v5.1.3

Tinyauth v5.1.3

A small patch release addressing GHSA-r27r-rr9v-vv37

Warning

This release contains a security fix, please update as soon as possible.

Fixes

• Remove query parameters and clean request path before access-controls

Technical

• Update dependencies

v5.1.3-rc.1

chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.…

nightly

chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.…

v5.1.2

Tinyauth v5.1.2

This path fix addresses some issues around the redirection logic (especially for Nginx/Swag users) and some security issues in access controls.

Warning

This release contains security fixes, please update as soon as possible.

Improvements

• Parent domain is now considered a trusted domain
• Allow for OAuth auto-redirect in OIDC flow

Fixes

• Make login_for parameter optional
• Fix redirection issues in HTTPS to HTTP downgrade redirect
• Fix ACLs normalization in Docker and Kubernetes ACL providers

Technical

• Update dependencies

Full Changelog: v5.1.1...v5.1.2

v5.1.2-beta.5

refactor: rework acl fetching for kubernetes and docker (#1028)

v5.1.2-beta.4

feat: experimental option to run tinyauth in oauth bridge mode (#1027)

v5.1.2-beta.3

fix: allow for oauth auto redirect in oidc authorization

v5.1.2-beta.2

refactor: rework scheme validation in oauth controller and frontend (…

v5.1.2-beta.1

fix: fix domain validator with port but no scheme and https or http

v5.1.1

Tinyauth v5.1.1

Small patch fix release, contains fixes for #1011 and #1009.

Fixes

• Abstain when OAuth whitelist is empty in ACLs @wwhsaber
• Don't fail app on label provider initialization failure
• Fix LDAP user lookup in basic-auth @tsushanth

New Contributors

• @wwhsaber made their first contribution in #1010
• @tsushanth made their first contribution in #1015

Full Changelog: v5.1.0...v5.1.1