Skip to content

v1.4.0

Latest
Latest

Choose a tag to compare

View all tags
@gioxx gioxx released this 15 Oct 15:22
v1.4.0
42a87a8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release reworks how admins sign in: magic links now work once, sessions live in one browser for at most 8 hours, and you can sign out. It also adds a Deploy with Vercel button for your own instance.

Security

  • Single-use magic links (#20, #21): a link works once, within 15 minutes of being requested. Using it again, using it after 15 minutes, or using an older link after requesting a new one is rejected with "That link expired or was already used".
    • Before, a link could be used any number of times for 15 minutes, from any browser, and each use created its own 7-day session.
    • Two simultaneous uses of the same link can't both succeed: the link is consumed with a conditional write on the Blob store, so only one wins. Verified against a real store with 10 parallel requests.
  • Confirm to sign in: opening the link shows a Sign in button, and the link is used only when you press it. Mail security scanners that open links in advance (Safe Links and similar) can no longer use it up before you click.
  • No email and no plain-text token at rest: the link carries an opaque random token, not your email address. The Blob store keeps only SHA-256 hashes of link tokens and session IDs (under auth/).
  • Browser-bound sessions: the session cookie has no expiry date, so it ends with the browser session, and the server ends every session 8 hours after sign-in whatever the browser does with the cookie. Before, sessions lasted 7 days.
  • One session per admin: signing in on another browser or device ends your previous session there.
  • Sign out: new Sign out button at the top right of every admin page. It ends the session on the server, so a copied cookie stops working too.

New features

  • Deploy with Vercel button (#7, #22) in the README: forks the repo, creates the Vercel project, creates and connects a public Blob store, and asks for every environment variable in one form, with RETENTION_DAYS and MAX_UPLOAD_BYTES pre-filled. The optional Edge Config store and your domain are still manual steps.

Upgrading

  • Every admin signs in once more after you deploy: sessions issued by earlier versions are no longer accepted.
  • No new environment variables. TOKEN_SECRET now signs only the session cookie.
  • To sign in on a Preview deployment, set SITE_URL in the Preview environment to that preview's address; magic links are built from SITE_URL, so otherwise they point at production.
  • The daily cleanup job also removes expired sign-in records; its response now includes authRecordsDeleted.
  • Agent tokens are unchanged: they don't depend on your session and keep working until regenerated or revoked.

Docs

  • README: new Admin sign-in section, Deploy with the button section and the Preview SITE_URL note.
  • Updated knowledge base: Admin login, Self-hosting, FAQ.

Full Changelog: v1.3.0...v1.4.0

Assets 2
Loading