Skip to content

Optional auth protection added to report, overview, and coverage endpoints

Choose a tag to compare

View all tags
@northwestwitch northwestwitch released this 17 Jun 11:52
· 129 commits to main since this release
v3.6
d8125a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[3.6]

Added

  • Optional Authorization protection on overview and report endpoints. When env variables JWKS_URL and AUDIENCE are specified, access_token will be collected from request cookies
  • Optional Authorization protection on coverage endpoints. When env variables JWKS_URL and AUDIENCE are specified, access_token will be collected from request headers {"Authorization": "Bearer "}
  • Tests for endpoints protected by Authorization
  • A test for the meta/handle_coverage_stats/get_chromosomes_prefix function

Fixed

  • Bump h11 from 0.14.0 to 0.16.0 (fixes: h11 accepts some malformed Chunked-Encoding bodies)
  • Bump requests from 2.32.3 to 2.32.4 (fixes: Requests vulnerable to .netrc credentials leak via malicious URLs)
  • Refactored the meta/handle_coverage_stats/get_chromosomes_prefix function to prevent vulnerability to command injection attacks
Assets 2
Loading