chore(release): v1.0.42

Under yaegi, the authenticated cookie path allocated about 3.8 MB per
request. A yaegi harness measures bytes per request with a browser-like
cookie jar. With it, these changes cut bytes by 83%, allocations by 69%
and time by about 93%.

- Replace range loops over tokens with index loops. Under yaegi, ranging
  over a string allocates O(n^2) bytes.
- Pool gzip readers for combined session cookies.
- Memoize the validated ID token within one request.
- Cache content-only token validation across requests. The key is the
  token type and SHA-256, and the cache holds at most 4096 entries. The
  entry keeps the parsed exp and iat claims. The expiry and freshness
  checks still run on every request.

New tests pin the validator results, the memo and the cache behavior.

CHANGELOG.md

@@ -17,6 +17,14 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   never reads a preflight body (`settings.go`, `middleware.go`, FIX-02).
   See the option table in [CONFIGURATION.md](docs/CONFIGURATION.md).
 
+- **`streamingRefresh` (default `false`).** SSE and WebSocket requests do
+  not check the token expiry, so a session stays usable for streaming until
+  the session cookie expires. Set the option to `true` to refresh an expired
+  token on these requests. If the IdP rejects the refresh with
+  `invalid_grant`, the request gets `401`. If the IdP cannot be reached, the
+  request is forwarded as before. The request waits for the full refresh, so
+  a rotated refresh token is never lost (`middleware.go`).
+
 ### Changed
 
 - **Opaque bearer tokens when all three bearer flags are set.** A deployment
@@ -113,6 +121,11 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 
+- SSE and WebSocket requests now get the configured `headers`, as normal
+  requests do. The last release sent only `X-Forwarded-User` on these
+  requests, so a backend that checks a shared-secret header answered `401`
+  on WebSocket upgrades. The same requests now also honor back-channel and
+  front-channel logout (`middleware.go`, #162).
 - The opaque bearer path rejects a token that `RevokeToken` added to the
   blacklist, for example at logout. It also rejects an opaque token whose
   `nbf` is in the future (`bearer_auth.go`).

README.md

@@ -139,6 +139,7 @@ Full reference in [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
 | `disableReplayDetection` | `false` | Disable JTI cache. Use Redis instead for multi-replica. |
 | `allowPrivateIPAddresses` | `false` | Permit private-IP `providerURL` (internal Keycloak, etc.). |
 | `allowUnauthenticatedPreflight` | `false` | Bypass auth for a genuine CORS preflight (`OPTIONS` + `Origin` + `Access-Control-Request-Method`); the response body is still discarded. Default requires auth for every `OPTIONS` request, preflight or not. |
+| `streamingRefresh` | `false` | Refresh an expired session on SSE/WebSocket requests. Reject the request when the IdP revokes the grant. |
 | `minimalHeaders` | `false` | Reduce forwarded headers (mitigates HTTP 431). |
 | `stripAuthCookies` | `false` | Strip OIDC cookies from backend hop (mitigates HTTP 431). |
 | `caCertPath` / `caCertPEM` | none | Trust an internal CA for the provider's TLS. |
@@ -161,6 +162,14 @@ Full reference in [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
   (previously signed only) and their cryptographic lifetime tracks
   `sessionMaxAge` (previously a fixed 30 days). Existing cookies become invalid
   on upgrade, so users re-authenticate one time.
+- **A rollback to v1.0.25 or earlier also invalidates sessions.** Those
+  releases cannot read the encrypted cookies that v1.0.26 and later issue.
+  They log `securecookie: the value is not valid` and `No state in
+  callback`, and the browser loops through the login. After a rollback, tell
+  users to delete
+  the `_oidc_raczylo_*` cookies (or the cookies with your `cookiePrefix`)
+  for the affected hosts. The cookies are `HttpOnly`, so users must delete
+  them in the browser site-data settings.
 - **Invalid configuration now fails closed at startup** instead of being
   silently accepted: a `sessionEncryptionKey` shorter than 32 bytes, a
   `rateLimit` below 10, a missing `callbackURL`, or a non-HTTPS remote
@@ -304,9 +313,17 @@ WebSocket upgrade. The middleware handles this automatically:
 - They are **not** unauthenticated — a valid encrypted session cookie is
   required, otherwise the request is rejected. The session must already exist
   (i.e. the user logged in via a normal HTTP page first).
-- `X-Forwarded-User` is forwarded from the session.
+- `X-Forwarded-User` and the configured `headers` are forwarded from the
+  session. Header templates render from the claims in the session cookie.
 - Validation is cookie-only (no JWK fetch), so streaming keeps working during
-  brief IdP outages.
+  brief IdP outages. Back-channel and front-channel logout still apply: a
+  session that the IdP logged out is rejected.
+- By default, the token expiry is not checked, so a session stays usable
+  for streaming until the session cookie expires. Set `streamingRefresh: true`
+  to refresh an expired token on the request. If the IdP rejects the refresh
+  (`invalid_grant`), the request gets `401`. If the IdP cannot be reached,
+  the request is forwarded as before. On a WebSocket upgrade, the refreshed
+  session cookie arrives on the `101 Switching Protocols` response.
 
 No configuration needed — this is implicit behavior.
 

chunk_validation_pin_test.go

@@ -0,0 +1,94 @@
+package traefikoidc
+
+import (
+	"strings"
+	"testing"
+)
+
+// These tests pin the token-content validators' results, including for
+// multi-byte UTF-8 input, so their loops can be rewritten for yaegi (where
+// ranging over a string allocates O(n²)) without changing behavior.
+
+func TestDetectRepeatedCharactersPinned(t *testing.T) {
+	cm := NewChunkManager(NewLogger(""))
+	cases := []struct {
+		name    string
+		token   string
+		wantErr string
+	}{
+		{"short token skipped", "aaaaaaaaa", ""},
+		{"varied ascii", "abcdefghijklmnopqrstuvwxyz0123456789", ""},
+		{"20 repeats allowed", strings.Repeat("a", 20) + strings.Repeat("bcdefghij", 4), ""},
+		{"21 repeats rejected", strings.Repeat("a", 21) + strings.Repeat("bcdefghij", 4), "excessive repeated characters (21 consecutive)"},
+		{"multibyte run counted per rune", strings.Repeat("é", 21) + strings.Repeat("bcdefghij", 4), "excessive repeated characters (21 consecutive)"},
+		// Rune counts are divided by the byte length, so a multi-byte rune
+		// cannot reach the 70% threshold. Pinned as-is.
+		{"multibyte frequency divides by byte length", strings.Repeat("éééx", 8), ""},
+		{"ascii frequency over 70%", strings.Repeat("aaaab", 8), "suspicious character frequency (char 'a'"},
+		{"multibyte mixed passes", "日本語テキストabcdefghijklmnopqrstuvwxyz", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := cm.detectRepeatedCharacters(tc.token, AccessTokenConfig)
+			assertPinnedErr(t, err, tc.wantErr)
+		})
+	}
+}
+
+func TestValidateJWTFormatPinned(t *testing.T) {
+	cm := NewChunkManager(NewLogger(""))
+	cases := []struct {
+		name    string
+		token   string
+		wantErr string
+	}{
+		{"valid base64url parts", jwtLike("eyJhbGciOiJSUzI1NiJ9", "eyJzdWIiOiJ4In0", "c2lnbmF0dXJlLXZhbHVl"), ""},
+		{"padding allowed", jwtLike("eyJhbGciOiJSUzI1NiJ9", "eyJzdWIiOiJ4In0=", "c2lnbmF0dXJl"), ""},
+		{"plus rejected", jwtLike("eyJhbGciOiJSUzI1NiJ9", "eyJzd+IiOiJ4In0", "c2lnbmF0dXJl"), "invalid base64url character in part 1"},
+		{"multibyte rejected", jwtLike("eyJhbGciOiJSUzI1NiJ9", "eyJzdé", "c2lnbmF0dXJl"), "invalid base64url character in part 1"},
+		{"control char rejected", jwtLike("eyJhbGciOiJSUzI1NiJ9", "eyJzdWIiOiJ4In0", "c2ln\x01bmF0"), "invalid base64url character in part 2"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := cm.validateJWTFormat(tc.token, "access")
+			assertPinnedErr(t, err, tc.wantErr)
+		})
+	}
+}
+
+func TestValidateTokenSanitizationPinned(t *testing.T) {
+	cm := NewChunkManager(NewLogger(""))
+	cases := []struct {
+		name    string
+		token   string
+		wantErr string
+	}{
+		{"clean jwt", jwtLike("eyJhbGciOiJSUzI1NiJ9", "eyJzdWIiOiJ4In0", "c2lnbmF0dXJl"), ""},
+		{"multibyte allowed", jwtLike("eyJhbGciOiJSUzI1NiJ9", "日本語", "c2lnbmF0dXJl"), ""},
+		{"control char byte offset", "abcé\x01def", "control character at position 5"},
+		{"delete char", "abcdef\x7fgh", "control character at position 6"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := cm.validateTokenSanitization(tc.token, AccessTokenConfig)
+			assertPinnedErr(t, err, tc.wantErr)
+		})
+	}
+}
+
+// jwtLike joins parts with dots at runtime; JWT-shaped literals trip the
+// pre-commit secret scanner.
+func jwtLike(parts ...string) string { return strings.Join(parts, ".") }
+
+func assertPinnedErr(t *testing.T, err error, want string) {
+	t.Helper()
+	if want == "" {
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		return
+	}
+	if err == nil || !strings.Contains(err.Error(), want) {
+		t.Fatalf("error = %v, want containing %q", err, want)
+	}
+}

cmd/yaegicheck/main.go

@@ -23,6 +23,7 @@ package main
 
 import (
 	"context"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
@@ -137,6 +138,8 @@ func main() {
 	runCheck("fix06-sse-flush-reaches-next", checkSSEFlushReachesNext)
 	runCheck("middleware-erraborthandler-aborts-under-yaegi", checkErrAbortHandlerAbortsUnderYaegi)
 	runCheck("fix17-setifabsent-claims-once", checkSetIfAbsentUnderYaegi)
+	runCheck("issue162-websocket-forwards-header-templates", checkIssue162WebSocketHeaderTemplates)
+	runCheck("streaming-refresh-revoked-grant-rejected", checkStreamingRefreshRevokedGrant)
 	fmt.Println("OK: all yaegi regression checks passed")
 }
 
