False
        

Triggered text Ignored text Blocked text

tag:github.com,2008:https://github.com/oauth2-proxy/oauth2-proxy/releases

Release notes from oauth2-proxy

2026-10-01T09:01:35Z tag:github.com,2008:Repository/105262714/v7.15.5 2026-10-01T09:07:54Z

v7.15.5

<h2>Release Highlights</h2> <ul> <li>🔵 Golang version upgrade to v1.26.8 <ul> <li>Upgrade of all dependencies to their latest versions</li> </ul> </li> <li>🕵️‍♀️ Vulnerabilities have been addressed <ul> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56855" rel="nofollow">CVE-2026-56855</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-78662" rel="nofollow">CVE-2026-78662</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-84304" rel="nofollow">CVE-2026-84304</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-84445" rel="nofollow">CVE-2026-84445</a></li> </ul> </li> </ul> <h2>Important Notes</h2> <p>The Bitbucket provider <code>--bitbucket-team</code> flag got deprecated and we added <code>--bitbucket-workspace</code> flag to restrict logins to members of a specific workspace instead of a team. The <code>--bitbucket-team</code> flag is still supported and will act like workspace but will be removed in a future release. Please update your configuration to use the new <code>--bitbucket-workspace</code> flag. For more information, refer to <a href="https://developer.atlassian.com/cloud/bitbucket/bitbucket-api-teams-deprecation/" rel="nofollow">Bitbucket teams API deprecation</a>.</p> <p>Additionally refer to OAuth client configuration for Bitbucket provider in the <a href="https://oauth2-proxy.github.io/oauth2-proxy/configuration/providers/bitbucket/" rel="nofollow">documentation</a>. for changes in the scopes (Account>Read) is now required if you restrict by workspace.</p> <p>Security Advisories:</p> <ul> <li>(Critical) <a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-63jm-59jj-478j">GHSA-63jm-59jj-478j</a> Authentication bypass via inconsistent skip-auth path interpretation</li> <li>(Critical) <a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-wr5q-7wxw-x568">GHSA-wr5q-7wxw-x568</a> Authentication bypass via spoofed client-IP headers in OAuth2 Proxy</li> <li>(Moderate) <a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-hhqp-vx7f-5c6m">GHSA-hhqp-vx7f-5c6m</a> Credential disclosure through OAuth callback error logging</li> </ul> <p>Read more below</p> <h2>Critical Fixes</h2> <p>For a small subset of deployments these fixes might be breaking change for the sake of fixing trust/security boundaries.</p> <h3><a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-63jm-59jj-478j">GHSA-63jm-59jj-478j</a> Authentication bypass via inconsistent skip-auth path interpretation</h3> <p><strong>Skip-auth path matching is now stricter</strong>: <code>--skip-auth-route</code> and<br> <code>--skip-auth-regex</code> no longer grant exemptions for invalid or ambiguous paths,<br> even when a positive or negated rule would otherwise match. This includes dot<br> segments, repeated slashes (including leading <code>//</code>), semicolons, backslashes,<br> fragment-like content, decoded question marks, and control characters, including<br> encoded forms. For example, previously public <code>/public/file;version=1</code> and<br> <code>/public//file</code> now follow normal authentication and authorization. <code>#</code> and <code>%23</code><br> are no longer silently stripped before matching.</p> <p>Trusted <code>X-Forwarded-Uri</code> metadata must use origin form (<code>/path?query</code>), not a full<br> URL. Before upgrading, review public-route exemptions and external-auth header<br> configuration. If unusual paths must remain public, expose them separately from<br> the protected routing boundary rather than broadening skip-auth rules.</p> <p>Flag names and configuration syntax are unchanged. Ordinary query strings,<br> trailing-slash distinctions, and unambiguous escaped characters retain their<br> matching behavior. The fix does not rewrite upstream request targets or<br> unconditionally reject authenticated requests; existing router behavior and<br> separately configured exemptions remain unchanged.</p> <h3><a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-wr5q-7wxw-x568">GHSA-wr5q-7wxw-x568</a> Authentication bypass via spoofed client-IP headers in OAuth2 Proxy</h3> <p><strong>Trusted client-IP resolution now enforces trusted proxy boundaries</strong>: When<br> <code>--reverse-proxy</code> is enabled, client-IP headers configured via<br> <code>--real-client-ip-header</code> are accepted only from direct peers that match<br> <code>--trusted-proxy-ip</code>. If the direct peer is not trusted, the transport peer<br> address is evaluated instead.</p> <p>For <code>X-Forwarded-For</code>, the chain is traversed from right to left, skipping<br> intermediate proxies in <code>--trusted-proxy-ip</code> and treating the first untrusted<br> address as the client. Leftmost entries cannot be spoofed past the trusted proxy<br> boundary. If <code>--trusted-proxy-ip</code> is left unset, OAuth2 Proxy preserves backwards<br> compatibility by trusting all source addresses and retaining the leftmost<br> behavior, which does not protect against spoofed XFF headers. To secure<br> <code>--trusted-ip</code> exemptions behind a reverse proxy, configure explicit, narrowly<br> scoped <code>--trusted-proxy-ip</code> CIDR ranges and ensure the proxy sanitizes client-IP<br> headers. Missing or malformed client-IP headers from a trusted proxy will no<br> longer fall back to granting exemptions based on the proxy's own IP.</p> <h2>Breaking Changes</h2> <h2>Changes since v7.15.4</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3546" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3546/hovercard">#3546</a> fix: strip the port from the request host when matching cookie domains <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/kirilju/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/kirilju">@kirilju</a></li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3547" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3547/hovercard">#3547</a> fix: refresh additional claims for OIDC and MS Entra ID providers and properly populate additional claims during login (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Apollo3zehn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Apollo3zehn">@Apollo3zehn</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3477" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3477/hovercard">#3477</a> fix(bitbucket): auth failure due to Bitbucket OAuth 2.0 <a href="https://developer.atlassian.com/cloud/bitbucket/changelog/#CHANGE-3052" rel="nofollow">changes on May 4th 2026</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mfouad/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mfouad">@mfouad</a></li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3535" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3535/hovercard">#3535</a> fix: surface Microsoft Graph errors during Entra group overage instead of logging in with an incomplete group set <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/no-hup/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/no-hup">@no-hup</a></li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3527" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3527/hovercard">#3527</a> fix(encryption): return an error instead of panicking on a short GCM ciphertext <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/winklemad/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/winklemad">@winklemad</a></li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.15.4 2026-08-20T06:23:04Z

