v0.12.0

What's Changed

• Finish GitHub's OAuth flow server-side, against a state in #638 (closes #637) — security
• Start GitHub's OAuth flow server-side, and let the wizard report its own failures in #636 (closes #631, #632)
• Restart the login when a callback carries no state at all in #640
• Build the GitHub button's URL in Go, not in four templates in #639
• Take the CDN stylesheets off the critical path in #635 (closes #630)

Signing in with GitHub is goblog's job now

The flow used to finish in the browser: the login page read ?code= out of the query and posted it to /api/login, which exchanged it and set the session. Nothing tied that code to the visitor who started the flow, so a code obtained for one account could be replayed into another visitor's browser, leaving them signed in as somebody else.

/login/github now mints an unguessable state, keeps it in the session and sends it to GitHub; the code is exchanged only if that state comes back unchanged, and it is spent either way. /api/login has been removed — it accepted a bare code as a form post and set the session from it, which a cross-site form could exploit without the login page being involved at all.

Along the way the authorize URL stopped being assembled in each theme's inline script, where window.location went into redirect_uri unescaped and a next containing & broke the URL outright.

Pages stop waiting on cdnjs

Render-blocking CSS on a public page drops from 67.6 KB to 31.3 KB (gzipped). Measuring what each sheet actually matched gave three different answers rather than one loading trick:

sheet	gzip	rules matched
bootstrap	30.7 KB	2.4%	stays blocking — those rules do the layout
font-awesome	20.2 KB	0.8%	loads async
tachyons	13.1 KB	0.9%	removed — all goblog used of it was four rules
bootstrap-social	3.0 KB	0%	login page only

Tachyons' four rules now live in www/css/base.css, served by goblog rather than added to a theme, so every theme keeps working with no release.

Also

• The install wizard can report its own failures. Both database handlers returned nothing when the form could not be read, which gin sends as a bare 200 — so the Test Database button turned green on a request the server never looked at. The client half threw on any non-JSON error response, so the button went red and the reason never appeared.

⚠️ Update your theme

If you run goblog-theme-forest or goblog-theme-minimal, install the new version:

• goblog-theme-forest v1.3.0
• goblog-theme-minimal v1.1.0

Older versions of those themes build the GitHub authorize URL themselves, with no state, and their sign-in button has no URL to point at. goblog recovers from the first of those automatically — a callback arriving with no state restarts the login (#640), so you will not be locked out — but it costs an extra round trip to GitHub and the button itself is still stale. Both themes now declare min_goblog_version: 0.12.0, so the directory will offer them only once you are on this release.

goblog-site-theme needs nothing: it is tracked from main, which already has the change.

Not included

Bootstrap, being the layout framework, still blocks rendering. Auto-updating installed themes and plugins — which would have prevented the theme mismatch above rather than recovering from it — is tracked in #641.

Full Changelog: v0.11.0...v0.12.0