Skip to content

Release v2.55.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 18:36
v2.55.0
97e4f66
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

AuthProxy can now sign forwarded identity with the v2 envelope (ES256), starting with browser sessions established through Cratis Identity. Credential kinds without an authoritative adapter are refused rather than guessed.

Added

  • Forwarded identity v2: ES256-signed envelope carrying the credential id, issuer, subject and verified authentication time, with key lifetime and readiness reporting. Signing refuses when trusted context is missing.
  • Protected browser-session evidence with a stable credential id created at sign-in from verified Cratis Identity realm evidence only. The id and authentication time survive session renewal; legacy or incomplete sessions are refused.
  • Gateway configuration for the backend tenant header, and removal of that header from inbound requests so callers cannot spoof it.

Changed

  • Sign-in callbacks carry a short-lived signed snapshot and re-check the session before each send attempt.
  • The ForwardedIdentitySigner constructor keeps its previous overload, and a warning is logged when the HTTP context accessor is not registered.

Security

  • Personal access tokens, bearer tokens, DPoP and on-behalf requests are refused fail-closed by the v2 signer until their authoritative credential adapters exist.
Assets 2
Loading