v7.15.4

<h2>Release Highlights</h2> <ul> <li>🔵 Golang version upgrade to v1.26.7 <ul> <li>Upgrade of all dependencies to their latest versions</li> </ul> </li> <li>🕵️‍♀️ Vulnerabilities have been addressed <ul> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33818" rel="nofollow">CVE-2026-33818</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39821" rel="nofollow">CVE-2026-39821</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39822" rel="nofollow">CVE-2026-39822</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42505" rel="nofollow">CVE-2026-42505</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-46600" rel="nofollow">CVE-2026-46600</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56852" rel="nofollow">CVE-2026-56852</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56853" rel="nofollow">CVE-2026-56853</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56858" rel="nofollow">CVE-2026-56858</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56859" rel="nofollow">CVE-2026-56859</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56860" rel="nofollow">CVE-2026-56860</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-56862" rel="nofollow">CVE-2026-56862</a></li> </ul> </li> </ul> <h2>Important Notes</h2> <h2>Breaking Changes</h2> <h2>Changes since v7.15.3</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3493" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3493/hovercard">#3493</a> chore(deps): update gomod <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a></li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.15.3 2026-06-09T11:35:45Z

v7.15.3

<h2>Release Highlights</h2> <ul> <li>🔵 Golang version upgrade to v1.26.4 <ul> <li>Upgrade of all dependencies to their latest versions</li> </ul> </li> <li>🕵️‍♀️ Vulnerabilities have ben addressed <ul> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33811" rel="nofollow">CVE-2026-33811</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33814" rel="nofollow">CVE-2026-33814</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39820" rel="nofollow">CVE-2026-39820</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39836" rel="nofollow">CVE-2026-39836</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42499" rel="nofollow">CVE-2026-42499</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42504" rel="nofollow">CVE-2026-42504</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39823" rel="nofollow">CVE-2026-39823</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39826" rel="nofollow">CVE-2026-39826</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-39825" rel="nofollow">CVE-2026-39825</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27145" rel="nofollow">CVE-2026-27145</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42507" rel="nofollow">CVE-2026-42507</a></li> </ul> </li> </ul> <h2>Important Notes</h2> <h2>Breaking Changes</h2> <h2>Changes since v7.15.2</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3477" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3477/hovercard">#3477</a> chore(dep): bump go to 1.26 and migrate of reverse proxy handling</li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.15.2 2026-04-14T11:24:35Z

v7.15.2

<h2>Release Highlights</h2> <ul> <li>🔵 Golang version upgrade to v1.25.9 <ul> <li>Upgrade of all dependencies to their latest versions</li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34986" rel="nofollow">CVE-2026-34986</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32281" rel="nofollow">CVE-2026-32281</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32289" rel="nofollow">CVE-2026-32289</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32288" rel="nofollow">CVE-2026-32288</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32280" rel="nofollow">CVE-2026-32280</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32282" rel="nofollow">CVE-2026-32282</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-32283" rel="nofollow">CVE-2026-32283</a></li> </ul> </li> <li>🕵️‍♀️ Vulnerabilities have been addressed</li> </ul> <h2>Important Notes</h2> <p>We have had security audits performed on OAuth2 Proxy in the past couple of weeks and as a result we have fixed<br> several CRITICAL vulnerabilities.</p> <p>The security vulnerabilities include multiple authentication bypasses and a potential session fixation attack.<br> For more details and to identify if you are effects, we urge all users of OAuth2 Proxy to read the security<br> disclosures.</p> <ul> <li>(Critical) <a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v">GHSA-5hvv-m4w4-gf6v</a> fix: health check user-agent authentication bypass</li> <li>(Critical) <a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x">GHSA-7x63-xv5r-3p2x</a> fix: authentication bypass via X-Forwarded-Uri header spoofing</li> <li>(High) <a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg">GHSA-pxq7-h93f-9jrg</a> fix: fragment evaluation as part of the allowed routes</li> <li>(Moderate) <a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3">GHSA-c5c4-8r6x-56w3</a> fix: email validation bypass via malformed multi-@ email claims</li> </ul> <p>Furthermore, for improving the security of OAuth2 Proxy we introduced a new flag <code>--trusted-proxy-ip</code> that allows users<br> to explicitly specify trusted reverse proxy IPs for the <code>X-Forwarded-*</code> headers. This is an important step to prevent<br> potential header spoofing attacks and to ensure that OAuth2 Proxy only trusts headers from known and trusted sources.<br> We highly recommend users to review their deployment architecture and consider using this flag to enhance the security<br> of their OAuth2 Proxy instances. Check the docs for more details: <a href="https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#proxy-options" rel="nofollow">https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#proxy-options</a></p> <p>Furthermore, we want to thank everyone who contributed to the audits and reported potential issues to make open source<br> software like OAuth2 Proxy more secure for everyone.</p> <h2>Breaking Changes</h2> <h2>Changes since v7.15.1</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3411" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3411/hovercard">#3411</a> chore(deps): update gomod dependencies (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3333" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3333/hovercard">#3333</a> fix: invalidate session on fatal OAuth2 refresh errors (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/frhack/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/frhack">@frhack</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f">GHSA-f24x-5g9q-753f</a> fix: clear session cookie at beginning of signinpage handler (@fnoehWM / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/bella-WI/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/bella-WI">@bella-WI</a> / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v">GHSA-5hvv-m4w4-gf6v</a> fix: health check user-agent authentication bypass (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x">GHSA-7x63-xv5r-3p2x</a> fix: authentication bypass via X-Forwarded-Uri header spoofing (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg">GHSA-pxq7-h93f-9jrg</a> fix: fragment evaluation as part of the allowed routes (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3">GHSA-c5c4-8r6x-56w3</a> fix: email validation bypass via malformed multi-@ email claims (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.15.1 2026-03-23T14:55:28Z

v7.15.1

<h2>Release Highlights</h2> <ul> <li>🐛 Squashed some bugs</li> <li>🕵️‍♀️ Vulnerabilities have been addressed <ul> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33186" rel="nofollow">CVE-2026-33186</a><br> OAuth2 Proxy was not impacted by this vulnerability as it isn't in the path of execution</li> </ul> </li> </ul> <h2>Important Notes</h2> <h2>Breaking Changes</h2> <h2>Changes since v7.15.0</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3382" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3382/hovercard">#3382</a> chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3374" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3374/hovercard">#3374</a> fix: handle Unix socket RemoteAddr in IP resolution (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/H1net/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/H1net">@H1net</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3381" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3381/hovercard">#3381</a> fix: do not log error for backend logout 204 (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/artificiosus/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/artificiosus">@artificiosus</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3327" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3327/hovercard">#3327</a> fix: improve logging when session refresh token is missing (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/yosri-brh/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/yosri-brh">@yosri-brh</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/2767" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/2767/hovercard">#2767</a> fix: propagate errors during route building (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sybereal/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/sybereal">@sybereal</a>)</li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.15.0 2026-03-18T17:19:09Z

