5 ms·

I was checking into using Caddy for new projects instead of NGINX or Apache HTTPD, but my new projects require OAuth2/OIDC authentication. It seems there's not

I was checking into using Caddy for new projects instead of NGINX or Apache HTTPD, but my new projects require OAuth2/OIDC authentication. It seems there's not built-in support for that kind of thing. There's the caddy-security plugin, but people online have been saying it has disclosed security vulnerabilities that aren't being fixed. Are you using caddy-security? Or is there a better alternative?

uriah 2y ago
With nginx I'm assuming you would use something like Vouch or oauth2-proxy? Something like the architecture described here: https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what-vouch-proxy-does https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what... Can't speak for caddy-security, but the forward_auth feature is the caddy equivalent to nginx's auth_request
- justin_oaks 2y ago
  Thanks. I've used oauth2-proxy with NGINX. So I could try to set up oauth2-proxy with Caddy in a similar way.
- mdaniel 2y ago
  Just watch out when using oauth2-proxy because its default session storage using cookies can easily blow out the header size of nginx leading to the dreaded 400 header too large One fix is moving session storage to redis <https://oauth2-proxy.github.io/oauth2-proxy/configuration/session_storage https://oauth2-proxy.github.io/oauth2-proxy/configuration/se...> and the other (if you have control over the nginx config) is bumping its allowed header size "large_client_header_buffers 4 128k;" <https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers https://nginx.org/en/docs/http/ngx_http_core_module.html#lar...> If you're using nginx as an ingress controller, the annotations support it: <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...> and/or auth-snippet <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...>
  - justin_oaks 2y ago
    Thanks for the heads-up. I'm curious at what would be stored in the session to make it large enough to be a problem, but it's good to know to watch out for it.
    - mdaniel 2y ago
      I believe it's almost always the "groups" claim <https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie+size https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie...> but I would suspect any sufficiently large set of claims would do it (e.g. a huge "iss", erroneously returning the user profile jpeg attribute, who knows)

uriah 2y ago

With nginx I'm assuming you would use something like Vouch or oauth2-proxy? Something like the architecture described here: https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what-vouch-proxy-does https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what... Can't speak for caddy-security, but the forward_auth feature is the caddy equivalent to nginx's auth_request

justin_oaks 2y ago
Thanks. I've used oauth2-proxy with NGINX. So I could try to set up oauth2-proxy with Caddy in a similar way.
mdaniel 2y ago
Just watch out when using oauth2-proxy because its default session storage using cookies can easily blow out the header size of nginx leading to the dreaded 400 header too large One fix is moving session storage to redis <https://oauth2-proxy.github.io/oauth2-proxy/configuration/session_storage https://oauth2-proxy.github.io/oauth2-proxy/configuration/se...> and the other (if you have control over the nginx config) is bumping its allowed header size "large_client_header_buffers 4 128k;" <https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers https://nginx.org/en/docs/http/ngx_http_core_module.html#lar...> If you're using nginx as an ingress controller, the annotations support it: <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...> and/or auth-snippet <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...>
- justin_oaks 2y ago
  Thanks for the heads-up. I'm curious at what would be stored in the session to make it large enough to be a problem, but it's good to know to watch out for it.
  - mdaniel 2y ago
    I believe it's almost always the "groups" claim <https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie+size https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie...> but I would suspect any sufficiently large set of claims would do it (e.g. a huge "iss", erroneously returning the user profile jpeg attribute, who knows)