Skip to content
Release Radar

OAuth2 Proxy

Security

Reverse proxy that adds authentication with OIDC and other identity providers

oauth2-proxy/oauth2-proxyWebsite
v7.15.472 days after v7.15.3
View on GitHub

Release history

Release Highlights

Important Notes

We have had security audits performed on OAuth2 Proxy in the past couple of weeks and as a result we have fixed several CRITICAL vulnerabilities.

The security vulnerabilities include multiple authentication bypasses and a potential session fixation attack. For more details and to identify if you are effects, we urge all users of OAuth2 Proxy to read the security disclosures.

Furthermore, for improving the security of OAuth2 Proxy we introduced a new flag --trusted-proxy-ip that allows users to explicitly specify trusted reverse proxy IPs for the X-Forwarded-* headers. This is an important step to prevent potential header spoofing attacks and to ensure that OAuth2 Proxy only trusts headers from known and trusted sources. We highly recommend users to review their deployment architecture and consider using this flag to enhance the security of their OAuth2 Proxy instances. Check the docs for more details: https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#proxy-options

Furthermore, we want to thank everyone who contributed to the audits and reported potential issues to make open source software like OAuth2 Proxy more secure for everyone.

Breaking Changes

Changes since v7.15.1

Release Highlights

  • 🐛 Squashed some bugs
  • 🕵️‍♀️ Vulnerabilities have been addressed
    • CVE-2026-33186 OAuth2 Proxy was not impacted by this vulnerability as it isn't in the path of execution

Important Notes

Breaking Changes

Changes since v7.15.0

Release Highlights

  • 🔒 OIDC JWT signing algorithms can now be configured
  • 🍪 CSRF cookie improvements (SameSite option, proper expiration validation)
  • 🧪 Configuration validation flag: --config-test
  • 🔌 Unix socket file mode support
  • 👤 Session state can now be extend with arbitrary claims from ID Token and upstream IDP user profiles endpoint
    • This opens the door for multiple features like:
    • Additional arbitrary header values for any claims your IDP provides
    • Extended OAuth2 Proxy UserInfo endpoint with all additional claims
    • Read the docs here

Important Notes

CSRF cookie validation now correctly uses CSRFExpire instead of Expire. If you relied on the previous behavior, review your session timeout configuration. Check the [documentation(https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#cookie-options) for cookie-csrf-expire.

Breaking Changes

Changes since v7.14.3

  • #3352 fix: backend logout URL call on sign out (#3172)(@vsejpal)
  • #3332 ci: distribute windows binary with .exe extension (@igitur)
  • #2685 feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (@vegetablest)
  • #3278 feat: possibility to inject id_token in redirect url during sign out (@albanf)
  • #2851 feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (@andoks / @tuunit)
  • #3369 fix: use CSRFExpire instead of Expire for CSRF cookie validation (@Br1an67)
  • #3365 fix: filter empty strings from allowed groups (@Br1an67)
  • #3338 feat: add --config-test flag for validating configuration (@MayorFaj)
  • #3347 feat: add same site option for csrf cookies (@jvnoije)
  • #3376 feat: allow setting unix socket file mode when declaring listener (@Tristan971 / @tuunit)

Release Highlights

  • 🔵 Go1.25.7 and upgrade of dependencies to latest versions (@tuunit)
  • 🐛 Bug fixes
    • Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.

Important Notes

We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workflow and to ensure that it can only be triggered from branches originating in the local repository. This potential issue was reported by automated systems as well as a couple of security researchers, and we want to thank everyone for their diligence in looking out for the security of the project. Especially Aastha Aggarwal for her detailed report and follow-up. @Aastha2602

Breaking Changes

Changes since v7.14.2

  • #3183 fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. (@Richard87)

Release Highlights

  • Revert AuthOnly endpoint change from v7.14.1 that caused issues when using skip-provider-button enabled

Important Notes

  • This release reverts the change made in v7.14.1 that caused issues when using the skip-provider-button enabled. Now, when a session does not exist, the AuthOnly endpoint will send a 401 status code as expected instead of a 302 redirect. And instead we extended the documentation to clarify the behavior when using nginx with auth_request and skip-provider-button and how to properly configure redirects for browser and API routes.

Excerpt from v7.14.0 release letter:

This release introduces a breaking change for Alpha Config users and moves us significantly closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more future proof and extensible.

