mirror of
https://github.com/TecharoHQ/anubis.git
synced 2025-12-30 16:29:37 -06:00
7ed1753fcc
* test(nginx-external-auth): bring up to code standards Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(lib): close open redirect when in subrequest mode Closes GHSA-cf57-c578-7jvv Previously Anubis had an open redirect in subrequest auth mode due to an insufficent fix in GHSA-jhjj-2g64-px7c. This patch adds additional validation at several steps of the flow to prevent open redirects in subrequest auth mode as well as implements automated testing to prevent this from occuring in the future. * docs: update CHANGELOG Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net>
49 lines
1.1 KiB
YAML
49 lines
1.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: nginx-external-auth
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: nginx-external-auth
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: nginx-external-auth
|
|
spec:
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: nginx-cfg
|
|
containers:
|
|
- name: www
|
|
image: nginx:alpine
|
|
resources:
|
|
limits:
|
|
memory: "128Mi"
|
|
cpu: "500m"
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "500m"
|
|
ports:
|
|
- containerPort: 80
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/nginx/conf.d
|
|
readOnly: true
|
|
- name: anubis
|
|
image: ttl.sh/techaro/anubis:latest
|
|
imagePullPolicy: Always
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 128Mi
|
|
env:
|
|
- name: TARGET
|
|
value: " "
|
|
- name: REDIRECT_DOMAINS
|
|
value: nginx.local.cetacean.club
|