Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nginxinc/nginx-openid-connect
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: R33
Choose a base ref
...
head repository: nginxinc/nginx-openid-connect
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: main
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 6 commits
  • 5 files changed
  • 2 contributors

Commits on Dec 4, 2024

  1. Configuration menu
    Copy the full SHA
    f7e8726 View commit details
    Browse the repository at this point in the history

Commits on Dec 12, 2024

  1. Fix OIDC client authentication for POST method after f7e8726

    Remove the `proxy_pass_request_body off` directive, which unintentionally broke
    OIDC client authentication using the POST body method (`client_secret_post`).
    
    Previously, when `$oidc_client_auth_method` was set to "client_secret_post"
    the `generateTokenRequestParams()` function correctly formatted the POST
    request and sent it via `r.subrequest` to the internal `/_token` location.
    However, the `proxy_pass_request_body off` directive caused the POST request
    to reach `$oidc_token_endpoint` with a valid Content-Length header but an
    empty body. This led to a timeout as the OP token endpoint closed the connection.
    
    Users encountered the error: "NGINX / OpenID Connect login failure."
    
    This commit restores functionality by ensuring the request body is passed
    to the token endpoint while retaining header exclusion to prevent CORS issues.
    route443 committed Dec 12, 2024
    Configuration menu
    Copy the full SHA
    1da0cc1 View commit details
    Browse the repository at this point in the history

Commits on Feb 22, 2025

  1. Refactor code to use async/await, modular functions, and improve toke…

    …n handling.
    
    - Switched from callbacks to async/await for clearer, more maintainable code.
    - Broke up the monolithic code into smaller and modular functions.
    - Refined id token validation logic.
    - Changed the internal /_id_token_validation location to /_token_validation.
    - Minimum required njs version is 0.7.0 now.
    route443 committed Feb 22, 2025
    Configuration menu
    Copy the full SHA
    66c4eaa View commit details
    Browse the repository at this point in the history
  2. Implement Front-Channel Logout endpoint

    Implement OpenID Connect Front-Channel Logout 1.0 specification:
    - Add default /front_channel_logout location that handles logout requests
    - Both sid and iss parameters must be present
    - Issuer verification against iss claim in ID token
    
    Reference: https://openid.net/specs/openid-connect-frontchannel-1_0.html
    route443 committed Feb 22, 2025
    Configuration menu
    Copy the full SHA
    1f5053b View commit details
    Browse the repository at this point in the history

Commits on Aug 14, 2025

  1. Add F5 CLA workflow.

    route443 committed Aug 14, 2025
    Configuration menu
    Copy the full SHA
    6066b8c View commit details
    Browse the repository at this point in the history

Commits on Aug 22, 2025

  1. Error logging improvement.

    - Implemented unified function for error handling.
    - Each error is assigned its own identifier, generated by using the first
    8 chars of the $request_id variable.
    - Added support for JSON log output. This is controlled by the
    $oidc_log_format variable, which must be set to 'json'.
    - Added support for stack trace output. This is enabled by the
    $oidc_debug variable, which must have any non-empty value.
    If this variable is defined, the $internal_error_message variable
    is overwritten with the text of the last error and returned to
    the User Agent - so use this only for debugging!
    route443 committed Aug 22, 2025
    Configuration menu
    Copy the full SHA
    24d53f9 View commit details
    Browse the repository at this point in the history
Loading