Stratos v5.4.0

Breaking Changes

• API key secrets are now stored hashed instead of in plaintext
  (HMAC-SHA256 peppered with the console encryption key). Existing keys
  are hashed in place on upgrade, so keys already issued keep working.
  Because the hash is keyed with ENCRYPTION_KEY, changing that key now
  invalidates stored API keys — in addition to the stored endpoint tokens
  it already invalidates.

Features

• The application Variables tab now masks secret-looking values —
  keys matching pass/secret/token/private/key/cred, URLs with
  embedded credentials, and PEM private-key blocks under any
  variable name — in both the variables list and the All
  Variables block. Values appear only on explicit request: a per-row
  Show/Hide toggle in the list, a Show secrets toggle on the block.
  The same value heuristics the Service Keys page already uses; hosts and
  ports in connection URLs stay readable.
• The diagnostics resource waterfall now draws the document request itself
  as its first row, segmented by phase (stall, DNS, TCP, TLS, server wait,
  download). Previously the document was invisible — it is a navigation
  entry, not a resource entry — so on a high-latency connection the chart
  showed an unexplained void until the HTML arrived. Under the Stratos
  clock the row collapses to just server wait + download, the part the
  app can influence.

Bug Fixes

• WebSocket upgrades (application SSH and log streaming) now validate the
  request Origin — same-origin, plus any host in ALLOWED_ORIGINS —
  instead of accepting connections from any origin, closing a cross-site
  WebSocket hijacking vector.
• The session cookie is now issued with SameSite=Lax.
• Jetstream no longer terminates when the Cloud Foundry info request fails
  during SSO auto-connect at login. That one login fails instead of the
  whole process exiting for every user.
• Proxied requests that time out no longer leak a goroutine and its
  buffered response body per endpoint.
• The OAuth client secret and the application-SSH one-time code are no
  longer written to the jetstream log.
• Jetstream now warns at startup when ENCRYPTION_KEY is left at the
  well-known default value shipped in config.example.
• Signing in no longer flashes the Home page, blanks the console, and
  reloads it. The login click handler and the existing-session check both
  triggered the post-login redirect; the two navigations cancelled each
  other and the loser fell back to a full page reload. The redirect now
  runs once.