v7.15.0

<h2>Release Highlights</h2> <ul> <li>🔒 OIDC JWT signing algorithms can now be configured</li> <li>🍪 CSRF cookie improvements (SameSite option, proper expiration validation)</li> <li>🧪 Configuration validation flag: --config-test</li> <li>🔌 Unix socket file mode support</li> <li>👤 Session state can now be extend with arbitrary claims from ID Token and upstream IDP user profiles endpoint <ul> <li>This opens the door for multiple features like:</li> <li>Additional arbitrary header values for any claims your IDP provides</li> <li>Extended OAuth2 Proxy UserInfo endpoint with all additional claims</li> <li>Read the docs <a href="https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#how-to-utilize-arbitrary-claims-provided-by-your-identity-provider" rel="nofollow">here</a></li> </ul> </li> </ul> <h2>Important Notes</h2> <p>CSRF cookie validation now correctly uses <code>CSRFExpire</code> instead of <code>Expire</code>. If you relied on the previous behavior, review your session timeout configuration.<br> Check the [documentation(https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#cookie-options) for <code>cookie-csrf-expire</code>.</p> <h2>Breaking Changes</h2> <h2>Changes since v7.14.3</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3352" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3352/hovercard">#3352</a> fix: backend logout URL call on sign out (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3346120147" data-permission-text="Title is private" data-url="https://github.com/oauth2-proxy/oauth2-proxy/issues/3172" data-hovercard-type="issue" data-hovercard-url="/oauth2-proxy/oauth2-proxy/issues/3172/hovercard" href="https://github.com/oauth2-proxy/oauth2-proxy/issues/3172">#3172</a>)(<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/vsejpal/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/vsejpal">@vsejpal</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3332" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3332/hovercard">#3332</a> ci: distribute windows binary with .exe extension (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/igitur/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/igitur">@igitur</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/2685" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/2685/hovercard">#2685</a> feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/vegetablest/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/vegetablest">@vegetablest</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3278" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3278/hovercard">#3278</a> feat: possibility to inject id_token in redirect url during sign out (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/albanf/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/albanf">@albanf</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/2851" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/2851/hovercard">#2851</a> feat: add support for specifying allowed OIDC JWT signing algorithms (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2483346518" data-permission-text="Title is private" data-url="https://github.com/oauth2-proxy/oauth2-proxy/issues/2753" data-hovercard-type="issue" data-hovercard-url="/oauth2-proxy/oauth2-proxy/issues/2753/hovercard" href="https://github.com/oauth2-proxy/oauth2-proxy/issues/2753">#2753</a>) (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/andoks/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/andoks">@andoks</a> / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3369" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3369/hovercard">#3369</a> fix: use CSRFExpire instead of Expire for CSRF cookie validation (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Br1an67/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Br1an67">@Br1an67</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3365" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3365/hovercard">#3365</a> fix: filter empty strings from allowed groups (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Br1an67/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Br1an67">@Br1an67</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3338" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3338/hovercard">#3338</a> feat: add --config-test flag for validating configuration (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/MayorFaj/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/MayorFaj">@MayorFaj</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3347" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3347/hovercard">#3347</a> feat: add same site option for csrf cookies (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/jvnoije/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/jvnoije">@jvnoije</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3376" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3376/hovercard">#3376</a> feat: allow setting unix socket file mode when declaring listener (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Tristan971/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Tristan971">@Tristan971</a> / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.14.3 2026-02-26T14:11:19Z

v7.14.3

<h2>Release Highlights</h2> <ul> <li>🔵 Go1.25.7 and upgrade of dependencies to latest versions (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>) <ul> <li>Fixes <a href="https://nvd.nist.gov/vuln/detail/cve-2025-68121" rel="nofollow">CVE-2025-68121</a></li> </ul> </li> <li>🐛 Bug fixes <ul> <li>Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.</li> </ul> </li> </ul> <h2>Important Notes</h2> <p>We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workflow and to ensure that it can only be triggered from branches originating in the local repository. This potential issue was reported by automated systems as well as a couple of security researchers, and we want to thank everyone for their diligence in looking out for the security of the project. Especially Aastha Aggarwal for her detailed report and follow-up. <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Aastha2602/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Aastha2602">@Aastha2602</a></p> <h2>Breaking Changes</h2> <h2>Changes since v7.14.2</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3183" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3183/hovercard">#3183</a> fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Richard87/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Richard87">@Richard87</a>)</li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.14.2 2026-01-18T00:28:25Z

