Skip to content

Release v2.50.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 05:07
v2.50.1
58b9a4b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Anonymous routes no longer carry authenticated identity to the backend, and sign-in callback matching is limited to the configured callback paths.

Security

  • On routes configured as anonymous, forwarded identity, tenant, authorization, on-behalf and signature material is now removed before the request reaches the backend, including caller-supplied copies. (#275)
  • Authentication bootstrap path matching now accepts only the configured callback paths instead of any path starting with /signin-. (part of #275)
Assets 2
Loading