@@ -723,6 +726,168 @@ func checkSSEFlushReachesNext() (string, error) {
 	return "", nil
 }
 
+// checkIssue162WebSocketHeaderTemplates pins #162 under the interpreter: an
+// authenticated WebSocket upgrade takes the streaming bypass, which must
+// still render the configured headers (static and claim-derived) for next.
+func checkIssue162WebSocketHeaderTemplates() (string, error) {
+	discovery := servers.NewOIDCServer(nil)
+	defer discovery.Close()
+
+	cfg := oidc.CreateConfig()
+	cfg.ProviderURL = discovery.URL
+	cfg.ClientID = "yaegi-check-162-client"
+	cfg.ClientSecret = "yaegi-check-162-secret"
+	cfg.CallbackURL = "/oauth2/callback"
+	cfg.SessionEncryptionKey = "0123456789abcdef0123456789abcdef"
+	cfg.Headers = []oidc.TemplatedHeader{
+		{Name: "X-Proxy-Secret", Value: "s3cret"},
+		{Name: "X-Forwarded-Preferred-Username", Value: "{{.Claims.preferred_username}}"},
+	}
+
+	var seen http.Header
+	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		seen = r.Header.Clone()
+	})
+	h, err := oidc.New(context.Background(), next, cfg, "yaegi-check-162")
+	if err != nil {
+		return "", fmt.Errorf("New: %w", err)
+	}
+	if closer, ok := h.(interface{ Close() error }); ok {
+		defer closer.Close()
+	}
+
+	sm, err := oidc.NewSessionManager(cfg.SessionEncryptionKey, cfg.ForceHTTPS, cfg.CookieDomain, cfg.CookiePrefix, time.Duration(cfg.SessionMaxAge)*time.Second, oidc.NewLogger("error"))
+	if err != nil {
+		return "", fmt.Errorf("NewSessionManager: %w", err)
+	}
+	defer sm.Shutdown()
+
+	setupReq := httptest.NewRequest("GET", "/ws", nil)
+	session, err := sm.GetSession(setupReq)
+	if err != nil {
+		return "", fmt.Errorf("GetSession: %w", err)
+	}
+	if err := session.SetAuthenticated(true); err != nil {
+		return "", fmt.Errorf("SetAuthenticated: %w", err)
+	}
+	session.SetUserIdentifier("[email protected]")
+	// Unsigned JWT: the bypass reads cookie-sealed claims without signature
+	// verification. Built at runtime because a JWT literal trips the
+	// pre-commit secret scanner.
+	b64 := base64.RawURLEncoding.EncodeToString
+	sig := make([]byte, 32)
+	for i := range sig {
+		sig[i] = byte(i + 1)
+	}
+	session.SetIDToken(b64([]byte(`{"alg":"RS256","typ":"JWT"}`)) + "." + b64([]byte(`{"preferred_username":"alice"}`)) + "." + b64(sig))
+	rec := httptest.NewRecorder()
+	if err := session.Save(setupReq, rec); err != nil {
+		return "", fmt.Errorf("session.Save: %w", err)
+	}
+	session.ReturnToPool()
+
+	req := httptest.NewRequest("GET", "/ws", nil)
+	for _, c := range rec.Result().Cookies() {
+		req.AddCookie(c)
+	}
+	req.Header.Set("Upgrade", "websocket")
+	req.Header.Set("Connection", "Upgrade")
+	rw := httptest.NewRecorder()
+	h.ServeHTTP(rw, req)
+
+	if seen == nil {
+		return "", fmt.Errorf("next was not reached (status %d)", rw.Code)
+	}
+	if got := seen.Get("X-Proxy-Secret"); got != "s3cret" {
+		return "", fmt.Errorf("X-Proxy-Secret = %q, want %q", got, "s3cret")
+	}
+	if got := seen.Get("X-Forwarded-Preferred-Username"); got != "alice" {
+		return "", fmt.Errorf("X-Forwarded-Preferred-Username = %q, want %q", got, "alice")
+	}
+	return "", nil
+}
+
+// checkStreamingRefreshRevokedGrant drives streamingRefresh under the
+// interpreter through the real RefreshCoordinator and token exchanger: an
+// expired session whose refresh the IdP answers with invalid_grant must get
+// 401 on a WebSocket upgrade instead of reaching next.
+func checkStreamingRefreshRevokedGrant() (string, error) {
+	idpCfg := servers.DefaultConfig()
+	idpCfg.RefreshError = &servers.OIDCError{Error: "invalid_grant"}
+	idp := servers.NewOIDCServer(idpCfg)
+	defer idp.Close()
+
+	cfg := oidc.CreateConfig()
+	cfg.ProviderURL = idp.URL
+	cfg.ClientID = "yaegi-check-refresh-client"
+	cfg.ClientSecret = "yaegi-check-refresh-secret"
+	cfg.CallbackURL = "/oauth2/callback"
+	cfg.SessionEncryptionKey = "0123456789abcdef0123456789abcdef"
+	cfg.StreamingRefresh = true
+
+	reached := false
+	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	})
+	h, err := oidc.New(context.Background(), next, cfg, "yaegi-check-refresh")
+	if err != nil {
+		return "", fmt.Errorf("New: %w", err)
+	}
+	if closer, ok := h.(interface{ Close() error }); ok {
+		defer closer.Close()
+	}
+	// The streaming bypass does not wait for provider metadata, so a normal
+	// request (which does) runs first to make the token endpoint known.
+	h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest("GET", "/", nil))
+
+	sm, err := oidc.NewSessionManager(cfg.SessionEncryptionKey, cfg.ForceHTTPS, cfg.CookieDomain, cfg.CookiePrefix, time.Duration(cfg.SessionMaxAge)*time.Second, oidc.NewLogger("error"))
+	if err != nil {
+		return "", fmt.Errorf("NewSessionManager: %w", err)
+	}
+	defer sm.Shutdown()
+
+	setupReq := httptest.NewRequest("GET", "/ws", nil)
+	session, err := sm.GetSession(setupReq)
+	if err != nil {
+		return "", fmt.Errorf("GetSession: %w", err)
+	}
+	if err := session.SetAuthenticated(true); err != nil {
+		return "", fmt.Errorf("SetAuthenticated: %w", err)
+	}
+	session.SetUserIdentifier("[email protected]")
+	// Built at runtime because a JWT literal trips the pre-commit secret scanner.
+	b64 := base64.RawURLEncoding.EncodeToString
+	sig := make([]byte, 32)
+	for i := range sig {
+		sig[i] = byte(i + 1)
+	}
+	payload := fmt.Sprintf(`{"email":"[email protected]","exp":%d}`, time.Now().Add(-time.Minute).Unix())
+	session.SetAccessToken(b64([]byte(`{"alg":"RS256","typ":"JWT"}`)) + "." + b64([]byte(payload)) + "." + b64(sig))
+	session.SetRefreshToken("yaegi-check-refresh-token")
+	rec := httptest.NewRecorder()
+	if err := session.Save(setupReq, rec); err != nil {
+		return "", fmt.Errorf("session.Save: %w", err)
+	}
+	session.ReturnToPool()
+
+	req := httptest.NewRequest("GET", "/ws", nil)
+	for _, c := range rec.Result().Cookies() {
+		req.AddCookie(c)
+	}
+	req.Header.Set("Upgrade", "websocket")
+	req.Header.Set("Connection", "Upgrade")
+	rw := httptest.NewRecorder()
+	h.ServeHTTP(rw, req)
+
+	if reached {
+		return "", fmt.Errorf("next reached for a revoked grant (status %d)", rw.Code)
+	}
+	if rw.Code != http.StatusUnauthorized {
+		return "", fmt.Errorf("status = %d, want %d", rw.Code, http.StatusUnauthorized)
+	}
+	return "", nil
+}
+
 // checkErrAbortHandlerAbortsUnderYaegi guards the re-review finding on
 // ServeHTTP's ErrAbortHandler branch (middleware.go): under yaegi v0.16.1,
 // `r == http.ErrAbortHandler` only ever matches a panic raised by COMPILED

combined_payload_pool_test.go

@@ -0,0 +1,45 @@
+package traefikoidc
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestDecompressCombinedPayloadReusesReaders(t *testing.T) {
+	var readers sync.Pool
+	first, err := compressCombinedPayload(&combinedSessionPayload{Ui: "[email protected]"})
+	if err != nil {
+		t.Fatalf("compress first: %v", err)
+	}
+	second, err := compressCombinedPayload(&combinedSessionPayload{Ui: "[email protected]"})
+	if err != nil {
+		t.Fatalf("compress second: %v", err)
+	}
+
+	cases := []struct {
+		name     string
+		input    string
+		wantUser string
+		wantErr  bool
+	}{
+		{"first payload", first, "[email protected]", false},
+		{"corrupt payload rejected", "bm90LWd6aXA=", "", true},
+		{"second payload after corrupt one", second, "[email protected]", false},
+		{"first payload again", first, "[email protected]", false},
+	}
+	for _, tc := range cases {
+		got, err := decompressCombinedPayload(tc.input, &readers)
+		if tc.wantErr {
+			if err == nil {
+				t.Fatalf("%s: expected error", tc.name)
+			}
+			continue
+		}
+		if err != nil {
+			t.Fatalf("%s: %v", tc.name, err)
+		}
+		if got.Ui != tc.wantUser {
+			t.Fatalf("%s: user = %q, want %q", tc.name, got.Ui, tc.wantUser)
+		}
+	}
+}

config_marshalling.go

@@ -76,6 +76,7 @@ func (c Config) configToMap() map[string]interface{} {
 	result["enablePKCE"] = c.EnablePKCE
 	result["allowPrivateIPAddresses"] = c.AllowPrivateIPAddresses
 	result["allowUnauthenticatedPreflight"] = c.AllowUnauthenticatedPreflight
+	result["streamingRefresh"] = c.StreamingRefresh
 	result["minimalHeaders"] = c.MinimalHeaders
 	result["stripAuthCookies"] = c.StripAuthCookies
 	result["cookiePath"] = c.CookiePath