v7.14.2

<h2>Release Highlights</h2> <ul> <li>Revert AuthOnly endpoint change from v7.14.1 that caused issues when using <code>skip-provider-button</code> enabled</li> </ul> <h2>Important Notes</h2> <ul> <li>This release reverts the change made in v7.14.1 that caused issues when using the <code>skip-provider-button</code> enabled. Now, when a session does not exist, the AuthOnly endpoint will send a 401 status code as expected instead of a 302 redirect. And instead we extended the documentation to clarify the behavior when using <code>nginx</code> with <code>auth_request</code> and <code>skip-provider-button</code> and how to properly configure redirects for browser and API routes.</li> </ul> <h3>Excerpt from v7.14.0 release letter:</h3> <p>This release introduces a breaking change for Alpha Config users and moves us significantly<br> closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more<br> future proof and extensible.</p> <p>From v7.14.0 onward, header injection sources must be explicitly nested. If you<br> previously relied on squashed fields, update to the new structure before upgrading:</p> <div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# before v7.14.0 injectRequestHeaders: - name: X-Forwarded-User values: - claim: user - name: X-Custom-Secret-header values: - value: my-super-secret # v7.14.0 and later injectRequestHeaders: - name: X-Forwarded-User values: - claimSource: claim: user - name: X-Custom-Secret-header values: - secretSource: value: my-super-secret"><pre><span class="pl-c"><span class="pl-c">#</span> before v7.14.0</span> <span class="pl-ent">injectRequestHeaders</span>: - <span class="pl-ent">name</span>: <span class="pl-s">X-Forwarded-User</span> <span class="pl-ent">values</span>: - <span class="pl-ent">claim</span>: <span class="pl-s">user</span> - <span class="pl-ent">name</span>: <span class="pl-s">X-Custom-Secret-header</span> <span class="pl-ent">values</span>: - <span class="pl-ent">value</span>: <span class="pl-s">my-super-secret</span> <span class="pl-c"><span class="pl-c">#</span> v7.14.0 and later</span> <span class="pl-ent">injectRequestHeaders</span>: - <span class="pl-ent">name</span>: <span class="pl-s">X-Forwarded-User</span> <span class="pl-ent">values</span>: - <span class="pl-ent">claimSource</span>: <span class="pl-ent">claim</span>: <span class="pl-s">user</span> - <span class="pl-ent">name</span>: <span class="pl-s">X-Custom-Secret-header</span> <span class="pl-ent">values</span>: - <span class="pl-ent">secretSource</span>: <span class="pl-ent">value</span>: <span class="pl-s">my-super-secret</span></pre></div> <p>Furthermore, Alpha Config now fully supports configuring the <code>Server</code> struct using YAML.</p> <div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="// Server represents the configuration for the Proxy HTTP(S) configuration. type Server struct { // BindAddress is the address on which to serve traffic. BindAddress string `yaml:"bindAddress,omitempty"` // SecureBindAddress is the address on which to serve secure traffic. SecureBindAddress string `yaml:"secureBindAddress,omitempty"` // TLS contains the information for loading the certificate and key for the // secure traffic and further configuration for the TLS server. TLS *TLS `yaml:"tls,omitempty"` } // TLS contains the information for loading a TLS certificate and key // as well as an optional minimal TLS version that is acceptable. type TLS struct { // Key is the TLS key data to use. Key *SecretSource `yaml:"key,omitempty"` // Cert is the TLS certificate data to use. Cert *SecretSource `yaml:"cert,omitempty"` // MinVersion is the minimal TLS version that is acceptable. MinVersion string `yaml:"minVersion,omitempty"` // CipherSuites is a list of TLS cipher suites that are allowed. CipherSuites []string `yaml:"cipherSuites,omitempty"` }"><pre><span class="pl-s">// Server represents the configuration for the Proxy HTTP(S) configuration.</span> <span class="pl-s">type Server struct {</span> <span class="pl-s">// BindAddress is the address on which to serve traffic.</span> <span class="pl-s">BindAddress string `yaml:"bindAddress,omitempty"`</span> <span class="pl-s">// SecureBindAddress is the address on which to serve secure traffic.</span> <span class="pl-s">SecureBindAddress string `yaml:"secureBindAddress,omitempty"`</span> <span class="pl-s">// TLS contains the information for loading the certificate and key for the</span> <span class="pl-s">// secure traffic and further configuration for the TLS server.</span> <span class="pl-s">TLS *TLS `yaml:"tls,omitempty"`</span> <span class="pl-s">}</span> <span class="pl-s">// TLS contains the information for loading a TLS certificate and key</span> <span class="pl-s">// as well as an optional minimal TLS version that is acceptable.</span> <span class="pl-s">type TLS struct {</span> <span class="pl-s">// Key is the TLS key data to use.</span> <span class="pl-s">Key *SecretSource `yaml:"key,omitempty"`</span> <span class="pl-s">// Cert is the TLS certificate data to use.</span> <span class="pl-s">Cert *SecretSource `yaml:"cert,omitempty"`</span> <span class="pl-s">// MinVersion is the minimal TLS version that is acceptable.</span> <span class="pl-s">MinVersion string `yaml:"minVersion,omitempty"`</span> <span class="pl-s">// CipherSuites is a list of TLS cipher suites that are allowed.</span> <span class="pl-s">CipherSuites []string `yaml:"cipherSuites,omitempty"`</span> <span class="pl-s">}</span></pre></div> <p>More about how to use Alpha Config can be found in the <a href="https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#server" rel="nofollow">documentation</a>.</p> <p>Example Alpha configuration: <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml">https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml</a></p> <p>We are committed to Semantic Versioning and usually avoid breaking changes without a major version release.<br> Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try<br> to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare<br> the project for future maintainability and future improvements like structured logging.</p> <h2>Breaking Changes</h2> <ul> <li>Check release notes for <a href="https://github.com/oauth2-proxy/oauth2-proxy/releases/v7.14.0">v7.14.0</a></li> </ul> <h2>Changes since v7.14.1</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3314" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3314/hovercard">#3314</a> revert: fix: skip provider button auth only redirect (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3817560373" data-permission-text="Title is private" data-url="https://github.com/oauth2-proxy/oauth2-proxy/issues/3309" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3309/hovercard" href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3309">#3309</a>) (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/StefanMarkmann/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/StefanMarkmann">@StefanMarkmann</a> / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3315" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3315/hovercard">#3315</a> docs: clarify browser vs API routes for nginx auth_request redirects (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/StefanMarkmann/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/StefanMarkmann">@StefanMarkmann</a>)</li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.14.1 2026-01-17T16:30:46Z

