public/geek-cookbook
1
0 Fork 0
mirror of https://github.com/funkypenguin/geek-cookbook/ synced 2026-10-25 18:23:21 +00:00
Code Issues Releases Wiki Activity

Merge pull request #296 from dargmuesli/patch-1

Browse Source
This commit is contained in:
David Young authored and GitHub committed 2023-05-10 13:00:25 +12:00
2 parents f483c92c6d 43bd8b7510
commit d561eb6e1e
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
docs/docker-swarm/traefik-forward-auth/index.md
+1 -1
View File
@@ -29,7 +29,7 @@ The advantage under this design is additional security. If I'm deploying a web a
## AuthHost mode ## AuthHost mode
Under normal Oauth2 / OIDC auth, you have to tell your auth provider which URLs it may redirect an authenticated user back to, post-authentication. This is a security feture of the OIDC spec, preventing a malicious landing page from capturing your session and using it to impersonate you. When you're securing many URLs though, explicitly listing them can be a PITA. Under normal Oauth2 / OIDC auth, you have to tell your auth provider which URLs it may redirect an authenticated user back to, post-authentication. This is a security feature of the OIDC spec, preventing a malicious landing page from capturing your session and using it to impersonate you. When you're securing many URLs though, explicitly listing them can be a PITA.
[@thomaseddon's traefik-forward-auth](https://github.com/thomseddon/traefik-forward-auth) includes an ingenious mechanism to simulate an "_auth host_" in your OIDC authentication, so that you can protect an unlimited amount of DNS names (_with a common domain suffix_), without having to manually maintain a list. [@thomaseddon's traefik-forward-auth](https://github.com/thomseddon/traefik-forward-auth) includes an ingenious mechanism to simulate an "_auth host_" in your OIDC authentication, so that you can protect an unlimited amount of DNS names (_with a common domain suffix_), without having to manually maintain a list.