6b6ff29b9a
All checks were successful
publish-latest / docker (push) Successful in 22s
Tighten forward-auth return URL validation to reject unsafe host syntax, including backslash-based browser/parser mismatches, and normalize scheme/port matching so bare allowlist entries are HTTPS default-port only. Support explicit scheme-qualified targets, including IPv6 host:port entries. Always emit deterministic identity headers with empty values when attributes are absent, zero unsafe header values, and clear stale forward-auth return targets when OIDC or registration flows take precedence. Add regression coverage for wildcard redirect bypasses, scheme/port handling, IPv6 allowlist entries, empty identity headers, unsafe header values, and stale return-target cleanup. Update docs with proxy header-stripping guidance and the new allowlist semantics. |
||
|---|---|---|
| .. | ||
| e2e | ||
| test_admin | ||
| test_auth_routes | ||
| test_authn | ||
| test_invite | ||
| test_manage | ||
| test_oidc | ||
| test_store | ||
| __init__.py | ||
| conftest.py | ||
| test_admin_groups_validation.py | ||
| test_admin_invite_validation.py | ||
| test_app.py | ||
| test_authn_active.py | ||
| test_cli.py | ||
| test_client_registration.py | ||
| test_config.py | ||
| test_csrf.py | ||
| test_forward_auth.py | ||
| test_manage_profile.py | ||
| test_models.py | ||
| test_password_change.py | ||
| test_rate_limit.py | ||
| test_userid.py | ||
| test_validation.py | ||