content_valid_cache_test.go

@@ -0,0 +1,67 @@
+package traefikoidc
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestContentValidCache(t *testing.T) {
+	cm := NewChunkManager(NewLogger(""))
+	t.Cleanup(cm.Shutdown)
+	now := time.Now()
+	valid := tokenWithGroups(t, map[string]interface{}{"sub": "a", "exp": float64(now.Add(time.Hour).Unix()), "iat": float64(now.Unix())})
+	futureIat := tokenWithGroups(t, map[string]interface{}{"sub": "b", "exp": float64(now.Add(2 * time.Hour).Unix()), "iat": float64(now.Add(time.Hour).Unix())})
+	badContent := jwtLike("eyJhbGciOiJSUzI1NiJ9", "eyJzdWIiOiJ4In0", "c2ln\x01bmF0dXJlLXZhbHVl")
+
+	t.Run("valid token passes twice and is cached", func(t *testing.T) {
+		for i := 0; i < 2; i++ {
+			if res := cm.validateToken(valid, AccessTokenConfig); res.Error != nil {
+				t.Fatalf("pass %d: %v", i, res.Error)
+			}
+		}
+		if _, ok := cm.cachedTokenTimes(contentValidKey(valid, AccessTokenConfig)); !ok {
+			t.Fatal("valid token was not cached")
+		}
+	})
+	t.Run("cache is per token type", func(t *testing.T) {
+		if _, ok := cm.cachedTokenTimes(contentValidKey(valid, IDTokenConfig)); ok {
+			t.Fatal("access-token entry leaked into the ID-token key")
+		}
+	})
+	t.Run("time checks still run on a cache hit", func(t *testing.T) {
+		cm.markContentValid(contentValidKey(futureIat, AccessTokenConfig), cm.tokenTimesOf(futureIat))
+		res := cm.validateToken(futureIat, AccessTokenConfig)
+		if res.Error == nil || !strings.Contains(res.Error.Error(), "issued in future") {
+			t.Fatalf("error = %v, want issued-in-future through the content cache", res.Error)
+		}
+	})
+	t.Run("cache hit uses the stored claims", func(t *testing.T) {
+		other := tokenWithGroups(t, map[string]interface{}{"sub": "c", "exp": float64(now.Add(time.Hour).Unix()), "iat": float64(now.Unix())})
+		future := now.Add(time.Hour)
+		cm.markContentValid(contentValidKey(other, AccessTokenConfig), tokenTimes{jwt: true, iat: &future})
+		res := cm.validateToken(other, AccessTokenConfig)
+		if res.Error == nil || !strings.Contains(res.Error.Error(), "issued in future") {
+			t.Fatalf("error = %v, want the cached iat to drive the freshness check", res.Error)
+		}
+	})
+	t.Run("invalid content never cached", func(t *testing.T) {
+		if res := cm.validateToken(badContent, AccessTokenConfig); res.Error == nil {
+			t.Fatal("control character accepted")
+		}
+		if _, ok := cm.cachedTokenTimes(contentValidKey(badContent, AccessTokenConfig)); ok {
+			t.Fatal("invalid token was cached")
+		}
+	})
+	t.Run("cache stays bounded", func(t *testing.T) {
+		for i := 0; i < contentValidCacheMax+10; i++ {
+			cm.markContentValid(contentValidKey(strings.Repeat("x", i%7)+string(rune('a'+i%26))+strings.Repeat("y", i/26), AccessTokenConfig), tokenTimes{})
+		}
+		cm.contentMu.Lock()
+		n := len(cm.contentValid)
+		cm.contentMu.Unlock()
+		if n > contentValidCacheMax {
+			t.Fatalf("cache size %d exceeds %d", n, contentValidCacheMax)
+		}
+	})
+}

docs/CONFIGURATION.md

@@ -313,6 +313,7 @@ strictAudienceValidation: true
 | `disableReplayDetection` | bool | `false` | Disable JTI-based replay attack detection |
 | `allowPrivateIPAddresses` | bool | `false` | Allow private IPs in provider URLs |
 | `allowUnauthenticatedPreflight` | bool | `false` | Bypass auth for a genuine CORS preflight (`OPTIONS` with `Origin` + `Access-Control-Request-Method`); response body is still discarded. Default requires auth for every `OPTIONS` request. |
+| `streamingRefresh` | bool | `false` | Refresh an expired session on SSE/WebSocket requests. Reject the request with `401` when the IdP revokes the grant (`invalid_grant`). Forward it as before when the IdP cannot be reached. |
 
 ### Discovered Endpoint Validation
 

id_token_memo_test.go

@@ -0,0 +1,50 @@
+package traefikoidc
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestIDTokenMemoFollowsStoredToken(t *testing.T) {
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef", false, "", "", time.Hour, NewLogger("error"))
+	if err != nil {
+		t.Fatalf("NewSessionManager: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := sm.Shutdown(); err != nil {
+			t.Errorf("Shutdown: %v", err)
+		}
+	})
+	future := float64(time.Now().Add(time.Hour).Unix())
+	first := tokenWithGroups(t, map[string]interface{}{"sub": "first", "exp": future})
+	second := tokenWithGroups(t, map[string]interface{}{"sub": "second", "exp": future})
+
+	session, err := sm.GetSession(httptest.NewRequest("GET", "/", nil))
+	if err != nil {
+		t.Fatalf("GetSession: %v", err)
+	}
+	steps := []struct {
+		name  string
+		write func()
+		want  string
+	}{
+		{"first read", func() { session.SetIDToken(first) }, first},
+		{"repeat read", func() {}, first},
+		{"after overwrite", func() { session.SetIDToken(second) }, second},
+		{"after clearing", func() { session.SetIDToken("") }, ""},
+		{"after Reset", func() { session.SetIDToken(first); _ = session.GetIDToken(); session.Reset() }, ""},
+	}
+	for _, st := range steps {
+		st.write()
+		if got := session.GetIDToken(); got != st.want {
+			t.Fatalf("%s: GetIDToken = %q, want %q", st.name, got, st.want)
+		}
+		if st.name == "repeat read" && session.idTokenMemoRaw != first {
+			t.Fatal("repeat read did not go through the memo; the test no longer covers it")
+		}
+	}
+	if session.idTokenMemoRaw != "" || session.idTokenMemo != "" {
+		t.Fatal("Reset left an ID-token memo on the pooled session")
+	}
+}

issue162_regression_test.go

@@ -0,0 +1,240 @@
+package traefikoidc
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"text/template"
+	"time"
+)
+
+// Issue #162: the SSE/WebSocket bypass forwarded only X-Forwarded-User, not
+// the operator-configured `headers`. Backends that authenticate the proxy
+// with a shared-secret header (Frigate proxy auth) answered 401 on /ws while
+// normal requests, which go through forwardAuthorized, kept working.
+
+func issue162Templates(t *testing.T, headers map[string]string) map[string]*template.Template {
+	t.Helper()
+	funcMap := headerTemplateFuncMap(claimsWhitelist(nil))
+	out := make(map[string]*template.Template, len(headers))
+	for name, value := range headers {
+		tmpl, err := template.New(name).Funcs(funcMap).Option("missingkey=zero").Parse(value)
+		if err != nil {
+			t.Fatalf("parse template %s: %v", name, err)
+		}
+		out[name] = tmpl
+	}
+	return out
+}
+
+// issue162Request builds a request carrying a saved authenticated session.
+// idClaims and accessClaims are optional; nil leaves that token unset.
+func issue162Request(t *testing.T, sm *SessionManager, idClaims, accessClaims map[string]interface{}) *http.Request {
+	t.Helper()
+	setupReq := httptest.NewRequest(http.MethodGet, "https://app.example.com/ws", nil)
+	session, err := sm.GetSession(setupReq)
+	if err != nil {
+		t.Fatalf("GetSession: %v", err)
+	}
+	if err := session.SetAuthenticated(true); err != nil {
+		t.Fatalf("SetAuthenticated: %v", err)
+	}
+	session.SetUserIdentifier("[email protected]")
+	if idClaims != nil {
+		session.SetIDToken(tokenWithGroups(t, idClaims))
+	}
+	if accessClaims != nil {
+		session.SetAccessToken(tokenWithGroups(t, accessClaims))
+	}
+	rr := httptest.NewRecorder()
+	if err := session.Save(setupReq, rr); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	session.returnToPoolSafely()
+
+	req := httptest.NewRequest(http.MethodGet, "https://app.example.com/ws", nil)
+	for _, c := range rr.Result().Cookies() {
+		req.AddCookie(c)
+	}
+	return req
+}
+
+func issue162Middleware(t *testing.T, sm *SessionManager, templates map[string]*template.Template, seen *http.Header) *TraefikOidc {
+	t.Helper()
+	initComplete := make(chan struct{})
+	close(initComplete)
+	return &TraefikOidc{
+		logger:            GetSingletonNoOpLogger(),
+		name:              "test",
+		sessionManager:    sm,
+		initComplete:      initComplete,
+		extractClaimsFunc: extractClaims,
+		groupClaimName:    "groups",
+		headerTemplates:   templates,
+		next: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			*seen = r.Header.Clone()
+			w.WriteHeader(http.StatusOK)
+		}),
+	}
+}
+
+func issue162SessionManager(t *testing.T) *SessionManager {
+	t.Helper()
+	sm, err := NewSessionManager(strings.Repeat("k", 32), false, "", "", time.Hour, NewLogger("error"))
+	if err != nil {
+		t.Fatalf("NewSessionManager: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := sm.Shutdown(); err != nil {
+			t.Errorf("Shutdown: %v", err)
+		}
+	})
+	return sm
+}
+
+func TestIssue162_StreamingBypassForwardsHeaderTemplates(t *testing.T) {
+	templates := map[string]string{
+		"X-Proxy-Secret":                 "s3cret",
+		"X-Forwarded-Preferred-Username": "{{.Claims.preferred_username}}",
+		"X-Forwarded-Groups":             "{{range $i, $e := .Claims.groups}}{{if $i}},{{end}}{{$e}}{{end}}",
+	}
+	idClaims := map[string]interface{}{
+		"preferred_username": "alice",
+		"groups":             []string{"admins", "viewers"},
+	}
+
+	cases := []struct {
+		name    string
+		prepare func(*http.Request)
+	}{
+		{"websocket", func(r *http.Request) {
+			r.Header.Set("Upgrade", "websocket")
+			r.Header.Set("Connection", "Upgrade")
+		}},
+		{"sse", func(r *http.Request) {
+			r.Header.Set("Accept", "text/event-stream")
+		}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			sm := issue162SessionManager(t)
+			var seen http.Header
+			m := issue162Middleware(t, sm, issue162Templates(t, templates), &seen)
+
+			req := issue162Request(t, sm, idClaims, nil)
+			tc.prepare(req)
+			rw := httptest.NewRecorder()
+			m.ServeHTTP(rw, req)
+
+			if seen == nil {
+				t.Fatalf("next not invoked (status=%d body=%q)", rw.Code, rw.Body.String())
+			}
+			want := map[string]string{
+				"X-Forwarded-User":               "[email protected]",
+				"X-Proxy-Secret":                 "s3cret",
+				"X-Forwarded-Preferred-Username": "alice",
+				"X-Forwarded-Groups":             "admins,viewers",
+			}
+			for h, v := range want {
+				if got := seen.Get(h); got != v {
+					t.Errorf("%s = %q, want %q", h, got, v)
+				}
+			}
+		})
+	}
+}
+
+// Opaque-ID-token providers: normal requests render templates from
+// access-token claims when the session has no ID token, so the bypass must too.
+func TestIssue162_StreamingBypassTemplatesFallBackToAccessTokenClaims(t *testing.T) {
+	sm := issue162SessionManager(t)
+	var seen http.Header
+	m := issue162Middleware(t, sm, issue162Templates(t, map[string]string{
+		"X-Forwarded-Preferred-Username": "{{.Claims.preferred_username}}",
+	}), &seen)
+
+	req := issue162Request(t, sm, nil, map[string]interface{}{"preferred_username": "bob"})
+	req.Header.Set("Accept", "text/event-stream")
+	m.ServeHTTP(httptest.NewRecorder(), req)
+
+	if seen == nil {
+		t.Fatal("next not invoked")
+	}
+	if got := seen.Get("X-Forwarded-Preferred-Username"); got != "bob" {
+		t.Fatalf("X-Forwarded-Preferred-Username = %q, want %q", got, "bob")
+	}
+}
+
+// An unauthenticated upgrade must still be rejected before any template
+// (which can carry a shared secret) is rendered onto the request.
+func TestIssue162_StreamingBypassRejectsUnauthenticatedWithoutTemplates(t *testing.T) {
+	sm := issue162SessionManager(t)
+	var seen http.Header
+	m := issue162Middleware(t, sm, issue162Templates(t, map[string]string{"X-Proxy-Secret": "s3cret"}), &seen)
+
+	req := httptest.NewRequest(http.MethodGet, "https://app.example.com/ws", nil)
+	req.Header.Set("Upgrade", "websocket")
+	req.Header.Set("Connection", "Upgrade")
+	rw := httptest.NewRecorder()
+	m.ServeHTTP(rw, req)
+
+	if seen != nil {
+		t.Fatal("next invoked for unauthenticated upgrade")
+	}
+	if rw.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rw.Code)
+	}
+	if req.Header.Get("X-Proxy-Secret") != "" {
+		t.Fatal("shared-secret template rendered onto a rejected request")
+	}
+}
+
+// Now that the bypass forwards proxy credentials (#162), it must honor
+// IdP-initiated logout like the normal path does; otherwise a logged-out
+// cookie keeps opening WebSocket/SSE with the shared secret attached.
+func TestIssue162_StreamingBypassRejectsIdPLoggedOutSession(t *testing.T) {
+	idClaims := map[string]interface{}{
+		"sid": "sess-162",
+		"sub": "alice",
+		"iat": float64(time.Now().Add(-time.Minute).Unix()),
+	}
+	cases := []struct {
+		name       string
+		invalidate bool
+		wantStatus int
+	}{
+		{"active session forwards", false, http.StatusOK},
+		{"logged-out session rejected", true, http.StatusUnauthorized},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			sm := issue162SessionManager(t)
+			cache := NewCache()
+			defer cache.Close()
+
+			var seen http.Header
+			m := issue162Middleware(t, sm, issue162Templates(t, map[string]string{"X-Proxy-Secret": "s3cret"}), &seen)
+			m.enableBackchannelLogout = true
+			m.sessionInvalidationCache = cache
+			if tc.invalidate {
+				if err := m.invalidateSession("sess-162", ""); err != nil {
+					t.Fatalf("invalidateSession: %v", err)
+				}
+			}
+
+			req := issue162Request(t, sm, idClaims, nil)
+			req.Header.Set("Upgrade", "websocket")
+			req.Header.Set("Connection", "Upgrade")
+			rw := httptest.NewRecorder()
+			m.ServeHTTP(rw, req)
+
+			if rw.Code != tc.wantStatus {
+				t.Fatalf("status = %d, want %d", rw.Code, tc.wantStatus)
+			}
+			if forwarded := seen != nil; forwarded != (tc.wantStatus == http.StatusOK) {
+				t.Fatalf("next invoked = %v, want %v", forwarded, tc.wantStatus == http.StatusOK)
+			}
+		})
+	}
+}

