WebSSH 2.0

WebSSH 2.0

WebSSH 2.0 is a major update focused on security, authentication assurance, session management, and a completely redesigned responsive workspace.

Highlights

• Completely redesigned responsive WebSSH workspace
• New Security Center and Admin Center experience
• Improved mobile and tablet support
• Context-based workspace for Files, Commands, Diagnostics, and Notes
• Per-session SFTP and diagnostics integration
• Improved split-pane and multi-session workflows
• Major authentication and MFA improvements
• Extensive security hardening across authentication, sessions, administration, and SSH

Authentication & Security

• Added optional TOTP authenticator-app MFA
• Added Passkey MFA support across supported authentication flows
• Improved LDAP / Active Directory authentication
• Enhanced OpenID Connect authentication and assurance handling
• Added administrator-controlled authentication feature gates
• Added action-bound administrator step-up authentication
• Added single-use, session-bound, action-bound, and target-bound authorization grants
• Improved authentication assurance tracking
• Restricted recovery codes to second-factor recovery
• Hardened factor enrollment and recovery flows
• Improved handling of parallel authentication sessions and browser tabs
• Added revalidation of authenticated Socket.IO sessions
• Improved redaction of sensitive audit information
• Improved SSH host-key error handling without exposing backend internals
• Authentication capabilities now fail closed when required deployment configuration is unavailable

MFA & Account Security

• Optional TOTP enrollment with encrypted authenticator secrets
• TOTP replay protection
• One-time recovery codes
• Safe MFA replacement and recovery flows
• Passkeys and TOTP can be used for MFA-enabled accounts
• Recovery codes can only be used after successful primary authentication
• Recovered sessions are restricted until account security has been repaired
• MFA remains optional per account unless enabled by the user and permitted by the deployment

Administrator Security

• Added administrator security feature controls
• Sensitive administrative actions now require fresh authentication assurance
• Administrator step-up grants are short-lived and single-use
• Step-up authorization is bound to the current session, action, and target
• Authentication capabilities remain constrained by deployment configuration
• Security policy changes no longer unexpectedly terminate active browser or SSH sessions
• Improved warnings for configuration changes that could affect future administrator access

OpenID Connect

• Improved OIDC callback implementation
• Added explicit authentication assurance validation
• Added configurable MFA and phishing-resistant amr / acr values
• Added provider-driven OIDC step-up authentication
• OIDC assurance is only trusted when signed claims match explicitly configured values
• Missing or unknown assurance claims remain basic assurance
• Stable issuer and subject identifiers continue to be used for account linking
• OIDC accounts are never automatically linked by email address

LDAP / Active Directory

• Improved LDAP and LDAPS authentication flows
• Added MFA support for LDAP-authenticated accounts
• Sensitive account operations perform fresh directory verification
• LDAP credentials remain server-side
• Deployment configuration remains the hard capability boundary for LDAP authentication

Workspace & Sessions

• Completely redesigned responsive desktop, tablet, and mobile workspace
• Connection sessions are now separated from contextual tools
• Files, Commands, Diagnostics, and Notes are available through the context workspace
• Embedded SFTP is bound to the active SSH session
• Diagnostics are bound to the active SSH session
• Added expandable diagnostics overlay
• Added resizable desktop context panel
• Improved behavior when resizing the application
• Improved handling of unavailable session capabilities
• Added configurable disconnect behavior
• Persistent tmux sessions remain reconnectable
• Improved session capability detection
• Improved active-session command handling
• Improved session lifecycle behavior

SFTP & Host Management

• Improved per-session SFTP integration
• Improved SFTP capability detection
• Hardened SFTP probe lifecycle
• Active SFTP panels are preserved correctly during resize
• Improved Hosts management
• Existing authentication, ownership, host-key, network-policy, transfer, and SFTP security boundaries are preserved

UI / UX

• Redesigned authentication pages
• Redesigned Security Center
• Redesigned Admin Center
• Improved application navigation
• Improved responsive scaling
• Improved mobile account menu
• Improved footer visibility
• Improved theme compatibility
• Updated translations
• Improved safe UI defaults
• Existing users retain their previous close-confirmation behavior
• New accounts receive the updated default behavior

Deployment & Configuration

• Updated Docker and homelab configuration documentation
• Added TOTP deployment configuration
• Added OIDC authentication-assurance configuration
• Added administrator step-up configuration
• Improved reverse-proxy documentation
• Added proxy-neutral Apache reverse-proxy documentation
• Existing stored preferences remain compatible
• Configuration and schema changes are additive
• Explicit existing user preferences continue to take precedence
• Authentication features now distinguish between deployment capability, runtime readiness, and administrator activation

Security Validation

WebSSH 2.0 received extensive security and regression testing before release:

• 1,806 Python tests passed
• Python 3.11 validated
• Python 3.14 validated
• 283 JavaScript unit tests passed
• 79 Playwright browser tests passed
• ESLint passed
• 10 vendored frontend assets verified
• Dependency lock validation passed
• 27 disposable OpenSSH / Paramiko integration tests passed
• Production Python 3.14 container image built successfully
• Independent security and regression review completed with no remaining Critical or Important findings

Upgrade

Existing Docker and homelab installations can upgrade using the normal container update process.

Review the updated authentication and security configuration when enabling TOTP, Passkeys, LDAP, OIDC, or administrator step-up functionality.

As always, backing up persistent WebSSH data before a major-version upgrade is recommended.

---

Full Changelog: Changes included in WebSSH 2.0 are based on the current main branch at the time of release.