Skip to content

Nimbus Direct v1.7.4

Choose a tag to compare

View all tags
@eurosatofficial eurosatofficial released this 23 Aug 15:05
· 1 commit to main since this release
v1.7.4
87b591c

Nimbus Direct v1.7.4 — Security Hardening

Nimbus Direct 1.7.4 strengthens the public authentication surface, improves error handling, and introduces a standard security contact for responsible disclosure.

Security improvements

  • Prevented authentication forms from falling back to unsafe GET requests when JavaScript is unavailable.
  • Added explicit POST methods to all pre-authentication forms.
  • Blocked native form navigation through the Content Security Policy.
  • Added safe 405 Method Not Allowed handling for non-GET static requests.
  • Added a clear fallback notice when JavaScript is disabled.
  • Removed filesystem paths, ENOENT details, stack information, and operating-system errors from public responses.
  • Missing files now return a generic not_found response with a request ID.
  • Added an RFC 9116-compatible /.well-known/security.txt security contact.
  • Added a documented Nginx/Plesk security-header baseline for proxy-generated error responses.

Defense in depth

The new reverse-proxy documentation explains how to preserve HSTS, CSP, framing protection, referrer policy, cross-origin policies, and other security headers across successful responses and proxy-generated 4xx or 5xx errors.

See docs/REVERSE_PROXY_SECURITY.md after upgrading. Reverse-proxy configuration must be applied separately because edge-generated responses are outside the Nimbus container.

Verification

  • 102 automated tests passing
  • Authentication fallback regression coverage
  • Filesystem disclosure regression coverage
  • Security-header validation
  • security.txt publication validation
  • English and German localization coverage remains at 100%

Upgrade

Existing installations can upgrade without a database migration.

Rebuild Nimbus using both Compose files when using the internal Proxmox connection configuration:

docker compose \
  -f compose.yaml \
  -f compose.internal.yaml \
  up -d --build --force-recreate panel

After deployment, apply the reverse-proxy recommendations from docs/REVERSE_PROXY_SECURITY.md and verify the headers on successful, missing-file, and rejected-method responses.

Assets 2
Loading