libapache2-mod-auth-openidc (2.4.15.1-1) unstable; urgency=medium The 2.4.15.x releases change a number of default settings to their more secure and standards-compliant values. In rare cases this may break existing configurations which can be restored as described below. Nevertheless it is recommended to update the environment to accommodate to the new defaults. New Defaults: * use Proof Key for Code Exchange (PKCE S256) by default; disable by configuring OIDCPKCEMethod none * use SameSite cookies Strict by default; disable by configuring OIDCCookieSameSite Off * apply ISO-8859-1 (latin1) as default encoding mechanism for claim values passed in headers and environment variables to comply with rfc5987; use OIDCPassClaimsAs none for backwards compatibility -- Moritz Schlarb Thu, 01 Feb 2024 21:24:55 +0100 libapache2-mod-auth-openidc (2.4.14.2-1) unstable; urgency=medium Note that as of release 2.4.14 the use of OIDCHTMLErrorTemplate is deprecated and one should instead rely on standard Apache error handling capabilities, optionally customized through [ErrorDocument]. The environment variable strings REDIRECT_OIDC_ERROR and REDIRECT_OIDC_ERROR_DESC are available for display purposes. [ErrorDocument]: https://httpd.apache.org/docs/2.4/custom-error.html -- Moritz Schlarb Thu, 01 Feb 2024 21:09:11 +0100 libapache2-mod-auth-openidc (2.4.11-1) unstable; urgency=medium Note that as of release 2.4.11 running mod_auth_openidc behind a reverse proxy that sets X-Forwarded-* headers needs explicit configuration of OIDCXForwardedHeaders for mod_auth_openidc to interpret those headers, thus this may break existing configurations if unmodified for the former. -- Moritz Schlarb Thu, 01 Feb 2024 21:04:03 +0100