Affected by GO-2022-0783
and 4 other vulnerabilities
GO-2022-0783 : JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium
GO-2022-0933 : Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
GO-2023-1800 : Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium
GO-2024-2965 : Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium
GO-2024-3179 : Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
Discover Packages
github.com/pomerium/pomerium
internal
sessions
header
package
Version:
v0.9.0
Opens a new window with list of versions in this module.
Published: May 31, 2020
License: Apache-2.0
Opens a new window with license information.
Imports: 4
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
Documentation
¶
Package header provides a request header based implementation of a
session loader.
TokenFromHeader retrieves the value of the authorization header from a given
request, header key, and authentication type.
Store implements the load session store interface using http
authorization headers.
NewStore returns a new header store for loading sessions from
authorization header as defined in as defined in rfc2617
NOTA BENE: While most servers do not log Authorization headers by default,
you should ensure no other services are logging or leaking your auth headers.
LoadSession tries to retrieve the token string from the Authorization header.
Source Files
¶
Click to show internal directories.
Click to hide internal directories.