jwt_test_helpers_test.go

@@ -80,3 +80,21 @@ func makeTestJWT(t *testing.T, claims map[string]interface{}) string {
 	return base64.RawURLEncoding.EncodeToString(hdr) + "." +
 		base64.RawURLEncoding.EncodeToString(pl) + ".c2ln"
 }
+
+// tokenWithGroups builds a JWT whose signature segment is long enough to pass
+// the session chunk manager's format validation (>=10 chars) so the access
+// token round-trips through Set/GetAccessToken.
+func tokenWithGroups(t *testing.T, claims map[string]interface{}) string {
+	t.Helper()
+	hdr, _ := json.Marshal(map[string]string{"alg": "RS256", "typ": "JWT"})
+	pl, _ := json.Marshal(claims)
+	// Varied (non-repeating) signature bytes so the session chunk manager's
+	// repeated-character heuristic does not reject it.
+	sigBytes := make([]byte, 32)
+	for i := range sigBytes {
+		sigBytes[i] = byte(i + 1)
+	}
+	sig := base64.RawURLEncoding.EncodeToString(sigBytes)
+	return base64.RawURLEncoding.EncodeToString(hdr) + "." +
+		base64.RawURLEncoding.EncodeToString(pl) + "." + sig
+}

main.go

@@ -336,6 +336,7 @@ func NewWithContext(ctx context.Context, config *Config, next http.Handler, name
 		dcrConfig:                     config.DynamicClientRegistration,
 		allowPrivateIPAddresses:       config.AllowPrivateIPAddresses,
 		allowUnauthenticatedPreflight: config.AllowUnauthenticatedPreflight,
+		streamingRefresh:              config.StreamingRefresh,
 		allowLoopbackHosts:            isLoopbackProviderURL(config.ProviderURL),
 		minimalHeaders:                config.MinimalHeaders,
 		stripAuthCookies:              config.StripAuthCookies,

middleware.go

@@ -273,7 +273,7 @@ func stripIdentityHeaders(req *http.Request) {
 	}
 }
 
-func (t *TraefikOidc) applyBypassUserHeaders(req *http.Request, reason string) (bool, int) {
+func (t *TraefikOidc) applyBypassUserHeaders(rw http.ResponseWriter, req *http.Request, reason string) (bool, int) {
 	if t.sessionManager == nil {
 		return false, http.StatusUnauthorized
 	}
@@ -296,6 +296,30 @@ func (t *TraefikOidc) applyBypassUserHeaders(req *http.Request, reason string) (
 		return false, http.StatusUnauthorized
 	}
 
+	// Opt-in: refresh an expired session so an IdP-revoked grant stops opening
+	// streams. Only a definitive rejection (refreshToken clears the session on
+	// invalid_grant) denies; IdP outages keep forwarding as before. The full
+	// coordinator wait is kept so a rotated refresh token is never dropped.
+	if t.streamingRefresh && bypassTokenExpired(session) {
+		if !t.refreshToken(rw, req, session) && !session.GetAuthenticated() {
+			t.logger.Infof("User %s refresh rejected by IdP (bypass)", userIdentifier)
+			return false, http.StatusUnauthorized
+		}
+	}
+
+	// Mirror the normal path's IdP-initiated logout check: this path forwards
+	// configured headers (often a shared proxy secret), so a logged-out cookie
+	// must not keep opening streams until the absolute session timeout.
+	if t.enableBackchannelLogout || t.enableFrontchannelLogout {
+		if idToken := session.GetIDToken(); idToken != "" {
+			sid, sub, _ := t.extractSessionInfo(idToken)
+			if t.isSessionInvalidated(sid, sub, t.sessionCreatedAtForInvalidation(idToken, session)) {
+				t.logger.Infof("User %s session invalidated via IdP-initiated logout (bypass)", userIdentifier)
+				return false, http.StatusUnauthorized
+			}
+		}
+	}
+
 	// Enforce the user allowlist, mirroring the normal path's authorization
 	// check (isAllowedUser). Without this, an authenticated user not in
 	// allowedUsers (or whose domain is not in allowedUserDomains) could
@@ -314,19 +338,18 @@ func (t *TraefikOidc) applyBypassUserHeaders(req *http.Request, reason string) (
 	// fallback, opaque-ID-token providers (groups only in the access token)
 	// were granted on normal requests but 403'd on the streaming bypass
 	// (R118).
+	var claims map[string]interface{}
+	var claimsErr error
+	if len(t.allowedRolesAndGroups) > 0 || len(t.headerTemplates) > 0 {
+		claims, claimsErr = t.bypassSessionClaims(session)
+	}
+
 	if len(t.allowedRolesAndGroups) > 0 {
-		var groupClaims map[string]interface{}
-		var claimsErr error
-		if idToken := session.GetIDToken(); idToken != "" {
-			groupClaims, claimsErr = session.GetIDTokenClaims(t.extractClaimsFunc)
-		} else if accessToken := session.GetAccessToken(); accessToken != "" {
-			groupClaims, claimsErr = t.extractClaimsFunc(accessToken)
-		}
-		if claimsErr != nil || groupClaims == nil {
+		if claimsErr != nil || claims == nil {
 			t.logger.Debugf("%s bypass: cannot read claims for role check (err=%v): %s", reason, claimsErr, userIdentifier)
 			return false, http.StatusForbidden
 		}
-		groups, roles, extErr := t.extractGroupsAndRolesFromClaims(groupClaims)
+		groups, roles, extErr := t.extractGroupsAndRolesFromClaims(claims)
 		if extErr != nil {
 			t.logger.Debugf("%s bypass: role extraction failed for %s: %v", reason, userIdentifier, extErr)
 			return false, http.StatusForbidden
@@ -351,8 +374,8 @@ func (t *TraefikOidc) applyBypassUserHeaders(req *http.Request, reason string) (
 	// only sets X-Forwarded-User / X-Auth-Request-User (never groups/roles),
 	// forged group/role headers would otherwise survive to the backend,
 	// which commonly trusts them for downstream authorization. Must precede
-	// the sanitize gate so even the drop-on-unsafe early return has already
-	// cleared forged values (R100).
+	// the sanitize gate so forged values are cleared even when the
+	// identifier is dropped as unsafe (R100).
 	stripIdentityHeaders(req)
 
