Skip to content

v0.6.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 22:21
· 35 commits to main since this release
v0.6.2
6545072

Other websites can no longer trigger a refresh through your browser.

  • Refresh by POST. Since v0.6.0, a refresh also probes every device of your tailnet. Any website could trigger one by loading http://home/?refresh in a visitor's browser. The refresh button now sends a POST to /refresh, and tailhome rejects browser requests that come from another site, including other apps on your tailnet.

No configuration changes. If you scripted /?refresh, send POST /refresh instead.
To upgrade, pull ghcr.io/mickey/tailhome:0.6.2 or download a binary below.

Changelog

  • 6545072 Protect manual refresh from cross-site browser requests
  • 3272678 Shorten the icons privacy line again
Assets 9
Loading