From v7.14.0 onward, header injection sources must be explicitly nested. If you previously relied on squashed fields, update to the new structure before upgrading:

# before v7.14.0
injectRequestHeaders:
- name: X-Forwarded-User
  values:
  - claim: user
- name: X-Custom-Secret-header
  values:
  - value: my-super-secret

# v7.14.0 and later
injectRequestHeaders:
- name: X-Forwarded-User
  values:
  - claimSource:
      claim: user
- name: X-Custom-Secret-header
  values:
  - secretSource:
      value: my-super-secret

Furthermore, Alpha Config now fully supports configuring the Server struct using YAML.

// Server represents the configuration for the Proxy HTTP(S) configuration.
type Server struct {
    // BindAddress is the address on which to serve traffic.
    BindAddress string `yaml:"bindAddress,omitempty"`

    // SecureBindAddress is the address on which to serve secure traffic.
    SecureBindAddress string `yaml:"secureBindAddress,omitempty"`

    // TLS contains the information for loading the certificate and key for the
    // secure traffic and further configuration for the TLS server.
    TLS *TLS `yaml:"tls,omitempty"`
}

// TLS contains the information for loading a TLS certificate and key
// as well as an optional minimal TLS version that is acceptable.
type TLS struct {
    // Key is the TLS key data to use.
    Key *SecretSource `yaml:"key,omitempty"`
    // Cert is the TLS certificate data to use.
    Cert *SecretSource `yaml:"cert,omitempty"`
    // MinVersion is the minimal TLS version that is acceptable.
    MinVersion string `yaml:"minVersion,omitempty"`
    // CipherSuites is a list of TLS cipher suites that are allowed.
    CipherSuites []string `yaml:"cipherSuites,omitempty"`
}

More about how to use Alpha Config can be found in the documentation.

Example Alpha configuration: https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml

We are committed to Semantic Versioning and usually avoid breaking changes without a major version release. Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare the project for future maintainability and future improvements like structured logging.

Breaking Changes

Changes since v7.14.1

Release Highlights

  • 🔵 Go1.25.6 and upgrade of dependencies to latest versions
  • 🐛 Bug fixes
    • AuthOnly now starts the auth flow and send status code 302 if no session exists and skip-provider-button is true
    • Fixed static upstream validation issue due to incorrect defaults

Important Notes

Excerpt from v7.14.0 release letter.

https://github.com/oauth2-proxy/oauth2-proxy/releases/v7.14.0

This release introduces a breaking change for Alpha Config users and moves us significantly closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more future proof and extensible.

From v7.14.0 onward, header injection sources must be explicitly nested. If you previously relied on squashed fields, update to the new structure before upgrading:

# before v7.14.0
injectRequestHeaders:
- name: X-Forwarded-User
  values:
  - claim: user
- name: X-Custom-Secret-header
  values:
  - value: my-super-secret

# v7.14.0 and later
injectRequestHeaders:
- name: X-Forwarded-User
  values:
  - claimSource:
      claim: user
- name: X-Custom-Secret-header
  values:
  - secretSource:
      value: my-super-secret

Furthermore, Alpha Config now fully supports configuring the Server struct using YAML.

// Server represents the configuration for the Proxy HTTP(S) configuration.
type Server struct {
    // BindAddress is the address on which to serve traffic.
    BindAddress string `yaml:"bindAddress,omitempty"`

    // SecureBindAddress is the address on which to serve secure traffic.
    SecureBindAddress string `yaml:"secureBindAddress,omitempty"`

    // TLS contains the information for loading the certificate and key for the
    // secure traffic and further configuration for the TLS server.
    TLS *TLS `yaml:"tls,omitempty"`
}

// TLS contains the information for loading a TLS certificate and key
// as well as an optional minimal TLS version that is acceptable.
type TLS struct {
    // Key is the TLS key data to use.
    Key *SecretSource `yaml:"key,omitempty"`
    // Cert is the TLS certificate data to use.
    Cert *SecretSource `yaml:"cert,omitempty"`
    // MinVersion is the minimal TLS version that is acceptable.
    MinVersion string `yaml:"minVersion,omitempty"`
    // CipherSuites is a list of TLS cipher suites that are allowed.
    CipherSuites []string `yaml:"cipherSuites,omitempty"`
}

More about how to use Alpha Config can be found in the documentation.

