Release v2.35.0

Tenant selection now forwards a tenant only after AuthProxy has confirmed it for the signed-in account, every service sees the same tenant identifier rules, and services stop receiving AuthProxy's own cookies. See the upgrade notes.

Added

• CallerAuthorizationHeader per service (Default, Forward, Strip) controls whether a caller's own Authorization header reaches the service.
• A warning is logged when forwarded headers arrive from a public address while no trusted proxies are configured.

Changed

• The selected tenant cookie is signed and tied to the account that selected it; cookies from earlier versions are upgraded on first use.
• Tenant membership is confirmed on every request that carries a selected tenant, including anonymous, invitation and registration paths; when the tenants endpoint cannot answer, the request is not forwarded with that tenant.
• Session requests no longer forward the caller's Authorization header unless the service sets CallerAuthorizationHeader: Forward.
• AuthProxy's own cookies are no longer forwarded to services.
• Tenant identifiers from every strategy follow the bearer-route rules (letters, digits, -._~, at most 256 characters).
• Identity bindings for legacy principals now include the identity provider; when several providers are configured, a principal without a provider must sign in again.

Fixed

• The tenant verification URL escapes the tenant identifier.
• The claim strategy reads the tenant claim from the signed-in user only.