v7.14.1

<h2>Release Highlights</h2> <ul> <li>🔵 Go1.25.6 and upgrade of dependencies to latest versions</li> <li>🐛 Bug fixes <ul> <li>AuthOnly now starts the auth flow and send status code 302 if no session exists and skip-provider-button is true</li> <li>Fixed static upstream validation issue due to incorrect defaults</li> </ul> </li> </ul> <h2>Important Notes</h2> <p>Excerpt from v7.14.0 release letter.</p> <p><a href="https://github.com/oauth2-proxy/oauth2-proxy/releases/v7.14.0">https://github.com/oauth2-proxy/oauth2-proxy/releases/v7.14.0</a></p> <p>This release introduces a breaking change for Alpha Config users and moves us significantly<br> closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more<br> future proof and extensible.</p> <p>From v7.14.0 onward, header injection sources must be explicitly nested. If you<br> previously relied on squashed fields, update to the new structure before upgrading:</p> <div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# before v7.14.0 injectRequestHeaders: - name: X-Forwarded-User values: - claim: user - name: X-Custom-Secret-header values: - value: my-super-secret # v7.14.0 and later injectRequestHeaders: - name: X-Forwarded-User values: - claimSource: claim: user - name: X-Custom-Secret-header values: - secretSource: value: my-super-secret"><pre><span class="pl-c"><span class="pl-c">#</span> before v7.14.0</span> <span class="pl-ent">injectRequestHeaders</span>: - <span class="pl-ent">name</span>: <span class="pl-s">X-Forwarded-User</span> <span class="pl-ent">values</span>: - <span class="pl-ent">claim</span>: <span class="pl-s">user</span> - <span class="pl-ent">name</span>: <span class="pl-s">X-Custom-Secret-header</span> <span class="pl-ent">values</span>: - <span class="pl-ent">value</span>: <span class="pl-s">my-super-secret</span> <span class="pl-c"><span class="pl-c">#</span> v7.14.0 and later</span> <span class="pl-ent">injectRequestHeaders</span>: - <span class="pl-ent">name</span>: <span class="pl-s">X-Forwarded-User</span> <span class="pl-ent">values</span>: - <span class="pl-ent">claimSource</span>: <span class="pl-ent">claim</span>: <span class="pl-s">user</span> - <span class="pl-ent">name</span>: <span class="pl-s">X-Custom-Secret-header</span> <span class="pl-ent">values</span>: - <span class="pl-ent">secretSource</span>: <span class="pl-ent">value</span>: <span class="pl-s">my-super-secret</span></pre></div> <p>Furthermore, Alpha Config now fully supports configuring the <code>Server</code> struct using YAML.</p> <div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="// Server represents the configuration for the Proxy HTTP(S) configuration. type Server struct { // BindAddress is the address on which to serve traffic. BindAddress string `yaml:"bindAddress,omitempty"` // SecureBindAddress is the address on which to serve secure traffic. SecureBindAddress string `yaml:"secureBindAddress,omitempty"` // TLS contains the information for loading the certificate and key for the // secure traffic and further configuration for the TLS server. TLS *TLS `yaml:"tls,omitempty"` } // TLS contains the information for loading a TLS certificate and key // as well as an optional minimal TLS version that is acceptable. type TLS struct { // Key is the TLS key data to use. Key *SecretSource `yaml:"key,omitempty"` // Cert is the TLS certificate data to use. Cert *SecretSource `yaml:"cert,omitempty"` // MinVersion is the minimal TLS version that is acceptable. MinVersion string `yaml:"minVersion,omitempty"` // CipherSuites is a list of TLS cipher suites that are allowed. CipherSuites []string `yaml:"cipherSuites,omitempty"` }"><pre><span class="pl-s">// Server represents the configuration for the Proxy HTTP(S) configuration.</span> <span class="pl-s">type Server struct {</span> <span class="pl-s">// BindAddress is the address on which to serve traffic.</span> <span class="pl-s">BindAddress string `yaml:"bindAddress,omitempty"`</span> <span class="pl-s">// SecureBindAddress is the address on which to serve secure traffic.</span> <span class="pl-s">SecureBindAddress string `yaml:"secureBindAddress,omitempty"`</span> <span class="pl-s">// TLS contains the information for loading the certificate and key for the</span> <span class="pl-s">// secure traffic and further configuration for the TLS server.</span> <span class="pl-s">TLS *TLS `yaml:"tls,omitempty"`</span> <span class="pl-s">}</span> <span class="pl-s">// TLS contains the information for loading a TLS certificate and key</span> <span class="pl-s">// as well as an optional minimal TLS version that is acceptable.</span> <span class="pl-s">type TLS struct {</span> <span class="pl-s">// Key is the TLS key data to use.</span> <span class="pl-s">Key *SecretSource `yaml:"key,omitempty"`</span> <span class="pl-s">// Cert is the TLS certificate data to use.</span> <span class="pl-s">Cert *SecretSource `yaml:"cert,omitempty"`</span> <span class="pl-s">// MinVersion is the minimal TLS version that is acceptable.</span> <span class="pl-s">MinVersion string `yaml:"minVersion,omitempty"`</span> <span class="pl-s">// CipherSuites is a list of TLS cipher suites that are allowed.</span> <span class="pl-s">CipherSuites []string `yaml:"cipherSuites,omitempty"`</span> <span class="pl-s">}</span></pre></div> <p>More about how to use Alpha Config can be found in the <a href="https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#server" rel="nofollow">documentation</a>.</p> <p>Example Alpha configuration: <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml">https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml</a></p> <p>We are committed to Semantic Versioning and usually avoid breaking changes without a major version release.<br> Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try<br> to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare<br> the project for future maintainability and future improvements like structured logging.</p> <h2>Breaking Changes</h2> <h2>Changes since v7.14.0</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3309" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3309/hovercard">#3309</a> fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/StefanMarkmann/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/StefanMarkmann">@StefanMarkmann</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3302" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3302/hovercard">#3302</a> fix: static upstreams failing validation due to <code>passHostHeader</code> and <code>proxyWebSockets</code> defaults being set incorrectly (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sourava01/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/sourava01">@sourava01</a> / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3312" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3312/hovercard">#3312</a> chore(deps): upgrade to go1.25.6 and latest dependencies (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> </ul> github-actions[bot] tag:github.com,2008:Repository/105262714/v7.14.0 2026-01-17T10:35:02Z