Example Alpha configuration: https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml

We are committed to Semantic Versioning and usually avoid breaking changes without a major version release. Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare the project for future maintainability and future improvements like structured logging.

Breaking Changes

Changes since v7.14.0

  • #3309 fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@StefanMarkmann)
  • #3302 fix: static upstreams failing validation due to passHostHeader and proxyWebSockets defaults being set incorrectly (@sourava01 / @tuunit)
  • #3312 chore(deps): upgrade to go1.25.6 and latest dependencies (@tuunit)

Release Highlights

Important Notes

This release introduces a breaking change for Alpha Config users and moves us significantly closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more future proof and extensible.

From v7.14.0 onward, header injection sources must be explicitly nested. If you previously relied on squashed fields, update to the new structure before upgrading:

# before v7.14.0
injectRequestHeaders:
- name: X-Forwarded-User
  values:
  - claim: user
- name: X-Custom-Secret-header
  values:
  - value: my-super-secret

# v7.14.0 and later
injectRequestHeaders:
- name: X-Forwarded-User
  values:
  - claimSource:
      claim: user
- name: X-Custom-Secret-header
  values:
  - secretSource:
      value: my-super-secret

Furthermore, Alpha Config now fully supports configuring the Server struct using YAML.

// Server represents the configuration for the Proxy HTTP(S) configuration.
type Server struct {
    // BindAddress is the address on which to serve traffic.
    BindAddress string `yaml:"bindAddress,omitempty"`

    // SecureBindAddress is the address on which to serve secure traffic.
    SecureBindAddress string `yaml:"secureBindAddress,omitempty"`

    // TLS contains the information for loading the certificate and key for the
    // secure traffic and further configuration for the TLS server.
    TLS *TLS `yaml:"tls,omitempty"`
}

// TLS contains the information for loading a TLS certificate and key
// as well as an optional minimal TLS version that is acceptable.
type TLS struct {
    // Key is the TLS key data to use.
    Key *SecretSource `yaml:"key,omitempty"`
    // Cert is the TLS certificate data to use.
    Cert *SecretSource `yaml:"cert,omitempty"`
    // MinVersion is the minimal TLS version that is acceptable.
    MinVersion string `yaml:"minVersion,omitempty"`
    // CipherSuites is a list of TLS cipher suites that are allowed.
    CipherSuites []string `yaml:"cipherSuites,omitempty"`
}

More about how to use Alpha Config can be found in the documentation.

Example Alpha configuration: https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml

We are committed to Semantic Versioning and usually avoid breaking changes without a major version release. Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare the project for future maintainability and future improvements like structured logging.

Breaking Changes

  • Alpha Config: header injection no longer supports squashed claim/secret sources; they must now be set explicitly (see example above).

Changes since v7.13.0

Release Highlights

Important Notes

By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both X-Forwarded-For and X_Forwarded-for will now be treated as equivalent and stripped away.

Please read our security advisory for CVE-2025-64484: GHSA-vjrc-mh2v-45x6

Furthermore, we now use the access_token for validating refreshed sessions in OIDC providers instead of the id_token. This is to align with the OIDC specification which states that id_tokens are not guaranteed to be issued when using refresh tokens. In future releases we might remove the id_token validation for sessions completely.

Breaking Changes

N/A

Changes since v7.12.0

  • #3228 fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file (@stagswtf)
  • #3244 chore(deps): upgrade to latest go1.25.3 (@tuunit)
  • #3238 chore: Replace pkg/clock with narrowly targeted stub clocks (@dsymonds)
  • #3237 - feat: add option to use organization id for preferred username in Google Provider (@pixeldrew)
  • GHSA-vjrc-mh2v-45x6 fix: request header smuggling by stripping all normalized header variants (@tuunit)
  • #1933 fix: validation of refreshed sessions using the access_token in the OIDC provider (@gysel / @tuunit)
  • #2841 feat: add allowed_* constraint option to proxy endpoint query string (@jacobalberty)

Release Highlights

  • 🕵️‍♀️ Vulnerabilities have been addressed
  • 🦸 Support for Cidaas IDP
  • 🐛 Squashed some bugs

Important Notes

Breaking Changes

Changes since v7.11.0