New
v7.14.0
Release Highlights
- 🕵️♀️ Vulnerabilities have been addressed
Unclaimed project
Are you a maintainer of oauth2-proxy? Claim this project to take control of your public changelog and roadmap.
Changelog
A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.
Last updated 6 days ago
Get up and running with Kimi-K2.5, GLM-4.7, DeepSeek, gpt-oss, Qwen, Gemma and other models.
Production-Grade Container Scheduling and Management
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
The world’s fastest framework for building websites.
This release introduces a breaking change for Alpha Config users and moves us significantly closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more future proof and extensible.
From v7.14.0 onward, header injection sources must be explicitly nested. If you previously relied on squashed fields, update to the new structure before upgrading:
# before v7.14.0
injectRequestHeaders:
- name: X-Forwarded-User
values:
- claim: user
- name: X-Custom-Secret-header
values:
- value: my-super-secret
# v7.14.0 and later
injectRequestHeaders:
- name: X-Forwarded-User
values:
- claimSource:
claim: user
- name: X-Custom-Secret-header
values:
- secretSource:
value: my-super-secret
Furthermore, Alpha Config now fully supports configuring the Server struct using YAML.
// Server represents the configuration for the Proxy HTTP(S) configuration.
type Server struct {
// BindAddress is the address on which to serve traffic.
BindAddress string `yaml:"bindAddress,omitempty"`
// SecureBindAddress is the address on which to serve secure traffic.
SecureBindAddress string `yaml:"secureBindAddress,omitempty"`
// TLS contains the information for loading the certificate and key for the
// secure traffic and further configuration for the TLS server.
TLS *TLS `yaml:"tls,omitempty"`
}
// TLS contains the information for loading a TLS certificate and key
// as well as an optional minimal TLS version that is acceptable.
type TLS struct {
// Key is the TLS key data to use.
Key *SecretSource `yaml:"key,omitempty"`
// Cert is the TLS certificate data to use.
Cert *SecretSource `yaml:"cert,omitempty"`
// MinVersion is the minimal TLS version that is acceptable.
MinVersion string `yaml:"minVersion,omitempty"`
// CipherSuites is a list of TLS cipher suites that are allowed.
CipherSuites []string `yaml:"cipherSuites,omitempty"`
}
More about how to use Alpha Config can be found in the documentation.
Example Alpha configuration: https://github.com/oauth2-proxy/oauth2-proxy/blob/955ab6b/contrib/local-environment/oauth2-proxy-alpha-config.yaml
We are committed to Semantic Versioning and usually avoid breaking changes without a major version release. Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare the project for future maintainability and future improvements like structured logging.