Skip to content

v2.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Jul 15:06
· 17 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.4.0
4d902ee

What's Changed

Features

  • DPoP (RFC 9449) support added if upstream IdP supports it by @velias in #61
  • PAR (RFC 9126) support added if upstream IdP advertises it by @velias in #62
  • Hardened OAuth redirect handling and outbound fetches against open-redirect / SSRF class issues. by @velias in #67
    • Reject HTTP redirects when fetching upstream well-known and health probes (redirect: 'error')
    • Validate CIMD redirect_uris (and authorize/PAR CIMD redirects) with shared URI security checks; block dangerous schemes (javascript:, data:, etc.)
    • Make redirect allowlist wildcards host-aware: http://host/* / http://host/:* still allow any port/path, but domain-extension matches (host.evil.com) are rejected
    • Treat IPv6-mapped private addresses in hex form (::ffff:7f00:1) as private for CIMD SSRF checks

Full Changelog: v2.3.0...v2.4.0

Contributors

velias
Assets 3
Loading