add note about backwards compatibility to OIDCUnAuthAction
#
# Useful in Location/Directory/Proxy path contexts that serve AJAX/Javascript calls and for "anonymous access"
#
-# When not defined the default is "auth" with auto-detection of XML HTTP requests, which would get "401".
+# When not defined the default is "auth" with auto-detection of requests that woult not be able to complete
+# an authentication round trip to the OpenID Connect Provider, which would receive a 401.
# The default auto-detection algorithm looks for the "X-Requested-With: XMLHttpRequest" header/value, or
# the presence of a Sec-Fetch-Mode header with a value that is not equal to "navigate", or the presence of
# a Sec-Fetch-Dest header with a value that is not equal to "document" or the absence of
# an "Accept" header with any of the values "text/html" "application/xhtml+xml" or "*/*"
-# and returns 401 for such non-browser/non-html clients.
+# and returns 401 for such non-auth-capable requests, e.g. XML HTTP Requests, image loading requests etc.
+# that would create a state cookie but never return to delete it.
# See: https://github.com/zmartzone/mod_auth_openidc/wiki/Cookies#tldr
#
# Only for Apache >= 2.4.x:
# Since verson 2.4.4 a boolean Apache expression as the second parameter to specify which requests
# need to match to return the configured value in the first parameter to override the default "auth".
# See also: https://httpd.apache.org/docs/2.4/expr.html.
-# E.g to return 401 for cURL based user agents and "auth" for any other browsers/user agents:
+# E.g to only return 401 for cURL based user agents and "auth" for any other browsers/user agents:
# OIDCUnAuthAction 401 "%{HTTP_USER_AGENT} =~ /curl/"
# to effectively override the default XML request detection algorithm by ignoring the Sec-Fetch-Mode,
# Sec-Fetch-Dest and Accept headers:
# || ( -n %{HTTP:Sec-Fetch-Dest} && %{HTTP:Sec-Fetch-Dest} != 'document' ) \
# || ( ( %{HTTP_ACCEPT} !~ m#text/html# ) \
# && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) \
-# && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) \
-# )"
+# && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"
+# To enable authentication in an iframe you need to change the Sec-Fetch-Dest part above in:
+# || ( -n %{HTTP:Sec-Fetch-Dest} && ( %{HTTP:Sec-Fetch-Dest} != 'iframe' && %{HTTP:Sec-Fetch-Dest} != 'document') \
+# For backwards compatibility with version < 2.4.10 you can remove the Sec-Fetch-Mode and Sec-Fetch-Dest parts.
# To disable auto-detection of XML HTTP request altogether and uncondtionally return "auth" for all clients:
# OIDCUnAuthAction auth true
# Note that actually *any* expression value in "OIDCUnAuthAction auth <expr>" will *always* render "auth"
# (even when set to "false"...) because of the default, so using an <expr> value (other than "true") only
# makes sense in combination with one of the values other than "auth".
-#OIDCUnAuthAction [auth|pass|401|407|410] [<expr>]
+#OIDCUnAuthAction [auth|pass|401|407|410] [<expression-to-detect-non-auth-request>]
# Defines the action to be taken when an unauthorized request is made i.e. the user is authenticated but
# does not meet the `Require claim <>` directives or similar.
