tinyauth

Reverse Proxies & Load Balancers

The tiniest OpenID Certified™ authentication and authorization server, designed as a middleware or standalone service supporting OAuth, LDAP, and popular proxies like Traefik, Nginx, and Caddy.

Track releases GitHub Website

Go Latest v5.1.2 · 6d ago Security brief →

Features

OpenID Certified™ Basic OP authentication server
Supports OAuth, LDAP, and fine‑grained access controls
Works as middleware for applications or as a standalone server
Compatible with Traefik, Nginx, Caddy and other common proxies

Recent releases

View all 11 releases →

Upgrade now

v5.1.2 Security relevant 6d

Auth

Security fixes + redirection

Open

Review required

v5.1.1 Bug fix 9d

Auth

LDAP fix + ACL + label‑provider

Open

Upgrade now

v5.1.0 Breaking risk 11d

Auth

OpenID Connect certified + security fixes

Open

v5.0.7 Breaking risk 3mo

Notable features

OpenID Connect server now supports PKCE
User information endpoint supports POST requests with access token in body
Unsigned OpenID Connect request objects now supported

Full changelog

Tinyauth v5.0.7

Hello everyone! This is officially the last release under my username. After this last patch, Tinyauth will move to its new home tinyauthapp, no breaking changes for now. As for this release, it addresses some further issues with the Envoy proxy and improves the OpenID Connect experience.

Improvements

The OpenID Connect server now supports PKCE
The OpenID Connect user information endpoint now supports POST requests @scottmckendry
The OpenID Connect user information endpoint now supports the access token in the POST request body @scottmckendry
The OAuth flow now supports the OpenID Connect parameters and stores CSRF states server-side for anti-tampering
Add X-Tinyauth-Location header for Nginx instances to support redirect to login and unauthorized pages automatically
Support unsigned OpenID Connect request objects @scottmckendry
Accessibility improvements

Fixes

Use 307 redirects for Envoy proxy
Fix TOTP field auto-fill not working in some password managers @scottmckendr

Technical

Update dependencies
Update translations
Use own fork of the paerser library for better flexibility in configuration parsing
Fail app early when the app URL is missing

Please let us know of any issues so we can address them as soon as possible.

Full Changelog: https://github.com/steveiliop56/tinyauth/compare/v5.0.6...v5.0.7

View release on GitHub

v5.0.6 Bug fix 3mo

Fixed browser detection for traffic passing through certain proxies and refreshed dependencies to close hidden bugs, improving reliability of auth redirects.

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.