Why

Currently sso-proxy signs the Gap-Signature header using a shared secret stored in the env-vars with the prefix "SSO_CONFIG_". This can be tedious as both the upstream and sso_proxy need to have the same secret.

What

Using a public/private key mechanism, SSO Proxy will sign requests with its private key and have an endpoint available for upstreams to retrieve the public key and validate the authenticity of the requests.