Skip to content

PortalWeave SSO 1.2.1

Choose a tag to compare

View all tags
@RobotHanzo RobotHanzo released this 06 Nov 20:04
v1.2.1
13ca935
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PortalWeave SSO 1.2.1 fixes client-IP attribution in opted-in audit logs behind Nginx and Cloudflare.

  • Resolve IPv4 and IPv6 visitor addresses through explicitly trusted proxy IPs/CIDRs.
  • Support X-Forwarded-For chains, X-Real-IP and CF-Connecting-IP without trusting caller-supplied headers from arbitrary peers.
  • Preserve the original IPv6 address when trusted Cloudflare traffic uses Pseudo IPv4 overwrite mode.
  • Keep IP collection off by default, with unchanged audit retention and no automatic proxy-list downloads.

When the web server still supplies the proxy as REMOTE_ADDR, configure PORTALWEAVE_SSO_TRUSTED_PROXIES and PORTALWEAVE_SSO_CLIENT_IP_HEADER in wp-config.php. If Nginx already restores REMOTE_ADDR, keep application-level proxy trust disabled. See the Nginx and Cloudflare deployment guide.

Validation includes 132 WordPress integration tests, 95 tooling checks, 13 HTTPS protocol tests, the minimum/current WordPress and multisite CI matrix, and strict Plugin Check. The attached ZIP and SHA-256 file are the exact verified artifacts from the successful workflow for this tag.

Full changelog

Assets 4
Loading