 	// Sanitize the claim-derived identifier before it is injected as a
@@ -361,20 +384,73 @@ func (t *TraefikOidc) applyBypassUserHeaders(req *http.Request, reason string) (
 	// or delimiter characters that would otherwise inject or confuse
 	// downstream header parsing. On failure, drop the header but still
 	// honor the bypass (the identity headers are decoration here).
-	safeIdentifier, ok := sanitizeHeaderClaimValue(userIdentifier, t.headerClaimMaxLen())
-	if !ok {
+	if safeIdentifier, ok := sanitizeHeaderClaimValue(userIdentifier, t.headerClaimMaxLen()); ok {
+		req.Header.Set("X-Forwarded-User", safeIdentifier)
+		if !t.minimalHeaders {
+			req.Header.Set("X-Auth-Request-User", safeIdentifier)
+		}
+		t.logger.Debugf("%s bypass: forwarded user %s from session", reason, safeIdentifier)
+	} else {
 		t.logger.Debugf("%s bypass: dropping unsafe user-identifier header: %s", reason, headerClaimValueReason(userIdentifier, t.headerClaimMaxLen()))
-		return true, 0
 	}
 
-	req.Header.Set("X-Forwarded-User", safeIdentifier)
-	if !t.minimalHeaders {
-		req.Header.Set("X-Auth-Request-User", safeIdentifier)
+	// Backends that authenticate the proxy via configured headers (shared
+	// secret, user/groups) need them on the upgrade too (#162). Claims are
+	// cookie-sealed but not re-verified here; see the doc comment above.
+	if len(t.headerTemplates) > 0 {
+		if claimsErr != nil {
+			t.logger.Debugf("%s bypass: rendering header templates without claims: %v", reason, claimsErr)
+		}
+		t.applyHeaderTemplates(req, &principal{
+			Source:       sourceSession,
+			Identifier:   userIdentifier,
+			AccessToken:  session.GetAccessToken(),
+			IDToken:      session.GetIDToken(),
+			RefreshToken: session.GetRefreshToken(),
+			Claims:       claims,
+		})
 	}
-	t.logger.Debugf("%s bypass: forwarded user %s from session", reason, safeIdentifier)
 	return true, 0
 }
 
+// bypassTokenExpired reports whether the session's access token, or its ID
+// token when the access token carries no readable exp (opaque), has expired.
+// exp is read unverified: the cookie is sealed and a verified refresh follows.
+func bypassTokenExpired(session *SessionData) bool {
+	for _, token := range []string{session.GetAccessToken(), session.GetIDToken()} {
+		if token == "" {
+			continue
+		}
+		jwt, err := parseJWT(token)
+		if err != nil {
+			continue
+		}
+		if exp, ok := jwt.Claims["exp"].(float64); ok {
+			return !time.Now().Before(time.Unix(int64(exp), 0))
+		}
+	}
+	return false
+}
+
+// bypassSessionClaims returns the session's ID-token claims, falling back to
+// access-token claims when there is no ID token, matching the source the
+// normal authorization path uses (R118).
+func (t *TraefikOidc) bypassSessionClaims(session *SessionData) (map[string]interface{}, error) {
+	if t.extractClaimsFunc == nil {
+		return nil, nil
+	}
+	// Explicit assignments, not tail-call returns: yaegi can zero
+	// multi-value tail-call results (see issue151_regression_test.go).
+	var claims map[string]interface{}
+	var err error
+	if session.GetIDToken() != "" {
+		claims, err = session.GetIDTokenClaims(t.extractClaimsFunc)
+	} else if accessToken := session.GetAccessToken(); accessToken != "" {
+		claims, err = t.extractClaimsFunc(accessToken)
+	}
+	return claims, err
+}
+
 // ServeHTTP implements the main middleware logic for processing HTTP requests.
 // It handles the complete OIDC authentication flow including:
 //   - Excluded URL bypass
@@ -594,7 +670,7 @@ func (t *TraefikOidc) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 			// Otherwise an unauthenticated client could hit the backend
 			// just by setting Accept: text/event-stream or sending a
 			// WebSocket upgrade.
-			if ok, status := t.applyBypassUserHeaders(req, reason); !ok {
+			if ok, status := t.applyBypassUserHeaders(rw, req, reason); !ok {
 				msg := "Authentication required"
 				if status == http.StatusForbidden {
 					msg = "Access denied"
@@ -1248,6 +1324,64 @@ func joinBoundedClaimHeader(values []string) string {
 	return b.String()
 }
 
+// applyHeaderTemplates renders the configured header templates for p onto req.
+func (t *TraefikOidc) applyHeaderTemplates(req *http.Request, p *principal) {
+	if len(t.headerTemplates) == 0 {
+		return
+	}
+	// p.Claims may be nil (e.g. session without an ID token). Templates
+	// referencing .Claims.* will simply produce empty values — matches
+	// the prior behavior. Bearer-source principals always carry access-
+	// token claims (post-verifyToken).
+	templateData := map[string]interface{}{
+		"AccessToken":  p.AccessToken,
+		"IDToken":      p.IDToken,
+		"IdToken":      p.IDToken, // documented spelling (README/CONFIGURATION); alias so {{.IdToken}} renders (issue #149 review)
+		"RefreshToken": p.RefreshToken,
+		"Claims":       p.Claims,
+	}
+
+	for headerName, tmpl := range t.headerTemplates {
+		var buf bytes.Buffer
+		if err := tmpl.Execute(&buf, templateData); err != nil {
+			t.logger.Errorf("Failed to execute template for header %s: %v", headerName, err)
+			continue
+		}
+		headerValue := buf.String()
+		// Go's text/template renders a missing key in an interface-valued
+		// map as the literal "<no value>" even with missingkey=zero
+		// (zero only applies to typed keys). Replace that sentinel so an
+		// optional claim the provider did not emit (e.g. email) does not
+		// leak "<no value>" into the downstream header.
+		if strings.Contains(headerValue, noValueSentinel) {
+			headerValue = stripNoValueSentinels(headerValue)
+		}
+		// Skip an empty render: Setting "" would clobber an identity
+		// header (X-Forwarded-User / X-Auth-Request-*) the caller already
+		// injected with the authenticated value, silently
+		// dropping the user identity at the backend.
+		if headerValue == "" {
+			t.logger.Debugf("Skipping templated header %s: rendered value is empty", headerName)
+			continue
+		}
+		// Sanitize the rendered output: template inputs are claim-derived
+		// and attacker-influenceable, so reject control chars (header
+		// injection), bidi-override runes, the , ; = delimiters, and an
+		// over-long value. Fail closed by dropping the header rather than
+		// forwarding a tainted value. Do not log the value (it commonly
+		// carries the access token); log only name + reason.
+		if reason := headerValueReason(headerValue, headerTemplateMaxLen); reason != "" {
+			t.logger.Debugf("Dropping templated header %s: value failed sanitization (%s)", headerName, reason)
+			continue
+		}
+		req.Header.Set(headerName, headerValue)
+		// Do not log the value: templated headers commonly carry the access
+		// token (e.g. "Authorization: Bearer {{.AccessToken}}"), and logging
+		// it — even at debug — leaks credentials into logs.
+		t.logger.Debugf("Set templated header %s (%d bytes)", headerName, len(headerValue))
+	}
+}
+
 func (t *TraefikOidc) forwardAuthorized(rw http.ResponseWriter, req *http.Request, p *principal) {
 	// This middleware fully owns the identity headers it injects upstream.
 	// Unconditionally remove any inbound values with the same names first:
@@ -1383,59 +1517,7 @@ func (t *TraefikOidc) forwardAuthorized(rw http.ResponseWriter, req *http.Reques
 		req.Header.Del("Authorization")
 	}
 
-	if len(t.headerTemplates) > 0 {
-		// p.Claims may be nil (e.g. session without an ID token). Templates
-		// referencing .Claims.* will simply produce empty values — matches
-		// the prior behavior. Bearer-source principals always carry access-
-		// token claims (post-verifyToken).
-		templateData := map[string]interface{}{
-			"AccessToken":  p.AccessToken,
-			"IDToken":      p.IDToken,
-			"IdToken":      p.IDToken, // documented spelling (README/CONFIGURATION); alias so {{.IdToken}} renders (issue #149 review)
-			"RefreshToken": p.RefreshToken,
-			"Claims":       p.Claims,
-		}
-
-		for headerName, tmpl := range t.headerTemplates {
-			var buf bytes.Buffer
-			if err := tmpl.Execute(&buf, templateData); err != nil {
-				t.logger.Errorf("Failed to execute template for header %s: %v", headerName, err)
-				continue
-			}
-			headerValue := buf.String()
-			// Go's text/template renders a missing key in an interface-valued
-			// map as the literal "<no value>" even with missingkey=zero
-			// (zero only applies to typed keys). Replace that sentinel so an
-			// optional claim the provider did not emit (e.g. email) does not
-			// leak "<no value>" into the downstream header.
-			if strings.Contains(headerValue, noValueSentinel) {
-				headerValue = stripNoValueSentinels(headerValue)
-			}
-			// Skip an empty render: Setting "" would clobber an identity
-			// header (X-Forwarded-User / X-Auth-Request-*) already injected
-			// earlier in this function with the authenticated value, silently
-			// dropping the user identity at the backend.
-			if headerValue == "" {
-				t.logger.Debugf("Skipping templated header %s: rendered value is empty", headerName)
-				continue
-			}
-			// Sanitize the rendered output: template inputs are claim-derived
-			// and attacker-influenceable, so reject control chars (header
-			// injection), bidi-override runes, the , ; = delimiters, and an
-			// over-long value. Fail closed by dropping the header rather than
-			// forwarding a tainted value. Do not log the value (it commonly
-			// carries the access token); log only name + reason.
-			if reason := headerValueReason(headerValue, headerTemplateMaxLen); reason != "" {
-				t.logger.Debugf("Dropping templated header %s: value failed sanitization (%s)", headerName, reason)
-				continue
-			}
-			req.Header.Set(headerName, headerValue)
-			// Do not log the value: templated headers commonly carry the access
-			// token (e.g. "Authorization: Bearer {{.AccessToken}}"), and logging
-			// it — even at debug — leaks credentials into logs.
-			t.logger.Debugf("Set templated header %s (%d bytes)", headerName, len(headerValue))
-		}
-	}
+	t.applyHeaderTemplates(req, p)
 
