You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
Gateway AuthArea: what it touches
ImprovementsKind: in v2.1.309,
ImprovementsSection of the release
What
Signing in through a Cloud gateway now carries the gateway's allowlist entry through each step: the trust prompt, the device sign-in, the token exchange and the saved login.
When the gateway is allowlisted, the request that looks up its sign-in details at /.well-known/oauth-authorization-server now uses a pinned connection, meaning one that only accepts the expected TLS certificate fingerprint (TLS is the encryption that secures web connections), and it follows no redirects. The device-code and token requests also use a pinned connection. Before, the lookup request was sent with only a user agent and a timeout.
Why
For allowlisted gateways, sign-in can no longer be redirected elsewhere or completed against a different certificate.
