Affected by GO-2022-0783 and 4 other vulnerabilities

GO-2022-0783: JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium

GO-2022-0933: Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium

GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

pomerium

module

v0.6.2 Latest Latest Go to latest Published: Feb 3, 2020 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/pomerium/pomerium

Links

Open Source Insights

README ¶

Docker Pulls

Pomerium is an identity-aware proxy that enables secure access to internal applications. Pomerium provides a standardized interface to add access control to applications regardless of whether the application itself has authorization or authentication baked-in. Pomerium gateways both internal and external requests, and can be used in situations where you'd typically reach for a VPN.

Pomerium can be used to:

provide a single-sign-on gateway to internal applications.
enforce dynamic access policy based on context, identity, and device state.
aggregate access logs and telemetry data.
a VPN alternative.

Docs

For comprehensive docs, and tutorials see our documentation.

Directories ¶

Path	Synopsis
authenticate
authorize
cache
cmd
pomerium
config
integration
backends/httpdetails Module
backends/ws-echo Module
internal
cryptutil
encoding
encoding/ecjson Package ecjson represents encrypted and compressed content using JSON-based	Package ecjson represents encrypted and compressed content using JSON-based
encoding/jws Package jws represents content secured with digitalsignatures using JSON-based data structures as specified by rfc7515	Package jws represents content secured with digitalsignatures using JSON-based data structures as specified by rfc7515
encoding/mock
fileutil
frontend
frontend/statik
grpc
grpc/authorize
grpc/authorize/client
grpc/authorize/client/mock_authorize Package mock_authorize is a generated GoMock package.	Package mock_authorize is a generated GoMock package.
grpc/cache
grpc/cache/client
httputil
identity Package identity provides support for making OpenID Connect (OIDC) and OAuth2 authenticated HTTP requests with third party identity providers.	Package identity provides support for making OpenID Connect (OIDC) and OAuth2 authenticated HTTP requests with third party identity providers.
kv
kv/autocache
kv/bolt
kv/redis
log Package log provides a global logger for zerolog.	Package log provides a global logger for zerolog.
middleware Package middleware provides a standard set of middleware for pomerium.	Package middleware provides a standard set of middleware for pomerium.
middleware/responsewriter
sessions
sessions/cache
sessions/cookie
sessions/header
sessions/mock
sessions/queryparam
telemetry/metrics
telemetry/trace
tripper
urlutil
version
proxy

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL