2.35 (security fix)

Security fix: authentication bypass on the log socket

Severity: high, for installations that enable Basic Auth (-U/-P). Affects every earlier release, including the upstream project this is forked from.

With Basic Auth enabled, the web page was protected but the WebSocket that streams the logs was not reliably protected: its session check could be satisfied without having passed Basic Auth. A client that could reach the server and work out which log sources it serves could read the live log stream without credentials.

Fixed in 2.35. The session is now marked authenticated only after Basic Auth succeeds, sessions are no longer created for visitors who fail it, and the socket requires a validly signed session cookie whose server-side session is authenticated. Session cookies also get SameSite=Lax and a 24 h lifetime.

What to do: upgrade to 2.35. If you can't immediately, restrict network access to frontail (firewall, VPN or an authenticating reverse proxy in front of it). Installations without -U/-P were never protected by this mechanism and are unaffected by the change. After upgrading, browsers pick up a fresh session automatically on the next page load; a tab that was open before the upgrade needs a refresh.

Other

• The npm package now contains only what runs (bin, lib, web, preset, index.js): 1.2 MB → 76 kB, 149 → 36 files (it used to include screenshots, tests and CI files).

Details and how to report a vulnerability: see the Security page of the wiki.

Full Changelog: 2.34...2.35