Skip to content

Release v2.31.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 10:54
v2.31.0
51442d2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

One AuthProxy can now serve several applications on their own hosts with one sign-in and one identity-provider callback. Nothing changes until you configure it: the session cookie keeps its name and stays host-only, each host keeps running its own handshake, and return URLs stay relative.

Added

  • Session:CookieDomain shares the session cookie with every host under a parent domain, for example .example.com. Sign-out deletes it for the whole domain, and the stale host-only copy that an earlier deployment left in a browser is deleted on sign-in, on sign-out, when the cookie arrives twice and when it cannot be read. (#194)
  • Session:CookieName renames the session cookie, so two AuthProxy deployments under one domain do not read each other's sessions. The default stays .Cratis.AuthProxy.Auth.v2.
  • SignIn:CallbackHost runs every OAuth or OIDC handshake on one host. A sign-in or sign-out that starts elsewhere is sent there and returns to the original address, so the provider needs one callback and one post-logout address. It requires Session:CookieDomain.
  • A sign-in may return to an absolute address only when SignIn:CallbackHost is set, and only for an origin of a declared service host, a configured frontend, the lobby or Logout:AllowedRedirectOrigins that lies inside the cookie domain, on the scheme the request arrived on. Anything else is reduced to a path on the host it started on. Sign-out uses the same list.
  • Aspire: WithHosts, WithPathPrefix, WithSessionCookieDomain, WithSessionCookieName and WithSignInCallbackHost.
  • A startup warning when Session:CookieDomain is set while AllowedHosts accepts every host, and when the cookie name uses the __Secure- prefix.
  • A how-to, One proxy, several hosts, with the migration from several instances.

Changed

  • AuthProxy now refuses to start when Session:CookieDomain is combined with the SubHost tenant resolution, when a declared service host or the callback host is outside the cookie domain, when the domain is an address, a top-level domain, a wildcard or carries a port, when the cookie name is not a valid name, and when the name uses the __Host- prefix together with a domain. None of these can occur unless you set the new options.
  • Invitations, credential links and registration still run on the host they start on. With a callback host, register a provider callback for every host where one of them can start.
Assets 2
Loading