Security hardening of the host listener (remote control and webhooks). Updating is recommended for anyone who has enabled the host or a webhook. Servers and settings are kept when upgrading over 1.0.x.
Installation
Download and run Mineger_1.0.2_x64-setup.exe (or the .msi).
What changed
- Request body limits per route.
/hook/{id}now accepts at most 64 KB. It has to read the body to find the token, so an unauthenticated caller could previously make the host buffer up to 1 GB per request. API routes are capped at 1 MB and the server icon at 16 MB; the 1 GB limit remains only on mod uploads. - Constant-time token comparison for the API token and for per-webhook tokens.
- Rate limiting on failed authentication: after 20 failures within a minute from the same address the host answers
429without evaluating the token. - API token only in the
Authorization: Bearerheader. The?token=query parameter is honoured solely on/api/ws, where browsers cannot set headers. Webhook tokens may still travel in query or body: they are per-hook, carry their own permissions, and GET-only integrations depend on it. - CORS restricted to the Mineger webview origins instead of
permissive(). Bots and the remote app are unaffected. - Configurable listen address under Settings → Remote control → Listen on: whole network (default) or this PC only, for setups behind a tunnel or VPN on the same machine.
- Webhook statistics no longer rewrite
settings.jsonon every request. Unauthenticated calls stay in memory; authenticated ones are coalesced (written at most every 2 s and on exit). All settings writes go through a single lock. - Content Security Policy for the webview (was unset).
- New application icon and logo, replacing the default Tauri artwork (installers rebuilt on 2 September 2026 with the same version).
No functional changes. Full changelog: https://github.com/Zed2101/Mineger/blob/main/CHANGELOG.md