Skip to content

v0.10.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 13:02
v0.10.0
This tag was signed with the committer’s verified signature.
CybotTM Sebastian Mendel
SSH Key Fingerprint: BsdGvKi3Med56Wy4VisZQhWin20c4hORHHUxNM9bVlw
Verified
Learn about vigilant mode.
4243e51
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Security-hardening release. A cluster of login- and auth-path weaknesses is closed: the username-enumeration oracle on the login options endpoint, an unauthenticated account-lockout DoS, and a fail-open in passkey enforcement. Building on that:

  • Admin API enforces the system-maintainer boundary — a non-maintainer admin can no longer list, revoke, unlock, or send reminders for a system maintainer's passkeys (#78).
  • Setup interstitial no longer exempts every ajax_* route. The exemption is narrowed to the enrollment/login routes, so an enforced-but-unenrolled user can no longer drive state-changing core AJAX endpoints (e.g. the DataHandler save) through it (#79).
  • WebAuthn anchor derivation fails closed: rpId/origin are no longer derived from an unvalidated Host header when trustedHostsPattern is disabled. The check only fires for a real request Host, so CLI/cron paths keep their safe localhost fallback (#79).
  • discoverableLoginEnabled is enforced on the auth-service path that establishes the session, not only at challenge issuance — a username-first token can no longer drive the discoverable branch when the feature is off (#77).
  • The rate-limit check/record TOCTOU is closed with a single atomic consume, so concurrent requests can no longer overshoot the limit (#80).

These enforcement changes are policy, not an auth bypass — a valid passkey signature was always required.

New features: the admin Help page and dashboard onboarding infoboxes are now fully translatable, and a passkeys:recovery CLI command provides out-of-band recovery. Tooling moves to the canonical TYPO3-extension CI template with PHPStan raised to level 10.

Minor bump (new features); no breaking API changes.

Changes

  • chore(release): v0.10.0 (#81)
  • fix(ratelimit): close rate-limit check/record TOCTOU with atomic consume (#80)
  • fix(admin): enforce system-maintainer boundary on passkey admin API (#78)
  • fix: narrow interstitial AJAX exemption + fail closed on Host-derived rpId/origin (#79)
  • fix(auth): enforce discoverableLoginEnabled on the auth-service login path (#77)
  • ci: adopt canonical typo3-extension template (#71)
  • refactor(js): share WebAuthn base64 helpers + modernize login to ES module (TEST-1) (#76)
  • refactor(service): split WebAuthnService into attestation + assertion ceremonies (ARCH-2) (#75)
  • fix(admin): dashboard infobox rendering + i18n + real documentation screenshots (#74)
  • fix: admin-UX hardening + cross-DB credential binding (review follow-ups) (#72)
  • fix: critical onboarding lockout + security/v14-deprecation/arch/docs review findings (#70)

Installation

composer require netresearch/nr-passkeys-be

Publication status

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-passkeys-be-0.10.0.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-passkeys-be-0.10.0.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.

Contributors

Contributors

CybotTM
Assets 12
Loading