Skip to content

v1.0.7

@aarora79 aarora79 tagged this 10 Dec 03:28
Major improvements to session cookie security configuration and documentation:

Security Enhancements:
- Removed automatic domain inference (explicit configuration only)
- Added X-Forwarded-Proto detection for HTTPS termination at load balancers
- Implemented secure-by-default recommendations
- Clear separation of localhost vs production configuration

Configuration:
- Added SESSION_COOKIE_SECURE environment variable
- Added SESSION_COOKIE_DOMAIN environment variable
- Added Terraform variables for ECS deployments
- Updated all configuration templates with comprehensive examples

Documentation:
- Comprehensive SESSION_COOKIE_SECURE documentation with critical warnings
- HTTPS termination detection documentation
- Troubleshooting guide for login issues
- Enhanced cookie security design document
- Generic domain examples (removed AWS-specific references)

ECS Deployment:
- Updated all ECS task definitions with session cookie environment variables
- Updated terraform/aws-ecs/README.md with session cookie configuration guide
- All services deployed and running with latest configuration

Files Changed:
- .env.example
- auth_server/server.py
- registry/auth/routes.py
- docs/configuration.md
- docs/complete-setup-guide.md
- docs/design/cookie-security-design.md
- terraform/aws-ecs/modules/mcp-gateway/ecs-services.tf
- terraform/aws-ecs/variables.tf
- terraform/aws-ecs/terraform.tfvars.example
- terraform/aws-ecs/README.md

Breaking Changes: None - backward compatible with existing deployments
Assets 2
Loading