Skip to content

StateFrame 0.4.37

Choose a tag to compare

View all tags
@FarsideResearch FarsideResearch released this 06 Nov 03:30
v0.4.37
7740e86
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

StateFrame 0.4.37: proxy credentials never reach the endpoint.

Changes

  • Security: direct requests now remove a caller-supplied Proxy-Authorization header before sending, so a proxy-only credential cannot be forwarded to your endpoint.
  • Security: when a request goes through a proxy, the proxy credentials stay with the proxy and are not sent again after a redirect to a different origin.
  • How requests are routed is unchanged: StateFrame still connects to your endpoint directly and does not use environment proxy settings.

Known issues (fixes planned)

  • In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
  • Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
  • The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
  • On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.
Assets 5
Loading