 	// Strip OIDC session cookies before forwarding to the backend to prevent
 	// HTTP 431 "Request Header Fields Too Large" errors (GitHub issue #122).

review_r100_test.go

@@ -53,7 +53,7 @@ func TestApplyBypassUserHeaders_ClearsForgedIdentityHeaders(t *testing.T) {
 		logger:         NewLogger("debug"),
 	}
 
-	if ok, _ := oidc.applyBypassUserHeaders(req, "test"); !ok {
+	if ok, _ := oidc.applyBypassUserHeaders(httptest.NewRecorder(), req, "test"); !ok {
 		t.Fatalf("applyBypassUserHeaders returned false; bypass should be honored")
 	}
 
@@ -110,7 +110,7 @@ func TestApplyBypassUserHeaders_UnsafeIdentifierClearsForgedValue(t *testing.T)
 		logger:         NewLogger("debug"),
 	}
 
-	if ok, _ := oidc.applyBypassUserHeaders(req, "test"); !ok {
+	if ok, _ := oidc.applyBypassUserHeaders(httptest.NewRecorder(), req, "test"); !ok {
 		t.Fatalf("applyBypassUserHeaders returned false; bypass should be honored")
 	}
 	if v := req.Header.Get("X-Forwarded-User"); v != "" {

review_r118_test.go

@@ -2,8 +2,6 @@ package traefikoidc
 
 import (
 	"context"
-	"encoding/base64"
-	"encoding/json"
 	"errors"
 	"net/http"
 	"net/http/httptest"
@@ -64,24 +62,6 @@ func TestIsRetryableError_HTTPErrorStatus(t *testing.T) {
 
 // --- R118 fix C: bypass role gate must fall back to access-token claims ---
 
-// tokenWithGroups builds a JWT whose signature segment is long enough to pass
-// the session chunk manager's format validation (>=10 chars) so the access
-// token round-trips through Set/GetAccessToken.
-func tokenWithGroups(t *testing.T, claims map[string]interface{}) string {
-	t.Helper()
-	hdr, _ := json.Marshal(map[string]string{"alg": "RS256", "typ": "JWT"})
-	pl, _ := json.Marshal(claims)
-	// Varied (non-repeating) signature bytes so the session chunk manager's
-	// repeated-character heuristic does not reject it.
-	sigBytes := make([]byte, 32)
-	for i := range sigBytes {
-		sigBytes[i] = byte(i + 1)
-	}
-	sig := base64.RawURLEncoding.EncodeToString(sigBytes)
-	return base64.RawURLEncoding.EncodeToString(hdr) + "." +
-		base64.RawURLEncoding.EncodeToString(pl) + "." + sig
-}
-
 // TestApplyBypassUserHeaders_AccessTokenGroupFallback regresses R118: the
 // SSE/WebSocket bypass role gate read only the session's ID token, while the
 // main authorization path falls back to access-token claims when no ID token
@@ -120,7 +100,7 @@ func TestApplyBypassUserHeaders_AccessTokenGroupFallback(t *testing.T) {
 		allowedRolesAndGroups: map[string]struct{}{"team-a": {}},
 	}
 
-	ok, status := oidc.applyBypassUserHeaders(req, "test")
+	ok, status := oidc.applyBypassUserHeaders(httptest.NewRecorder(), req, "test")
 	if !ok {
 		t.Fatalf("bypass role gate denied access-token group; got status %d, want granted", status)
 	}

review_r48_regression_test.go

@@ -42,7 +42,7 @@ func TestApplyBypassUserHeaders_SanitizesIdentifier(t *testing.T) {
 		logger:         NewLogger("debug"),
 	}
 
-	if ok, _ := oidc.applyBypassUserHeaders(req, "test"); !ok {
+	if ok, _ := oidc.applyBypassUserHeaders(httptest.NewRecorder(), req, "test"); !ok {
 		t.Fatalf("applyBypassUserHeaders returned false; bypass should be honored")
 	}
 	if v := req.Header.Get("X-Forwarded-User"); v != "" {
@@ -83,7 +83,7 @@ func TestApplyBypassUserHeaders_KeepsCleanIdentifier(t *testing.T) {
 		logger:         NewLogger("debug"),
 	}
 
-	if ok, _ := oidc.applyBypassUserHeaders(req, "test"); !ok {
+	if ok, _ := oidc.applyBypassUserHeaders(httptest.NewRecorder(), req, "test"); !ok {
 		t.Fatalf("applyBypassUserHeaders returned false; bypass should be honored")
 	}
 	if v := req.Header.Get("X-Forwarded-User"); v != "[email protected]" {

session.go

@@ -193,8 +193,10 @@ func compressCombinedPayload(payload *combinedSessionPayload) (string, error) {
 }
 
 // decompressCombinedPayload decompresses a base64+gzip encoded combined session payload.
+// readers pools *gzip.Reader values: a new reader allocates its 32 KB window,
+// which is a large per-request cost under yaegi.
 // Returns the deserialized payload and any error encountered.
-func decompressCombinedPayload(compressed string) (*combinedSessionPayload, error) {
+func decompressCombinedPayload(compressed string, readers *sync.Pool) (*combinedSessionPayload, error) {
 	if compressed == "" {
 		return nil, fmt.Errorf("empty compressed data")
 	}
@@ -204,11 +206,16 @@ func decompressCombinedPayload(compressed string) (*combinedSessionPayload, erro
 		return nil, fmt.Errorf("failed to decode base64: %w", err)
 	}
 
-	gr, err := gzip.NewReader(bytes.NewReader(data))
+	gr, _ := readers.Get().(*gzip.Reader)
+	if gr == nil {
+		gr, err = gzip.NewReader(bytes.NewReader(data))
+	} else {
+		err = gr.Reset(bytes.NewReader(data))
+	}
 	if err != nil {
 		return nil, fmt.Errorf("failed to create gzip reader: %w", err)
 	}
-	defer func() { _ = gr.Close() }()
+	defer readers.Put(gr)
 
 	// Limit decompressed size to prevent zip bombs
 	limitedReader := io.LimitReader(gr, 512*1024) // 512KB max
@@ -408,6 +415,7 @@ func decompressTokenInternal(compressed string) string {
 // session object reuse and supports both HTTP and HTTPS schemes.
 type SessionManager struct {
 	sessionPool    sync.Pool
+	gzipReaders    sync.Pool
 	ctx            context.Context
 	store          sessions.Store
 	logger         *Logger
@@ -1265,7 +1273,7 @@ func (sm *SessionManager) loadFromCombinedCookies(r *http.Request, sessionData *
 		return false
 	}
 
-	payload, err := decompressCombinedPayload(compressed)
+	payload, err := decompressCombinedPayload(compressed, &sm.gzipReaders)
 	if err != nil {
 		sm.logger.Debugf("Failed to decompress combined payload: %v", err)
 		return false
@@ -1410,6 +1418,13 @@ type SessionData struct {
 	// timed against the new owner's own writes.
 	sessionOwner atomic.Uint64
 
+	// idTokenMemoRaw and idTokenMemo cache getIDTokenUnsafe's validated result
+	// for an unchunked, uncompressed stored token, keyed by the stored value.
+	// A request reads the ID token twice, and each read re-ran full chunk
+	// validation. Cleared by Reset so no result outlives its request.
+	idTokenMemoRaw string
+	idTokenMemo    string
+
 	// cachedClaimsToken is the ID token string whose claims were last parsed and
 	// cached. A lazy, per-request cache to avoid re-parsing the JWT on every
 	// authenticated request (e.g. for headerTemplates). Protected by sessionMutex.
@@ -2086,6 +2101,8 @@ func (sd *SessionData) Reset() {
 	sd.cachedClaimsToken = ""
 	sd.cachedClaims = nil
 	sd.cachedClaimsErr = nil
+	sd.idTokenMemoRaw = ""
+	sd.idTokenMemo = ""
 
 	// Reset the refresh mutex to ensure clean state
 	// Note: We don't need to lock it since sessionMutex is already held
@@ -3017,6 +3034,11 @@ func (sd *SessionData) getIDTokenUnsafe() string {
 		return token
 	}
 
+	memoable := token != "" && !compressed && len(sd.idTokenChunks) == 0
+	if memoable && token == sd.idTokenMemoRaw {
+		return sd.idTokenMemo
+	}
+
 	result := sd.manager.chunkManager.GetToken(
 		token,
 		compressed,
@@ -3024,11 +3046,14 @@ func (sd *SessionData) getIDTokenUnsafe() string {
 		IDTokenConfig,
 	)
 
+	validated := result.Token
 	if result.Error != nil {
-		return ""
+		validated = ""
 	}
-
-	return result.Token
+	if memoable {
+		sd.idTokenMemoRaw, sd.idTokenMemo = token, validated
+	}
+	return validated
 }
 
 // getRefreshTokenUnsafe retrieves the refresh token without acquiring locks.

session_chunk_manager.go

@@ -10,6 +10,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"time"
+	"unicode/utf8"
 
 	"github.com/gorilla/sessions"
 	"github.com/lukaszraczylo/traefikoidc/internal/pool"
@@ -89,9 +90,14 @@ type TokenRetrievalResult struct {
 // and error handling to ensure data integrity and prevent security vulnerabilities
 // throughout the process.
 type ChunkManager struct {
-	lastCleanup    time.Time
-	ctx            context.Context
-	mutex          *sync.RWMutex
+	lastCleanup time.Time
+	ctx         context.Context
+	mutex       *sync.RWMutex
+	// contentValid holds keys of tokens that passed every content-only check.
+	// Browsers resend the same cookie, and re-running those checks on every
+	// request dominated per-request cost under yaegi. Guarded by contentMu.
+	contentValid   map[string]tokenTimes
+	contentMu      sync.Mutex
 	cancel         context.CancelFunc
 	sessionMap     map[string]*SessionEntry
 	logger         *Logger
@@ -127,14 +133,15 @@ func NewChunkManager(logger *Logger) *ChunkManager {
 	ctx, cancel := context.WithCancel(context.Background())
 
 	cm := &ChunkManager{
-		logger:      logger,
-		mutex:       &sync.RWMutex{},
-		ctx:         ctx,
-		cancel:      cancel,
-		sessionMap:  make(map[string]*SessionEntry),
-		maxSessions: 200,              // CRITICAL FIX: Reduced from 1000 to 200 per instance
-		sessionTTL:  15 * time.Minute, // CRITICAL FIX: Reduced from 24h to 15 minutes
-		lastCleanup: time.Now(),
+		logger:       logger,
+		mutex:        &sync.RWMutex{},
+		ctx:          ctx,
+		cancel:       cancel,
+		sessionMap:   make(map[string]*SessionEntry),
+		contentValid: make(map[string]tokenTimes),
+		maxSessions:  200,              // CRITICAL FIX: Reduced from 1000 to 200 per instance
+		sessionTTL:   15 * time.Minute, // CRITICAL FIX: Reduced from 24h to 15 minutes
+		lastCleanup:  time.Now(),
 	}
 
