vauly 0.2.3

The API's procedures use the web app's session cookie only for requests from the web app's own pages, and handle any other site's request as though no one were signed in. No migrations.

Updating from 0.2.2? Nothing to do but update the server. The browser extension and the CLI are unchanged. Updating vauly has the details. Copies made with the Deploy to Cloudflare button update with Actions → Update vauly.

Try it: the live demo at https://demo.vauly.app (shared, resets every hour).

Deploy your own in one click: .

Install the CLI on macOS or Linux; it checks the download against SHA256SUMS:

curl -fsSL https://vauly.app/install.sh | sh

On Windows, download vauly-windows-x64.exe below and check it against SHA256SUMS.

Browser extension: vauly-extension-0.2.3-chrome.zip below. Until vauly is listed on the Chrome Web Store, unzip it and load the folder unpacked in chrome://extensions, or build it yourself as the docs describe.

Check what a vauly serves: vauly verify <url> rebuilds the commit an instance names and compares every file and security header. vauly-build.json below is this release's own build.

Known limits: no independent security audit yet, and no native mobile apps yet. Security describes the design and where it stops protecting you.

What's in 0.2.3

Security

• The API uses the web app's session cookie only for the web app's own pages. The browser sends the cookie with other sites' requests too, and the API's procedures now handle those as though no one were signed in. A request counts as the web app's when the browser's Fetch Metadata says it's same-origin, or its Origin is the API's own address, CORS_ORIGIN or BETTER_AUTH_URL; a request with neither must come from the address bar, or from a browser that sends no Fetch Metadata, and anything but a GET must send JSON. The browser extension, the app for iPhone and agents sign in with their own tokens and aren't affected.