Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 4 commits
- 8 files changed
- 4 contributors
Commits on Aug 19, 2025
-
Signed-off-by: Ryan Northey <[email protected]>
Commits on Sep 2, 2025
-
oauth2: add Secure attribute for prefixed cookies on signout
When using cookie names prefixed with `__Secure-` or `__Host-`, browsers require the `Secure` attribute to be present on the `Set-Cookie` header for any modification, including deletion. The OAuth2 filter did not add this attribute when generating the `Set-Cookie` headers to clear the OAuth cookies. This caused the browser to ignore the deletion request for prefixed cookies, effectively preventing the user from being signed out correctly. This patch fixes the behavior to set the `Secure` attribute when either prefix is found. Signed-off-by: Tony Allen <[email protected]> Signed-off-by: Ryan Northey <[email protected]> Signed-off-by: Boteng Yao <[email protected]>
-
release: Add changelog summary
Signed-off-by: Ryan Northey <[email protected]>
-
**Summary of changes**: * Security fixes: - Fix for OAuth cookie issue [CVE-2025-55162](GHSA-95j4-hw7f-v2rh). **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.32.11 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.32.11/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.32.11/version_history/v1.32/v1.32.11 **Full changelog**: v1.32.10...v1.32.11
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v1.32.10...v1.32.11