v7.14.0

<h2>Release Highlights</h2> <ul> <li>🕵️‍♀️ Vulnerabilities have been addressed <ul> <li><a href="https://access.redhat.com/security/cve/cve-2025-61729" rel="nofollow">CVE-2025-61729</a></li> <li><a href="https://access.redhat.com/security/cve/cve-2025-61727" rel="nofollow">CVE-2025-61727</a></li> <li><a href="https://access.redhat.com/security/cve/cve-2025-47914" rel="nofollow">CVE-2025-47914</a></li> <li><a href="https://access.redhat.com/security/cve/cve-2025-58181" rel="nofollow">CVE-2025-58181</a></li> </ul> </li> <li>🗂️ Major Alpha Config YAML parsing revamped for better extensibility and preparing v8</li> <li>🐛 Squashed some bugs</li> </ul> <h2>Important Notes</h2> <p>This release introduces a breaking change for Alpha Config users and moves us significantly<br> closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more<br> future proof and extensible.</p> <p>From v7.14.0 onward, header injection sources must be explicitly nested. If you<br> previously relied on squashed fields, update to the new structure before upgrading:</p> <div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# before v7.14.0 injectRequestHeaders: - name: X-Forwarded-User values: - claim: user - name: X-Custom-Secret-header values: - value: my-super-secret # v7.14.0 and later injectRequestHeaders: - name: X-Forwarded-User values: - claimSource: claim: user - name: X-Custom-Secret-header values: - secretSource: value: my-super-secret"><pre><span class="pl-c"><span class="pl-c">#</span> before v7.14.0</span> <span class="pl-ent">injectRequestHeaders</span>: - <span class="pl-ent">name</span>: <span class="pl-s">X-Forwarded-User</span> <span class="pl-ent">values</span>: - <span class="pl-ent">claim</span>: <span class="pl-s">user</span> - <span class="pl-ent">name</span>: <span class="pl-s">X-Custom-Secret-header</span> <span class="pl-ent">values</span>: - <span class="pl-ent">value</span>: <span class="pl-s">my-super-secret</span> <span class="pl-c"><span class="pl-c">#</span> v7.14.0 and later</span> <span class="pl-ent">injectRequestHeaders</span>: - <span class="pl-ent">name</span>: <span class="pl-s">X-Forwarded-User</span> <span class="pl-ent">values</span>: - <span class="pl-ent">claimSource</span>: <span class="pl-ent">claim</span>: <span class="pl-s">user</span> - <span class="pl-ent">name</span>: <span class="pl-s">X-Custom-Secret-header</span> <span class="pl-ent">values</span>: - <span class="pl-ent">secretSource</span>: <span class="pl-ent">value</span>: <span class="pl-s">my-super-secret</span></pre></div> <p>Furthermore, Alpha Config now fully supports configuring the <code>Server</code> struct using YAML.</p> <div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="// Server represents the configuration for the Proxy HTTP(S) configuration. type Server struct { // BindAddress is the address on which to serve traffic. BindAddress string `yaml:"bindAddress,omitempty"` // SecureBindAddress is the address on which to serve secure traffic. SecureBindAddress string `yaml:"secureBindAddress,omitempty"` // TLS contains the information for loading the certificate and key for the // secure traffic and further configuration for the TLS server. TLS *TLS `yaml:"tls,omitempty"` } // TLS contains the information for loading a TLS certificate and key // as well as an optional minimal TLS version that is acceptable. type TLS struct { // Key is the TLS key data to use. Key *SecretSource `yaml:"key,omitempty"` // Cert is the TLS certificate data to use. Cert *SecretSource `yaml:"cert,omitempty"` // MinVersion is the minimal TLS version that is acceptable. MinVersion string `yaml:"minVersion,omitempty"` // CipherSuites is a list of TLS cipher suites that are allowed. CipherSuites []string `yaml:"cipherSuites,omitempty"` }"><pre><span class="pl-s">// Server represents the configuration for the Proxy HTTP(S) configuration.</span> <span class="pl-s">type Server struct {</span> <span class="pl-s">// BindAddress is the address on which to serve traffic.</span> <span class="pl-s">BindAddress string `yaml:"bindAddress,omitempty"`</span> <span class="pl-s">// SecureBindAddress is the address on which to serve secure traffic.</span> <span class="pl-s">SecureBindAddress string `yaml:"secureBindAddress,omitempty"`</span> <span class="pl-s">// TLS contains the information for loading the certificate and key for the</span> <span class="pl-s">// secure traffic and further configuration for the TLS server.