Stavros
1f1abbf64d
fix: fail acl lookup when input domain doesn't match cookie domain
2026-08-23 17:37:46 +03:00
Stavros
9da7d3c7be
fix: check for header spoofing regardless of fallbacks state
2026-08-23 12:18:18 +03:00
Stavros
61d372b288
fix: don't use domain validator in acl matching logic
2026-08-22 21:17:08 +03:00
Stavros
cf5d5cab6e
feat: add option to disable auth module fallbacks
2026-08-21 13:26:02 +03:00
Stavros
75c7aad40e
fix: don't depend on auth modules failing for spoofing decision
2026-08-21 13:10:15 +03:00
Stavros
3052cc0da3
fix: only allow one auth module to succeed per request
2026-08-18 20:55:05 +03:00
Stavros and GitHub
0c47e68c09
feat: do not show oidc consent screen every time ( #989 )
2026-08-17 02:44:48 +03:00
Stavros and GitHub
46c8c58f45
fix: preserve query parameters for login ( #1068 )
2026-08-13 17:30:53 +03:00
tsushanth and GitHub
f9939538b9
Remote-Name header returns capitalized uid instead of LDAP cn — cn attribute never fetched ( #1072 )
2026-08-13 15:37:03 +03:00
6d5563db2c
fix: clean request path before acls ( #1055 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-30 19:35:31 +03:00
Stavros and GitHub
0e7bdf6cd5
feat: experimental option to run tinyauth in oauth bridge mode ( #1027 )
2026-07-20 00:03:26 +03:00
Stavros and GitHub
f43d690320
refactor: rework scheme validation in oauth controller and frontend ( #1026 )
2026-07-19 00:41:28 +03:00
Stavros
50c25e4478
fix: fix domain validator with port but no scheme and https or http
2026-07-18 18:17:24 +03:00
Stavros
d6087dc45e
fix: allow for mismatching protocol in trusted domain check - ui warnings
2026-07-18 18:06:26 +03:00
Stavros
286aad2e08
test: remove obsolete test case
2026-07-18 16:37:52 +03:00
Stavros
0fc87ad58f
fix: support for parent trusted domain, fixes #1021
2026-07-18 16:30:12 +03:00
Stavros and GitHub
dade1e2c8f
refactor: rework rate limit logic ( #1008 )
2026-07-15 15:30:57 +03:00
Stavros and GitHub
6e095fd4f2
refactor: rework the way trusted proxies ip work ( #1007 )
2026-07-15 15:17:55 +03:00
Stavros and GitHub
c22925c2fb
fix: use constant time in user checks ( #1004 )
2026-07-14 16:49:59 +03:00
Stavros and GitHub
d946926c36
feat: allow existing query params in oidc redirect uri ( #1003 )
2026-07-14 16:36:57 +03:00
Stavros and GitHub
e75605b2c5
refactor: move domain check into small helper util ( #1000 )
2026-07-14 14:20:15 +03:00
Stavros and GitHub
73cc4808bc
feat: improve binary size with build tags ( #976 )
2026-07-06 23:49:55 +03:00
Stavros and GitHub
69f4206f65
refactor: remove concurrent listeners and rework cookie logic ( #950 )
2026-06-23 13:35:29 +03:00
Stavros and GitHub
efe373084f
feat: support for oidc max age ( #949 )
2026-06-20 00:21:22 +03:00
Stavros and GitHub
7f18b45e21
feat: support for the prompt parameter in the oidc flow ( #948 )
2026-06-20 00:04:41 +03:00
Stavros and GitHub
6ccc894570
tests: improve test coverage for controllers ( #946 )
2026-06-19 11:59:16 +03:00
Stavros and GitHub
53af1b99c0
tests: don't use _test suffix in service and controller tests ( #944 )
2026-06-17 17:03:30 +03:00
Stavros
f7d7f1c4f0
feat: add psl checks to the oauth controller is safe redirect check
2026-06-17 13:05:42 +03:00
Stavros
e7d26f497d
fix: use runtime trusted uris in oauth controller
2026-06-17 12:33:09 +03:00
Stavros and GitHub
c825d81b2d
feat: add support for webfinger ( #941 )
2026-06-16 15:05:11 +03:00
Stavros and GitHub
f404c2ef16
feat: use dig for di in services and controllers ( #936 )
2026-06-16 13:00:48 +03:00
a0e74cd5f2
refactor: move oidc handling to backend and add support for oidc post ( #923 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-06-13 16:45:12 +03:00
Stavros and GitHub
426eac2d0b
refactor: rework oidc session storage ( #913 )
2026-06-06 16:26:08 +03:00
Stavros and GitHub
dac844595d
refactor: use new cache store in services ( #912 )
2026-05-31 18:55:06 +03:00
Stavros and GitHub
faee58ca8e
feat: use ding for ordered go routine shutdown order ( #896 )
2026-05-27 12:46:28 +03:00
Stavros and GitHub
4538922caf
refactor: simplify error handling in oidc authorize handler ( #907 )
2026-05-27 11:27:10 +03:00
Stavros and GitHub
0a3e7bf265
fix: use policy engine in oauth whitelist check ( #904 )
2026-05-26 00:07:46 +03:00
c3461131f5
feat: support provider-specific OAuth whitelists ( #882 )
...
Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com >
2026-05-24 20:18:33 +03:00
Stavros
ae17bd3b66
fix: do not log user context not found errors in proxy controller
2026-05-23 16:43:03 +03:00
Stavros and GitHub
1166a15aa7
feat: tailscale integration ( #847 )
2026-05-20 20:10:38 +03:00
Stavros and GitHub
c855f9b8ac
feat: add support for deny by default access controls ( #852 )
2026-05-19 18:07:55 +03:00
Scott McKendry and GitHub
a56c349525
refactor(db): use new store interface ( #831 )
2026-05-18 22:33:09 +03:00
e8071a9d80
fix: bug fixes for issues #859 , 860, 861, 862, 863, 864, 865, 866 ( #867 )
...
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2026-05-16 17:04:01 +03:00
Stavros
ca06099466
tests: fix tests for proxy controller
2026-05-15 18:43:18 +03:00
Stavros
d4b4245017
chore: revert 4c741a5 and use 403 for acl errors
2026-05-15 18:39:12 +03:00
Stavros
4c741a5990
fix: use 401 errors instead of 403 for nginx responses
2026-05-15 18:12:15 +03:00
a9eac7edd2
fix(ldap): pass through LDAP mail attribute instead of crafting email ( #834 )
...
* fix(ldap): pass through LDAP mail attribute instead of crafting email
TinyAuth was constructing LDAP user emails as username@CookieDomain
instead of using the mail attribute stored in the directory. This caused
OIDC clients like Grafana to receive a synthetic email rather than the
real one.
Rename GetUserDN to GetUserInfo and extend it to also fetch the mail
attribute in the same LDAP query. Thread the result through UserSearch
and use it in both the login flow and the basic auth middleware, falling
back to the crafted email only when LDAP returns no mail value.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
* chore: add ldap email logic back after main merge
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-05-11 15:40:15 +03:00
Stavros and GitHub
4f7335ed73
refactor: rework app logging, dependency injection and cancellation ( #844 )
...
* feat: add new logger
* refactor: use one struct for context handling and cancellation
* refactor: rework logging and config in controllers
* refactor: rework logging and config in middlewares
* refactor: rework logging and cancellation in services
* refactor: rework cli logging
* fix: improve logging in routines
* feat: use sync groups for better cancellation
* refactor: simplify middleware, controller and service init
* tests: fix controller tests
* tests: use require instead of assert where previous step is required
* tests: fix middleware tests
* tests: fix service tests
* tests: fix context tests
* fix: fix typos
* feat: add option to enable or disable concurrent listeners
* fix: assign public key correctly in oidc server
* tests: fix don't try to test logger with char size
* fix: coderabbit comments
* tests: use filepath join instead of path join
* fix: ensure unix socket shutdown doesn't run twice
* chore: remove temp lint file
2026-05-10 16:10:36 +03:00
ca6a7fa551
feat: add option to run tinyauth on a top-level domain ( #710 )
...
* Add TINYAUTH_AUTH_SUBDOMAINSENABLED option
Setting it to false allows to use Tinyauth on top-level domain only,
but forbids automatic cross-app authentication using Traefik/Nginx.
* fix: inform services and controllers if subdomain cookie domain is enabled
* chore: rabbit feedback
* fix: deny ip addresses for standalone domain
---------
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-05-07 16:12:24 +03:00
Stavros and GitHub
1382ab41e7
refactor: rework user context handling throughout tinyauth ( #829 )
...
* wip
* fix: fix util imports
* fix: fix bootstrap import issues
* fix: fix cli imports
* fix: context controller
* fix: use new context in user controller
* fix: fix imports and context in proxy controller
* fix: fix oauth and oidc controller imports and context
* feat: finalize context functionality
* refactor: simplify acls checking logic by passing the entire acl struct
* chore: rename get basic auth to encode basic auth for clarity
* fix: fix controller tests
* tests: fix service tests
* tests: fix utils tests
* tests: move to testify for testing in utils
* fix: fix config reference generator
* tests: add tests for context parsing
* tests: add tests for context middleware
* tests: remove error wrapper from context tests
* tests: fix log wrapper tests
* fix: fix verion setting in cd and dockerfiles
* fix: review comments batch 1
* fix: review comments batch 2
* fix: review comments batch 3
* fix: delete totp pending session cookie on totp success
* tests: fix user controller tests
* fix: don't audit login too early
* fix: own comments
2026-05-07 15:41:07 +03:00
Stavros
tsushanthandGitHub
Scott McKendryandGitHub
