Skip to content

v1.6

Choose a tag to compare

View all tags
@fuomag9 fuomag9 released this 11 Jun 14:06
Immutable release. Only release title and notes can be modified.
v1.6
928fc46
This commit was signed with the committer’s verified signature.
fuomag9
SSH Key Fingerprint: VBtxaBlHKIWXUb8jfft6vrwnSToeiwPBlOO2u+pimTE
Verified
Learn about vigilant mode.

Highlights

  • Strip client-supplied X-CPM-* forward-auth headers before proxying upstream.
  • Make mTLS trust handling fail closed when configured certificates, roles, or CAs resolve to no active trust anchors.
  • Gate OAuth registration behind AUTH_ALLOW_OAUTH_REGISTRATION and enforce safe role/status defaults for OAuth-created users by default.
  • Add active session management for listing and revoking sessions from the profile page.
  • Add anti-clickjacking and content-type security headers to public pages.
  • Isolate the Docker socket proxy and L4 port manager on an internal network.

Configuration

  • Set AUTH_ALLOW_OAUTH_REGISTRATION=true to allow new users to register through OAuth.
  • Set AUTH_ALLOW_OAUTH_ROLE_FROM_CLAIMS=true to allow OAuth claims to provide role/status instead of enforcing safe defaults.

Review and update your Docker Compose and environment configuration from this release.

Changes

  • ba795f8 Update development dependencies
  • f96cf87 Update production dependencies
  • 8f97f6e Disallow self registration by default
  • 3257b8d Strip inbound forward-auth headers and make mTLS fail closed
  • 3ae17c4 Force safe role/status defaults for OAuth-created users
  • a4eba25 Gate OAuth signup, fix mTLS CA fallback, and isolate socket proxy
  • 1bd877c Add active session management and public-page security headers
  • 756a5aa Fix unauthenticated OAuth/session end-to-end test state
  • 928fc46 Add opt-out for OAuth role/status enforcement

Full Changelog: v1.5.1...v1.6

Assets 3
Loading