</span> <span class="pl-s">TLS *TLS `yaml:"tls,omitempty"`</span> <span class="pl-s">}</span> <span class="pl-s">// TLS contains the information for loading a TLS certificate and key</span> <span class="pl-s">// as well as an optional minimal TLS version that is acceptable.</span> <span class="pl-s">type TLS struct {</span> <span class="pl-s">// Key is the TLS key data to use.</span> <span class="pl-s">Key *SecretSource `yaml:"key,omitempty"`</span> <span class="pl-s">// Cert is the TLS certificate data to use.</span> <span class="pl-s">Cert *SecretSource `yaml:"cert,omitempty"`</span> <span class="pl-s">// MinVersion is the minimal TLS version that is acceptable.</span> <span class="pl-s">MinVersion string `yaml:"minVersion,omitempty"`</span> <span class="pl-s">// CipherSuites is a list of TLS cipher suites that are allowed.</span> <span class="pl-s">CipherSuites []string `yaml:"cipherSuites,omitempty"`</span> <span class="pl-s">}</span></pre></div> <p>More about how to use Alpha Config can be found in the <a href="https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#server" rel="nofollow">documentation</a>.</p> <p>Example Alpha configuration: <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml">https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml</a></p> <p>We are committed to Semantic Versioning and usually avoid breaking changes without a major version release.<br> Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try<br> to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare<br> the project for future maintainability and future improvements like structured logging.</p> <h2>Breaking Changes</h2> <ul> <li>Alpha Config: header injection no longer supports squashed claim/secret sources; they must now be set explicitly (see example above).</li> </ul> <h2>Changes since v7.13.0</h2> <ul> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/2628" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/2628/hovercard">#2628</a> feat(structured config): revamp of yaml parsing using mapstructure decoder and custom decoders (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3197" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3197/hovercard">#3197</a> fix: NewRemoteKeySet is not using DefaultHTTPClient (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/rsrdesarrollo/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/rsrdesarrollo">@rsrdesarrollo</a> / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3292" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3292/hovercard">#3292</a> chore(deps): upgrade gomod and bump to golang v1.25.5 (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3304" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3304/hovercard">#3304</a> fix: added conditional so default is not always set and env vars are honored fixes 3303 (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/pixeldrew/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/pixeldrew">@pixeldrew</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3264" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3264/hovercard">#3264</a> fix: more aggressively truncate logged access_token (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/MartinNowak/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/MartinNowak">@MartinNowak</a> / <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tuunit/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tuunit">@tuunit</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3267" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3267/hovercard">#3267</a> fix: Session refresh handling in OIDC provider (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/gysel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/gysel">@gysel</a>)</li> <li><a href="https://github.com/oauth2-proxy/oauth2-proxy/pull/3290" data-hovercard-type="pull_request" data-hovercard-url="/oauth2-proxy/oauth2-proxy/pull/3290/hovercard">#3290</a> fix: WebSocket proxy to respect PassHostHeader setting (<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/UnsignedLong/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/UnsignedLong">@UnsignedLong</a>)</li> </ul> github-actions[bot]