearer_auth.go`). `nbf` is in the future (`bearer_auth.go`).
README.md
+8
View File
@@ -162,6 +162,14 @@ Full reference in [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
(previously signed only) and their cryptographic lifetime tracks (previously signed only) and their cryptographic lifetime tracks
`sessionMaxAge` (previously a fixed 30 days). Existing cookies become invalid `sessionMaxAge` (previously a fixed 30 days). Existing cookies become invalid
on upgrade, so users re-authenticate one time. on upgrade, so users re-authenticate one time.
- **A rollback to v1.0.25 or earlier also invalidates sessions.** Those
releases cannot read the encrypted cookies that v1.0.26 and later issue.
They log `securecookie: the value is not valid` and `No state in
callback`, and the browser loops through the login. After a rollback, tell
users to delete
the `_oidc_raczylo_*` cookies (or the cookies with your `cookiePrefix`)
for the affected hosts. The cookies are `HttpOnly`, so users must delete
them in the browser site-data settings.
- **Invalid configuration now fails closed at startup** instead of being - **Invalid configuration now fails closed at startup** instead of being
silently accepted: a `sessionEncryptionKey` shorter than 32 bytes, a silently accepted: a `sessionEncryptionKey` shorter than 32 bytes, a
`rateLimit` below 10, a missing `callbackURL`, or a non-HTTPS remote `rateLimit` below 10, a missing `callbackURL`, or a non-HTTPS remote