Skip to content

Release v2.46.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 03:51
v2.46.0
900944b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Deployments that use forwarded-identity signing now get signing and transport protection on AuthProxy's identity back-channel calls as well as on proxied requests. Deployments without forwarded-identity signing are unaffected.

Changed

  • Sign-in callbacks to a service with forwarded-identity signing configured carry the forwarded-identity envelope, and are not sent if signing fails (#262)
  • When forwarded-identity signing is configured, on-behalf, invitation, link and sign-in notification calls use the backend TLS client settings, and outside the LocalDevelopment profile they must use HTTPS
  • When forwarded-identity signing is configured, the client-credentials, capability, tenant and user-token verification endpoints must use HTTPS outside the LocalDevelopment profile, checked at startup and again before each call
  • The forwarded-identity startup report lists these back-channel flows
  • Upgrade: in a signed deployment, serve every endpoint named in a startup validation error over HTTPS

Fixed

  • A path-only client-credentials verification path, such as the default, is resolved against the service's backend address on every platform
Assets 2
Loading