Skip to content

Commit fbcc837

Browse files
ahus1ahus1
committed
Deploying to main from @ 61b030d3d2bc5cc71d2cd3e27863b86517c0f7e5 🚀
1 parent 87e5e0a commit fbcc837

7 files changed

Lines changed: 989 additions & 16 deletions

File tree

‎extensions.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -564,7 +564,7 @@ <h5 class="card-title">Magic Link Login</h5>
564564
<div class="d-flex align-items-center">
565565
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
566566
class="me-2"/>
567-
<span data-nosnippet>405 stars</span>
567+
<span data-nosnippet>406 stars</span>
568568
</div>
569569
</div>
570570
</div>

‎nightly/guides.html‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1050,6 +1050,21 @@ <h5 class="card-title">
10501050
</div>
10511051
</div>
10521052
</div>
1053+
<div class="col-sm-4">
1054+
<div class="card shadow-sm mb-4">
1055+
<div class="card-body">
1056+
<h5 class="card-title">
1057+
AuthZEN Authorization
1058+
1059+
1060+
</h5>
1061+
<span class="card-text">Using Keycloak as an AuthZEN Policy Decision Point (PDP) to evaluate authorization requests.</span>
1062+
<div>
1063+
</div>
1064+
<a href="https://www.keycloak.org/nightly/securing-apps/authzen-authorization" class="stretched-link link-dark"></a>
1065+
</div>
1066+
</div>
1067+
</div>
10531068
<div class="col-sm-4">
10541069
<div class="card shadow-sm mb-4">
10551070
<div class="card-body">

‎nightly/securing-apps/authzen-authorization.html‎

Lines changed: 835 additions & 0 deletions
Large diffs are not rendered by default.

‎nightly/securing-apps/specifications.html‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ <h1>Specifications implemented</h1>
139139
</div>
140140
</div>
141141
<div class="sect1">
142-
<h2 id="_openid_connect"><a class="anchor" href="#_openid_connect"></a>OpenID Connect</h2>
142+
<h2 id="_openid"><a class="anchor" href="#_openid"></a>OpenID</h2>
143143
<div class="sectionbody">
144144
<table class="tableblock frame-all grid-all fit-content">
145145
<colgroup>
@@ -235,6 +235,12 @@ <h2 id="_openid_connect"><a class="anchor" href="#_openid_connect"></a>OpenID Co
235235
<td class="tableblock halign-left valign-top"></td>
236236
<td class="tableblock halign-left valign-top"><p class="tableblock">See <a href="https://www.keycloak.org/nightly/securing-apps/mcp-authz-server">Integrating with Model Context Protocol (MCP)</a>.</p></td>
237237
</tr>
238+
<tr>
239+
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://openid.net/specs/authorization-api-1_0.html">OpenID AuthZEN Authorization API 1.0</a></p></td>
240+
<td class="tableblock halign-left valign-top"><p class="tableblock">Experimental</p></td>
241+
<td class="tableblock halign-left valign-top"></td>
242+
<td class="tableblock halign-left valign-top"><p class="tableblock">See <a href="https://www.keycloak.org/nightly/securing-apps/authzen-authorization">AuthZEN Authorization</a>.</p></td>
243+
</tr>
238244
</tbody>
239245
</table>
240246
</div>

‎nightly/server/haproxy-reencrypt.html‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -140,12 +140,24 @@ <h2 id="haproxy-configuration-reencrypt"><a class="anchor" href="#haproxy-config
140140
frontend https_front
141141
bind *:8443 ssl crt /path/to/haproxy-external-certificate <i class="conum" data-value="1"></i><b>(1)</b>
142142
mode http <i class="conum" data-value="2"></i><b>(2)</b>
143+
144+
# Prevent external spoofing
143145
http-request del-header Forwarded <i class="conum" data-value="3"></i><b>(3)</b>
144-
http-request del-header x-forwarded-for
145-
http-request del-header x-forwarded-proto
146-
http-request del-header x-forwarded-host
147-
http-request del-header x-forwarded-port
148-
http-request del-header x-forwarded-server
146+
http-request del-header x-forwarded-.* -m reg
147+
http-request del-header x-original-.* -m reg
148+
http-request del-header x-real-ip
149+
150+
# Prevent external tracing context injection (W3C Trace Context / Baggage)
151+
http-request del-header traceparent
152+
http-request del-header tracestate
153+
http-request del-header baggage
154+
155+
# Prevent external tracing context injection (Zipkin, Jaeger, OpenTracing)
156+
http-request del-header b3
157+
http-request del-header x-b3-.* -m reg
158+
http-request del-header uber-trace-id
159+
http-request del-header x-ot-span-context
160+
149161
default_backend keycloak_back
150162

