3 ms·

With nginx I'm assuming you would use something like Vouch or oauth2-proxy? Something like the architecture described here: https://github.com/vouch/vouch-prox

by uriah 2y ago

With nginx I'm assuming you would use something like Vouch or oauth2-proxy? Something like the architecture described here: https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what-vouch-proxy-does https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what... Can't speak for caddy-security, but the forward_auth feature is the caddy equivalent to nginx's auth_request

justin_oaks 2y ago
Thanks. I've used oauth2-proxy with NGINX. So I could try to set up oauth2-proxy with Caddy in a similar way.
mdaniel 2y ago
Just watch out when using oauth2-proxy because its default session storage using cookies can easily blow out the header size of nginx leading to the dreaded 400 header too large One fix is moving session storage to redis <https://oauth2-proxy.github.io/oauth2-proxy/configuration/session_storage https://oauth2-proxy.github.io/oauth2-proxy/configuration/se...> and the other (if you have control over the nginx config) is bumping its allowed header size "large_client_header_buffers 4 128k;" <https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers https://nginx.org/en/docs/http/ngx_http_core_module.html#lar...> If you're using nginx as an ingress controller, the annotations support it: <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...> and/or auth-snippet <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...>
- justin_oaks 2y ago
  Thanks for the heads-up. I'm curious at what would be stored in the session to make it large enough to be a problem, but it's good to know to watch out for it.
  - mdaniel 2y ago
    I believe it's almost always the "groups" claim <https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie+size https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie...> but I would suspect any sufficiently large set of claims would do it (e.g. a huge "iss", erroneously returning the user profile jpeg attribute, who knows)

by uriah 2y ago

justin_oaks 2y ago

Thanks. I've used oauth2-proxy with NGINX. So I could try to set up oauth2-proxy with Caddy in a similar way.

mdaniel 2y ago

Just watch out when using oauth2-proxy because its default session storage using cookies can easily blow out the header size of nginx leading to the dreaded 400 header too large One fix is moving session storage to redis <https://oauth2-proxy.github.io/oauth2-proxy/configuration/session_storage https://oauth2-proxy.github.io/oauth2-proxy/configuration/se...> and the other (if you have control over the nginx config) is bumping its allowed header size "large_client_header_buffers 4 128k;" <https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers https://nginx.org/en/docs/http/ngx_http_core_module.html#lar...> If you're using nginx as an ingress controller, the annotations support it: <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...> and/or auth-snippet <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...>

justin_oaks 2y ago
Thanks for the heads-up. I'm curious at what would be stored in the session to make it large enough to be a problem, but it's good to know to watch out for it.
- mdaniel 2y ago
  I believe it's almost always the "groups" claim <https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie+size https://github.com/oauth2-proxy/oauth2-proxy/issues?q=cookie...> but I would suspect any sufficiently large set of claims would do it (e.g. a huge "iss", erroneously returning the user profile jpeg attribute, who knows)