Skip to content

Release v2.51.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 06:08
v2.51.0
afb6955
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

AuthProxy no longer trusts forwarded headers from any peer unless trusted proxies are configured. Deployments behind an ingress or load balancer must set TrustedProxies (and ForwardLimit where proxies are chained) before upgrading, or explicitly opt in with Mode=TrustAny when a network boundary already restricts who can reach AuthProxy.

Changed

  • Forwarded headers are ignored by default when no trusted proxies are configured; the previous allow-all behavior for an empty list is removed. TrustAny remains an explicit opt-in and the platform forwarded-headers switch cannot bypass the setting. (#278)
  • AuthProxy logs a startup warning when running with no trusted proxies, and a rate-limited warning when requests carry forwarded headers that are being ignored. (#278)
  • The Aspire integration defaults to TrustAny for local runs only, unless trusted-proxy settings are configured explicitly; published deployments use the secure default. (#278)
  • The trusted-proxies documentation now describes the upgrade steps and settings. (#278)
Assets 2
Loading