151163
backend keycloak_back
@@ -175,8 +187,9 @@ <h2 id="haproxy-configuration-reencrypt"><a class="anchor" href="#haproxy-config
175187
</tr>
176188
<tr>
177189
<td><i class="conum" data-value="3"></i><b>3</b></td>
178-
<td>The <code>http-request del-header &lt;HEADER&gt;</code> entries remove particular HTTP headers from the incoming requests before passing them on.
179-
The example shows removing of the <code>Forwarded</code> and <code>x-forwarded-</code> headers in order to prevent a security vulnerability to IP spoofing attacks, where the client is able to impersonate the proxy or other services.</td>
190+
<td>The <code>http-request del-header</code> directives remove HTTP headers from incoming requests before forwarding them to Keycloak.
191+
This prevents external clients from spoofing proxy identity headers (such as <code>Forwarded</code>, <code>X-Forwarded-*</code>, and <code>X-Real-IP</code>), injecting authentication-related headers (such as <code>X-Forwarded-Access-Token</code>), or injecting distributed tracing context (such as W3C Trace Context, Zipkin B3, or Jaeger headers).
192+
For the full list of recommended headers to filter, see the <a href="https://www.keycloak.org/nightly/server/reverseproxy#header-filtering-recommendations">Configuring a reverse proxy</a> guide.</td>
180193
</tr>
181194
<tr>
182195
<td><i class="conum" data-value="4"></i><b>4</b></td>

