Skip to content

Release v2.10.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 07:04
v2.10.2
27b2489
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Hardens the cookie/session posture so a browser holding old cookies cannot retain access indefinitely: revoking a user's access now takes effect within minutes without validating against backing services on every request.

Changed

  • The auth session is bounded by an absolute lifetime (default 12h, configurable via Cratis:AuthProxy:Session:Lifetime); sliding expiration is off by default so activity cannot extend a session indefinitely. The auth cookie remains session-scoped, so closing the browser ends it.
  • The identity-details cookie now expires after the identity re-validation interval (default 10 min), forcing periodic re-resolution of identity and authorization instead of living for the whole browser session.
  • A tenant resolved through the selection strategy is re-validated against the tenants endpoint on an interval (default 10 min); when the tenant is no longer available to the user, the tenant cookies are cleared and the request replays through fresh resolution.
  • Auth, correlation, and nonce cookies now use SecurePolicy.SameAsRequest instead of None.

Added

  • Cratis:AuthProxy:Session configuration section: Lifetime, SlidingExpiration, IdentityRevalidationInterval, TenantRevalidationInterval (zero/negative interval opts out), with documentation.

All 576 specs pass (28 new covering the option defaults, cookie configuration, identity cookie expiry, and tenant re-validation). Not verified live against a deployed IdP — in-process spec coverage only.

🤖 Generated with Claude Code

Assets 2
Loading