FeedEcho v1.1.0 — Security Hardening
Security-focused release addressing SSRF, CSRF, auth, and secret exposure.
New Features
SSRF Protection
Feed URLs are validated before fetching. Blocks private/internal IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x, ::1, fc00::, fe80::), non-http schemes (file://, gopher://), and hostnames that resolve to private IPs. Prevents attacks on cloud metadata endpoints, localhost, and internal services.
Web UI Authentication
Optional shared-secret auth via FEEDCHO_AUTH_TOKEN environment variable. When set, all requests must include the token as either a cookie (set by the login page at /login) or an X-Auth-Token header. When unset, behavior is unchanged. OAuth callback endpoints are exempt.
HMAC-Signed OAuth State
OAuth state tokens are now HMAC-signed (nonce|instance|signature) with hmac.compare_digest verification. Prevents CSRF and instance field tampering. Replaces the previous unsigned state parameter.
SMTP Password Masking
SMTP passwords are masked (********) when sent to the browser. The save endpoint skips password updates when the mask placeholder is submitted, preserving the existing password.
Configurable OAuth Callback URL
FEEDCHO_CALLBACK_URL environment variable replaces the hardcoded callback URL. Self-hosters no longer need to edit source code.
Configuration
| Environment variable | Purpose | Default |
|---|---|---|
FEEDCHO_AUTH_TOKEN |
Shared-secret auth token (enables login page + API auth, also signs OAuth state) | Unset (auth disabled) |
FEEDCHO_CALLBACK_URL |
Public URL for OAuth callback | https://feedecho.snakepit.us/oauth/callback |
FEEDCHO_DB_PATH |
Path to SQLite database | ./feedecho.db |
Tests
17 new tests (test_security.py) covering SSRF IP/scheme blocking, hostname resolution mocking, and OAuth state sign/verify/tamper rejection. 62 tests total, all passing.
Full changelog: v1.0.0...v1.1.0