 	// Start background cleanup routine
@@ -293,26 +300,38 @@ func (cm *ChunkManager) processSingleToken(token string, compressed bool, config
 // Returns:
 //   - TokenRetrievalResult with the validated token or validation error.
 func (cm *ChunkManager) validateToken(token string, config TokenConfig) TokenRetrievalResult {
-	if sizeErr := cm.validateTokenSize(token, config); sizeErr != nil {
-		return TokenRetrievalResult{Token: "", Error: sizeErr}
+	// Content-only checks depend on the token string alone, so a token that
+	// passed them once skips them. Expiry and freshness always run.
+	key := contentValidKey(token, config)
+	times, cached := cm.cachedTokenTimes(key)
+
+	if !cached {
+		if sizeErr := cm.validateTokenSize(token, config); sizeErr != nil {
+			return TokenRetrievalResult{Token: "", Error: sizeErr}
+		}
+
+		cm.validateChunkingEfficiency(token, config)
+
+		if contentErr := cm.validateTokenContent(token, config); contentErr != nil {
+			return TokenRetrievalResult{Token: "", Error: contentErr}
+		}
+		times = cm.tokenTimesOf(token)
 	}
 
-	cm.validateChunkingEfficiency(token, config)
-
-	if contentErr := cm.validateTokenContent(token, config); contentErr != nil {
-		return TokenRetrievalResult{Token: "", Error: contentErr}
-	}
-
-	if expErr := cm.validateTokenExpiration(token, config); expErr != nil {
+	if expErr := cm.validateTokenExpiration(times, config); expErr != nil {
 		return TokenRetrievalResult{Token: "", Error: expErr}
 	}
 
-	if freshnessErr := cm.validateTokenFreshness(token, config); freshnessErr != nil {
+	if freshnessErr := cm.validateTokenFreshness(times, config); freshnessErr != nil {
 		return TokenRetrievalResult{Token: "", Error: freshnessErr}
 	}
 
 	// Determine if token is opaque or JWT based on format
 	// JWT tokens have exactly 2 dots (3 parts: header.payload.signature)
+	if cached {
+		return TokenRetrievalResult{Token: token, Error: nil}
+	}
+
 	dotCount := strings.Count(token, ".")
 	isJWT := dotCount == 2
 
@@ -338,6 +357,7 @@ func (cm *ChunkManager) validateToken(token string, config TokenConfig) TokenRet
 		}
 	}
 
+	cm.markContentValid(key, times)
 	return TokenRetrievalResult{Token: token, Error: nil}
 }
 
@@ -350,6 +370,53 @@ func (cm *ChunkManager) validateToken(token string, config TokenConfig) TokenRet
 //
 // Returns:
 //   - TokenRetrievalResult with the reassembled token or error.
+//
+// tokenTimes holds a token's parsed exp and iat claims. They are part of the
+// token content, so a content-cache entry keeps them to avoid re-parsing the
+// payload on every request. The checks that use them still run each time.
+type tokenTimes struct {
+	exp, iat       *time.Time
+	expErr, iatErr error
+	jwt            bool
+}
+
+// tokenTimesOf parses exp and iat from a JWT-shaped token.
+func (cm *ChunkManager) tokenTimesOf(token string) tokenTimes {
+	if !strings.Contains(token, ".") {
+		return tokenTimes{}
+	}
+	t := tokenTimes{jwt: true}
+	t.exp, t.expErr = cm.extractJWTExpiration(token)
+	t.iat, t.iatErr = cm.extractJWTIssuedAt(token)
+	return t
+}
+
+// contentValidCacheMax bounds contentValid; the map is cleared when full.
+const contentValidCacheMax = 4096
+
+// contentValidKey keys a token by type and SHA-256 so the cache does not
+// retain token values.
+func contentValidKey(token string, config TokenConfig) string {
+	sum := sha256.Sum256([]byte(token))
+	return config.Type + ":" + string(sum[:])
+}
+
+func (cm *ChunkManager) cachedTokenTimes(key string) (tokenTimes, bool) {
+	cm.contentMu.Lock()
+	t, ok := cm.contentValid[key]
+	cm.contentMu.Unlock()
+	return t, ok
+}
+
+func (cm *ChunkManager) markContentValid(key string, t tokenTimes) {
+	cm.contentMu.Lock()
+	if len(cm.contentValid) >= contentValidCacheMax {
+		cm.contentValid = make(map[string]tokenTimes)
+	}
+	cm.contentValid[key] = t
+	cm.contentMu.Unlock()
+}
+
 func (cm *ChunkManager) processChunkedToken(chunks map[int]*sessions.Session, config TokenConfig) TokenRetrievalResult {
 	if len(chunks) > config.MaxChunks {
 		err := fmt.Errorf("too many %s token chunks (%d, max: %d)", config.Type, len(chunks), config.MaxChunks)
@@ -504,7 +571,9 @@ func (cm *ChunkManager) validateJWTFormat(token string, tokenType string) error
 			return err
 		}
 
-		for _, char := range part {
+		// Byte loop: a multi-byte rune fails on its first byte either way.
+		for j := 0; j < len(part); j++ {
+			char := part[j]
 			if !((char >= 'A' && char <= 'Z') ||
 				(char >= 'a' && char <= 'z') ||
 				(char >= '0' && char <= '9') ||
@@ -717,9 +786,10 @@ func (cm *ChunkManager) validateTokenSanitization(token string, config TokenConf
 		return err
 	}
 
-	// Check for control characters (ASCII 0-31 and 127)
-	for i, char := range token {
-		if char < 32 || char == 127 {
+	// Check for control characters (ASCII 0-31 and 127). Byte loop: bytes of
+	// a multi-byte rune are >= 0x80, and i is a byte offset either way.
+	for i := 0; i < len(token); i++ {
+		if char := token[i]; char < 32 || char == 127 {
 			err := fmt.Errorf("%s token contains control character at position %d", config.Type, i)
 			return err
 		}
@@ -921,7 +991,13 @@ func (cm *ChunkManager) detectRepeatedCharacters(token string, config TokenConfi
 	currentRepeated := 1
 	var lastChar rune
 
-	for i, char := range token {
+	// Index loops, not range: under yaegi, ranging over a string allocates
+	// O(n²) bytes, which dominated per-request cost for 1-2 KB tokens.
+	for i := 0; i < len(token); {
+		char, size := rune(token[i]), 1
+		if char >= utf8.RuneSelf {
+			char, size = utf8.DecodeRuneInString(token[i:])
+		}
 		if i > 0 && char == lastChar {
 			currentRepeated++
 			if currentRepeated > maxRepeated {
@@ -931,6 +1007,7 @@ func (cm *ChunkManager) detectRepeatedCharacters(token string, config TokenConfi
 			currentRepeated = 1
 		}
 		lastChar = char
+		i += size
 	}
 
 	threshold := 20
@@ -941,8 +1018,13 @@ func (cm *ChunkManager) detectRepeatedCharacters(token string, config TokenConfi
 	}
 
 	charFreq := make(map[rune]int)
-	for _, char := range token {
+	for i := 0; i < len(token); {
+		char, size := rune(token[i]), 1
+		if char >= utf8.RuneSelf {
+			char, size = utf8.DecodeRuneInString(token[i:])
+		}
 		charFreq[char]++
+		i += size
 	}
 
 	tokenLen := len(token)
@@ -963,21 +1045,21 @@ func (cm *ChunkManager) detectRepeatedCharacters(token string, config TokenConfi
 // It extracts and checks JWT expiration claims to ensure tokens are not expired
 // and detects tokens with suspicious expiration times.
 // Parameters:
-//   - token: The token to check expiration for.
+//   - times: The token's parsed claims (see tokenTimesOf).
 //   - config: Token configuration for error context.
 //
 // Returns:
 //   - An error if the token is expired or has invalid expiration, nil if valid.
 //
 //nolint:unparam // error return kept for API consistency and future use
-func (cm *ChunkManager) validateTokenExpiration(token string, config TokenConfig) error {
-	if !strings.Contains(token, ".") {
+func (cm *ChunkManager) validateTokenExpiration(times tokenTimes, config TokenConfig) error {
+	if !times.jwt {
 		return nil
 	}
 
-	expiration, err := cm.extractJWTExpiration(token)
-	if err != nil {
-		cm.logger.Debugf("Could not extract expiration from %s token: %v", config.Type, err)
+	expiration := times.exp
+	if times.expErr != nil {
+		cm.logger.Debugf("Could not extract expiration from %s token: %v", config.Type, times.expErr)
 		return nil
 	}
 
@@ -1062,19 +1144,19 @@ func (cm *ChunkManager) extractJWTExpiration(token string) (*time.Time, error) {
 // It examines the 'iat' (issued at) claim to detect tokens issued too far
 // in the future or suspiciously old tokens that might indicate replay attacks.
 // Parameters:
-//   - token: The token to check freshness for.
+//   - times: The token's parsed claims (see tokenTimesOf).
 //   - config: Token configuration for error context.
 //
 // Returns:
 //   - An error if the token freshness is suspicious, nil if acceptable.
-func (cm *ChunkManager) validateTokenFreshness(token string, config TokenConfig) error {
-	if !strings.Contains(token, ".") {
+func (cm *ChunkManager) validateTokenFreshness(times tokenTimes, config TokenConfig) error {
+	if !times.jwt {
 		return nil
 	}
 
