Skip to main content

v26.3.6

v26.3.6​

Oathkeeper hardens request path handling against path-confusion attacks​

Ory Oathkeeper now normalizes and validates the request URL path before matching access rules, closing a class of path-confusion attacks that could bypass authorization. A new security configuration section tunes this behavior, and the defaults are secure.

Read Request path normalization and validation if you run Oathkeeper as a Decision API, place it behind another proxy, or rely on unusual path encodings.

Breaking changes​

The Access Control Decision API no longer trusts incoming X-Forwarded-* headers by default. ForwardAuth-style integrations (Traefik, NGINX, Ambassador, Envoy) must set security.decision.x_forwarded_headers: trust to keep working. See the documentation for details.