{"version":"2.1.309","anchor":"gateway-login-pins-and-uses-allowlist-entry-with-the-tls-fin","canonical_anchor":"gateway-login-pins-and-uses-allowlist-entry-with-the-tls-fin","heading":"Cloud gateway sign-in pins the connection and blocks redirects for allowlisted gateways","tier":"notice","area":"Gateway Auth","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309\/e\/gateway-login-pins-and-uses-allowlist-entry-with-the-tls-fin","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309","markdown":"### Cloud gateway sign-in pins the connection and blocks redirects for allowlisted gateways\n\nSigning in through an allowlisted Cloud gateway now uses a pinned connection at each step and refuses redirects when looking up the sign-in server\n\n**What**\n\nSigning in through a Cloud gateway now carries the gateway's allowlist entry through each step: the trust prompt, the device sign-in, the token exchange and the saved login.\n\nWhen the gateway is allowlisted, the request that looks up its sign-in details at `\/.well-known\/oauth-authorization-server` now uses a pinned connection, meaning one that only accepts the expected TLS certificate fingerprint (TLS is the encryption that secures web connections), and it follows no redirects. The device-code and token requests also use a pinned connection. Before, the lookup request was sent with only a user agent and a timeout.\n\n**Why**\n\nFor allowlisted gateways, sign-in can no longer be redirected elsewhere or completed against a different certificate.\n\n- Area: Gateway Auth\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: org\n- Heads-up: no"}