-	issuedAt, err := cm.extractJWTIssuedAt(token)
-	if err != nil {
-		cm.logger.Debugf("Could not extract issued time from %s token: %v", config.Type, err)
+	issuedAt := times.iat
+	if times.iatErr != nil {
+		cm.logger.Debugf("Could not extract issued time from %s token: %v", config.Type, times.iatErr)
 		return nil
 	}
 

settings.go

@@ -115,8 +115,12 @@ type Config struct {
 	// or not, like any other method. Enable only if your backend itself
 	// answers CORS preflights and must see them unauthenticated.
 	AllowUnauthenticatedPreflight bool `json:"allowUnauthenticatedPreflight,omitempty"`
-	MinimalHeaders                bool `json:"minimalHeaders,omitempty"`
-	StripAuthCookies              bool `json:"stripAuthCookies,omitempty"`
+	// StreamingRefresh refreshes an expired session on the SSE/WebSocket
+	// bypass and rejects the request when the IdP revokes the grant.
+	// Default false: the bypass trusts the session cookie until it expires.
+	StreamingRefresh bool `json:"streamingRefresh,omitempty"`
+	MinimalHeaders   bool `json:"minimalHeaders,omitempty"`
+	StripAuthCookies bool `json:"stripAuthCookies,omitempty"`
 	// CookiePath restricts session cookies to a specific path prefix instead of "/".
 	// When traefikoidc protects some but not all paths on a domain, set this to the
 	// middleware's path prefix (e.g. "/app-protegido") so the browser does not send

streaming_refresh_test.go

@@ -0,0 +1,189 @@
+package traefikoidc
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"text/template"
+	"time"
+)
+
+// streamingRefreshSession stores a session whose tokens expire at exp and
+// returns a WebSocket upgrade request carrying its cookies. An empty
+// refreshToken leaves the refresh token unset; opaqueAccess stores a
+// non-JWT access token so only the ID token carries an exp.
+func streamingRefreshSession(t *testing.T, sm *SessionManager, exp time.Time, refreshToken string, opaqueAccess bool) *http.Request {
+	t.Helper()
+	setupReq := httptest.NewRequest(http.MethodGet, "https://app.example.com/ws", nil)
+	session, err := sm.GetSession(setupReq)
+	if err != nil {
+		t.Fatalf("GetSession: %v", err)
+	}
+	if err := session.SetAuthenticated(true); err != nil {
+		t.Fatalf("SetAuthenticated: %v", err)
+	}
+	session.SetUserIdentifier("[email protected]")
+	claims := map[string]interface{}{
+		"email":              "[email protected]",
+		"preferred_username": "alice-old",
+		"exp":                float64(exp.Unix()),
+	}
+	session.SetIDToken(tokenWithGroups(t, claims))
+	if opaqueAccess {
+		session.SetAccessToken("opaque-access-token-without-dots")
+	} else {
+		session.SetAccessToken(tokenWithGroups(t, claims))
+	}
+	if refreshToken != "" {
+		session.SetRefreshToken(refreshToken)
+	}
+	rr := httptest.NewRecorder()
+	if err := session.Save(setupReq, rr); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	session.returnToPoolSafely()
+
+	req := httptest.NewRequest(http.MethodGet, "https://app.example.com/ws", nil)
+	for _, c := range rr.Result().Cookies() {
+		req.AddCookie(c)
+	}
+	req.Header.Set("Upgrade", "websocket")
+	req.Header.Set("Connection", "Upgrade")
+	return req
+}
+
+func TestStreamingBypassRefresh(t *testing.T) {
+	past := time.Now().Add(-time.Minute)
+	future := time.Now().Add(time.Hour)
+	errInvalidGrant := errors.New(`token endpoint returned 400: {"error":"invalid_grant"}`)
+	errTransient := errors.New("dial tcp 10.0.0.1:443: connect: connection refused")
+
+	cases := []struct {
+		name         string
+		enabled      bool
+		exp          time.Time
+		refreshToken string
+		opaqueAccess bool
+		refreshErr   error
+		wantStatus   int
+		wantRefresh  int
+		wantUsername string
+	}{
+		{name: "flag off keeps expired session forwarding", enabled: false, exp: past, refreshToken: "rt-old", wantStatus: http.StatusOK, wantRefresh: 0, wantUsername: "alice-old"},
+		{name: "unexpired token skips refresh", enabled: true, exp: future, refreshToken: "rt-old", wantStatus: http.StatusOK, wantRefresh: 0, wantUsername: "alice-old"},
+		{name: "expired token refreshes and forwards fresh claims", enabled: true, exp: past, refreshToken: "rt-old", wantStatus: http.StatusOK, wantRefresh: 1, wantUsername: "alice-new"},
+		{name: "opaque access token uses ID token expiry", enabled: true, exp: past, refreshToken: "rt-old", opaqueAccess: true, wantStatus: http.StatusOK, wantRefresh: 1, wantUsername: "alice-new"},
+		{name: "revoked grant is rejected", enabled: true, exp: past, refreshToken: "rt-old", refreshErr: errInvalidGrant, wantStatus: http.StatusUnauthorized, wantRefresh: 1},
+		{name: "transient IdP failure still forwards", enabled: true, exp: past, refreshToken: "rt-old", refreshErr: errTransient, wantStatus: http.StatusOK, wantRefresh: 1, wantUsername: "alice-old"},
+		{name: "no refresh token still forwards", enabled: true, exp: past, wantStatus: http.StatusOK, wantRefresh: 0, wantUsername: "alice-old"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			sm, err := NewSessionManager(strings.Repeat("k", 32), false, "", "", time.Hour, NewLogger("error"))
+			if err != nil {
+				t.Fatalf("NewSessionManager: %v", err)
+			}
+			t.Cleanup(func() {
+				if err := sm.Shutdown(); err != nil {
+					t.Errorf("Shutdown: %v", err)
+				}
+			})
+
+			newClaims := map[string]interface{}{
+				"email":              "[email protected]",
+				"preferred_username": "alice-new",
+				"exp":                float64(future.Unix()),
+			}
+			exchanger := &EnhancedMockTokenExchanger{
+				RefreshErr: tc.refreshErr,
+				RefreshResponse: &TokenResponse{
+					AccessToken:  tokenWithGroups(t, newClaims),
+					IDToken:      tokenWithGroups(t, newClaims),
+					RefreshToken: "rt-new",
+				},
+			}
+			tmpl := template.Must(template.New("X-Forwarded-Preferred-Username").
+				Funcs(headerTemplateFuncMap(claimsWhitelist(nil))).
+				Option("missingkey=zero").
+				Parse("{{.Claims.preferred_username}}"))
+
+			initComplete := make(chan struct{})
+			close(initComplete)
+			var seen http.Header
+			m := &TraefikOidc{
+				logger:              GetSingletonNoOpLogger(),
+				name:                "test",
+				sessionManager:      sm,
+				initComplete:        initComplete,
+				extractClaimsFunc:   extractClaims,
+				userIdentifierClaim: "email",
+				tokenExchanger:      exchanger,
+				tokenVerifier:       &EnhancedMockTokenVerifier{},
+				streamingRefresh:    tc.enabled,
+				headerTemplates:     map[string]*template.Template{"X-Forwarded-Preferred-Username": tmpl},
+				next: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					seen = r.Header.Clone()
+					w.WriteHeader(http.StatusOK)
+				}),
+			}
+
+			req := streamingRefreshSession(t, sm, tc.exp, tc.refreshToken, tc.opaqueAccess)
+			rw := httptest.NewRecorder()
+			m.ServeHTTP(rw, req)
+
+			if rw.Code != tc.wantStatus {
+				t.Fatalf("status = %d, want %d", rw.Code, tc.wantStatus)
+			}
+			if got := len(exchanger.RefreshCalls); got != tc.wantRefresh {
+				t.Fatalf("refresh calls = %d, want %d", got, tc.wantRefresh)
+			}
+			if tc.wantStatus != http.StatusOK {
+				if seen != nil {
+					t.Fatal("next invoked for a rejected request")
+				}
+				return
+			}
+			if seen == nil {
+				t.Fatal("next not invoked")
+			}
+			if got := seen.Get("X-Forwarded-Preferred-Username"); got != tc.wantUsername {
+				t.Fatalf("X-Forwarded-Preferred-Username = %q, want %q", got, tc.wantUsername)
+			}
+			if tc.wantRefresh == 1 && tc.refreshErr == nil && len(rw.Result().Cookies()) == 0 {
+				t.Fatal("refreshed session was not written back as a cookie")
+			}
+		})
+	}
+}
+
+func TestStreamingRefreshConfigWiring(t *testing.T) {
+	if CreateConfig().StreamingRefresh {
+		t.Fatal("streamingRefresh must default to false")
+	}
+	for _, enabled := range []bool{false, true} {
+		config := CreateConfig()
+		config.ProviderURL = "https://provider.example.com"
+		config.ClientID = "test-client-id"
+		config.ClientSecret = "test-secret"
+		config.SessionEncryptionKey = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+		config.CallbackURL = "/callback"
+		config.StreamingRefresh = enabled
+
+		if got, ok := config.configToMap()["streamingRefresh"].(bool); !ok || got != enabled {
+			t.Fatalf("configToMap streamingRefresh = %v (present=%v), want %v", got, ok, enabled)
+		}
+		oidc, err := NewWithContext(context.Background(), config, http.NotFoundHandler(), "test")
+		if err != nil {
+			t.Fatalf("NewWithContext: %v", err)
+		}
+		if oidc.streamingRefresh != enabled {
+			t.Errorf("streamingRefresh = %v, want %v", oidc.streamingRefresh, enabled)
+		}
+		if err := oidc.Close(); err != nil {
+			t.Errorf("Close: %v", err)
+		}
+	}
+}

types.go

@@ -235,6 +235,8 @@ type TraefikOidc struct {
 	// (default false): gates whether shouldBypassAuth's genuine-preflight
 	// check (middleware.go) bypasses OIDC auth at all.
 	allowUnauthenticatedPreflight bool
+	// streamingRefresh mirrors Config.StreamingRefresh (default false).
+	streamingRefresh bool
 	// allowLoopbackHosts permits loopback/localhost hosts in outbound URL
 	// validation (validateHost). Derived at construction time from a loopback
 	// providerURL (local development), never operator-set directly. Mirrors

version.go

@@ -14,4 +14,4 @@ const devPluginVersion = "0.0.0-dev"
 // from build info at runtime (debug.ReadBuildInfo sees Traefik's build graph,
 // not the interpreted plugin). This build-stamped constant is therefore the
 // single source of truth for the version reported by anonymous usage telemetry.
-const traefikoidcPluginVersion = "0.0.0-dev"
+const traefikoidcPluginVersion = "1.0.42"