‎nightly/server/reverseproxy.html‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -452,6 +452,114 @@ <h3 id="_trusted_proxies"><a class="anchor" href="#_trusted_proxies"></a>Trusted
452452
</div>
453453
</div>
454454
<div class="sect2">
455+
<h3 id="header-filtering-recommendations"><a class="anchor" href="#header-filtering-recommendations"></a>Header filtering recommendations</h3>
456+
<div class="paragraph">
457+
<p>When using TLS re-encrypt, the proxy can inspect and modify HTTP traffic.
458+
Use this capability to prevent external clients from injecting headers that affect identity resolution, access control, or observability.</p>
459+
</div>
460+
<div class="admonitionblock note">
461+
<table>
462+
<tr>
463+
<td class="icon">
464+
<i class="fa icon-note" title="Note"></i>
465+
</td>
466+
<td class="content">
467+
The following assumes that there is only a single proxy layer in front of Keycloak, and that it is not receiving traffic from another trusted proxy layer with trusted headers.
468+
</td>
469+
</tr>
470+
</table>
471+
</div>
472+
<div class="paragraph">
473+
<p>Configure the proxy to apply the following rules to incoming requests before forwarding them to Keycloak:</p>
474+
</div>
475+
<div class="ulist">
476+
<ul>
477+
<li>
478+
<p><strong>Overwrite</strong> <code>Forwarded</code> and <code>X-Forwarded-*</code> headers with the proxy&#8217;s own values rather than removing them, because Keycloak relies on these headers when <code>--proxy-headers</code> is configured.</p>
479+
</li>
480+
<li>
481+
<p><strong>Strip</strong> all other headers listed below entirely.</p>
482+
</li>
483+
</ul>
484+
</div>
485+
<table class="tableblock frame-all grid-all fit-content">
486+
<colgroup>
487+
<col>
488+
<col>
489+
<col>
490+
</colgroup>
491+
<thead>
492+
<tr>
493+
<th class="tableblock halign-left valign-top">Header(s)</th>
494+
<th class="tableblock halign-left valign-top">Category</th>
495+
<th class="tableblock halign-left valign-top">Risk if not filtered</th>
496+
</tr>
497+
</thead>
498+
<tbody>
499+
<tr>
500+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>Forwarded</code>, <code>X-Forwarded-For</code>, <code>X-Forwarded-Proto</code>, <code>X-Forwarded-Host</code>, <code>X-Forwarded-Port</code>, <code>X-Forwarded-Prefix</code></p></td>
501+
<td class="tableblock halign-left valign-top"><p class="tableblock">Proxy identity</p></td>
502+
<td class="tableblock halign-left valign-top"><p class="tableblock">Clients can spoof their IP address, protocol, or host, affecting access control and audit logging.
503+
<strong>Overwrite</strong> these headers rather than stripping them.</p></td>
504+
</tr>
505+
<tr>
506+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>X-Original-Forwarded-For</code></p></td>
507+
<td class="tableblock halign-left valign-top"><p class="tableblock">Proxy identity</p></td>
508+
<td class="tableblock halign-left valign-top"><p class="tableblock">Variant of <code>X-Forwarded-For</code> recognized by some proxies.
509+
Can be spoofed to bypass IP-based access controls.</p></td>
510+
</tr>
511+
<tr>
512+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>X-Real-IP</code></p></td>
513+
<td class="tableblock halign-left valign-top"><p class="tableblock">Proxy identity</p></td>
514+
<td class="tableblock halign-left valign-top"><p class="tableblock">Trusted by some applications for rate limiting and audit logging.
515+
Can be spoofed to bypass IP-based restrictions.</p></td>
516+
</tr>
517+
<tr>
518+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>X-Original-URL</code>, <code>X-Original-Method</code></p></td>
519+
<td class="tableblock halign-left valign-top"><p class="tableblock">Proxy identity</p></td>
520+
<td class="tableblock halign-left valign-top"><p class="tableblock">Used by authentication sub-request mechanisms in some proxies.
521+
Can be spoofed to manipulate path-based authorization decisions.</p></td>
522+
</tr>
523+
<tr>
524+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>X-Forwarded-Access-Token</code></p></td>
525+
<td class="tableblock halign-left valign-top"><p class="tableblock">Proxy identity</p></td>
526+
<td class="tableblock halign-left valign-top"><p class="tableblock">Injected by some OAuth2 proxies.
527+
Can be spoofed to inject forged access tokens.</p></td>
528+
</tr>
529+
<tr>
530+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>traceparent</code>, <code>tracestate</code></p></td>
531+
<td class="tableblock halign-left valign-top"><p class="tableblock">Distributed tracing</p></td>
532+
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://www.w3.org/TR/trace-context/">W3C Trace Context</a> headers.
533+
External injection allows attackers to correlate requests in the tracing backend and map internal service dependencies.</p></td>
534+
</tr>
535+
<tr>
536+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>baggage</code></p></td>
537+
<td class="tableblock halign-left valign-top"><p class="tableblock">Distributed tracing</p></td>
538+
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://www.w3.org/TR/baggage/">W3C Baggage</a> header.
539+
Can inject arbitrary key-value pairs into the trace context propagated to downstream services.</p></td>
540+
</tr>
541+
<tr>
542+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>b3</code>, <code>x-b3-traceid</code>, <code>x-b3-spanid</code>, <code>x-b3-parentspanid</code>, <code>x-b3-sampled</code>, <code>x-b3-flags</code></p></td>
543+
<td class="tableblock halign-left valign-top"><p class="tableblock">Distributed tracing</p></td>
544+
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://github.com/openzipkin/b3-propagation">Zipkin B3</a> propagation headers.
545+
External injection inflates observability costs and enables cross-service correlation.</p></td>
546+
</tr>
547+
<tr>
548+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>uber-trace-id</code></p></td>
549+
<td class="tableblock halign-left valign-top"><p class="tableblock">Distributed tracing</p></td>
550+
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://www.jaegertracing.io/sdk-migration/#propagation-format">Jaeger</a> propagation header (deprecated in favor of W3C Trace Context).
551+
Same risks as other tracing headers.</p></td>
552+
</tr>
553+
<tr>
554+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>x-ot-span-context</code></p></td>
555+
<td class="tableblock halign-left valign-top"><p class="tableblock">Distributed tracing</p></td>
556+
<td class="tableblock halign-left valign-top"><p class="tableblock">OpenTracing propagation header (deprecated in favor of W3C Trace Context).
557+
Same risks as other tracing headers.</p></td>
558+
</tr>
559+
</tbody>
560+
</table>
561+
</div>
562+
<div class="sect2">
455563
<h3 id="_exposed_path_recommendations"><a class="anchor" href="#_exposed_path_recommendations"></a>Exposed path recommendations</h3>
456564
<div class="paragraph">
457565
<p>When using a reverse proxy, Keycloak only requires certain paths to be exposed.

‎translations.html‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -271,14 +271,10 @@ <h1>Translations</h1>
271271
&check;
272272
</td>
273273
<td style="text-align: right">
274-
<a rel="nofollow" href="https://hosted.weblate.org/translate/keycloak/theme-baseaccount/cs/?q=state:%3Ctranslated">
275-
96 %
276-
</a>
274+
&check;
277275
</td>
278276
<td style="text-align: right">
279-
<a rel="nofollow" href="https://hosted.weblate.org/translate/keycloak/admin-ui/cs/?q=state:%3Ctranslated">
280-
93 %
281-
</a>
277+
&check;
282278
</td>
283279
<td style="text-align: right">
284280
&check;
@@ -896,7 +892,7 @@ <h1>Translations</h1>
896892
</tbody>
897893
</table>
898894

899-
<p data-nosnippet>(Statistics updated daily. Last update: 2026-05-19T17:39:34Z)</p>
895+
<p data-nosnippet>(Statistics updated daily. Last update: 2026-05-20T06:25:49Z)</p>
900896

901897
</div>
902898

0 commit comments

Comments
 (0)