3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-02 00:10:45 +02:00
Code Issues Projects Releases Packages Wiki Activity

proxy: restrict programmatic URLs to localhost (#2049)

Browse source 
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
This commit is contained in:
Travis Groth 2021-04-01 10:04:49 -04:00 • committed by GitHub
parent 0635c838c9
commit c7d243d742
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
14 changed files with 822 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/reference/readme.md
View file

@ -889,6 +889,15 @@ Use this option if you previously relied on `x-pomerium-authenticated-user-{emai
Secure service communication can fail if the external certificate does not match the internally routed service hostname/[SNI](https://en.wikipedia.org/wiki/Server_Name_Indication). This setting allows you to override that value.
### Programmatic Redirect Domain Whitelist
- Config File Key: `programmatic_redirect_domain_whitelist`
- Type: array of `string`
- Optional
- Default: `localhost`
The programmatic redirect domain whitelist is used to restrict the allowed redirect URLs when using programmatic login. By default only `localhost` URLs are allowed.
### Refresh Cooldown
- Environmental Variable: `REFRESH_COOLDOWN`
- Config File Key: `refresh_cooldown`

9
docs/reference/settings.yaml
View file

@ -1003,6 +1003,15 @@ settings:
Secure service communication can fail if the external certificate does not match the internally routed service hostname/[SNI](https://en.wikipedia.org/wiki/Server_Name_Indication). This setting allows you to override that value.
shortdoc: |
Secure service communication can fail if the external certificate does not match the internally routed service hostname/SNI.
- name: "Programmatic Redirect Domain Whitelist"
keys: ["programmatic_redirect_domain_whitelist"]
attributes: |
- Config File Key: `programmatic_redirect_domain_whitelist`
- Type: array of `string`
- Optional
- Default: `localhost`
doc: |
The programmatic redirect domain whitelist is used to restrict the allowed redirect URLs when using programmatic login. By default only `localhost` URLs are allowed.
- name: "Refresh Cooldown"
keys: ["refresh_cooldown"]
attributes: |