What's Changed
- Update docu by @p53 in #748
- Update and cleanup indirect deps by @p53 in #750
- Add options to customize log sampling by @p53 in #751
- Update opa dep by @p53 in #752
- Refactor e2e by @p53 in #753
- Add max headers option by @p53 in #754
- Update best practices by @p53 in #755
- Update docu by @p53 in #756
- Add best practices by @p53 in #757
- Fix and enhance path normalization by @p53 in #759
- Add allow encodes slashes by @p53 in #760
- Add deny option for resource by @p53 in #761
- Set enable-default-deny-strict=true as default by @p53 in #762
- Update dependencies by @p53 in #763
- Update deps 5.0.0 by @p53 in #764
- Update docs by @p53 in #766
NOTE: I would like to highlight added deny attribute to resource - this can significantly reduce attack surface and make faster responses to endpoints which should be forbidden
IMPORTANT: This version contains breaking changes, here is list of them and some suggestions related to new behaviour:
--enable-default-deny-strict- is default true now and--enable-default-denyis false, this means that/*will be added as resource and it will be denied- added
--allow-escaped-slashes-path- option which is by default true, previous versions allowed escaped slashes, from 5.0.0 onward they are disallowed by default - added path normalization options - see docs https://gogatekeeper.github.io/gatekeeper/#path-normalization, previous versions were partially normalizing path used internally but upstream was sent as received, this has changed and behaviour is as per docs
Special THANKS: I would like to special thank @bogbert which was discussing and testing changes with me in this release
Full Changelog: 4.11.0...5.0.0