Session state's email stored in clear in the cookie about oauth2-proxy HOT 4 CLOSED

In the session_state in the EncryptedString and DecodeSessionState functions, we can include the accountInfo() as encrypted instead of heaving them in clear.

If you agree I can do a PR with this fix.

@tlawrie, @JoelSpeed

from oauth2-proxy.

With the -cookie-httponly and -cookie-secure options, both of which are enabled by default, the browser will only send the cookie over https to the server running oauth2_proxy. For what it's worth.

from oauth2-proxy.

With the -cookie-httponly and -cookie-secure options, both of which are enabled by default, the browser will only send the cookie over https to the server running oauth2_proxy. For what it's worth.

@costelmoraru What is the problem with this approach? In this case the cookies are only available by the browser to be sent over HTTPS (so no man in the middle reading the cookie) and can't be read by client-side scripts (so no malicious scripts finding anything out), the only real way to see the content would be on the user's machine using something like developer tools? But I would expect the user would know their email anyway?

I appreciate enterprises can be quite strict with their security requirements but I am struggling to see the security flaw here

Your proposed solution does however seem sensible

from oauth2-proxy.

Issue closed by the PR #120 .

from oauth2-proxy.