webauthn

May 26, 2023 GO-2024-2965 +1 more

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Nov 11, 2022 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

May 26, 2023 GO-2024-2965 +1 more

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Sep 7, 2022 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Aug 31, 2022 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Changes in this version

type State

+ BrandingOptions httputil.BrandingOptions

May 26, 2023 GO-2024-2965 +1 more

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Jul 26, 2022 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

May 26, 2023 GO-2024-2965 +1 more

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

May 5, 2022 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Apr 22, 2022 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Mar 30, 2022 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Changes in this version

type State

+ InternalAuthenticateURL *url.URL

Mar 4, 2022 GO-2022-0413 +3 more

  GO-2022-0413: Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Changes in this version

type Handler

+ func (h *Handler) GetOptions(ctx context.Context) (creationOptions *webauthn.PublicKeyCredentialCreationOptions, ...)

type State

+ AuthenticateURL *url.URL

+ PomeriumDomains []string

Feb 25, 2022 GO-2022-0413 +3 more

  GO-2022-0413: Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Feb 11, 2022 GO-2022-0413 +3 more

  GO-2022-0413: Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Jan 25, 2022 GO-2022-0413 +3 more

  GO-2022-0413: Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Jan 19, 2022 GO-2022-0413 +3 more

  GO-2022-0413: Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Dec 22, 2021 GO-2022-0413 +3 more

  GO-2022-0413: Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Nov 4, 2021 GO-2023-1800 +2 more

  GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

  GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

  GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Changes in this version

+ type Handler struct

+ func New(getState StateProvider) *Handler

+ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ type State struct

+ Client databroker.DataBrokerServiceClient

+ RelyingParty *webauthn.RelyingParty

+ Session *session.Session

+ SessionState *sessions.State

+ SessionStore sessions.SessionStore

+ SharedKey []byte

+ type StateProvider = func(context.Context) (*State, error)