Skip to content

v0.11.1

Choose a tag to compare

View all tags
@eterna2 eterna2 released this 13 Jun 17:02
· 10 commits to main since this release
v0.11.1
ac853e4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[0.11.1] — 2026-06-14

Fixed

  • Cookie TTL Alignment: nocr_token cookie Max-Age is now derived from the JWT exp claim and nocr_refresh from the IdP's refresh_expires_in field, preventing stale cookies from outliving their tokens. Configurable fallbacks via PROXY_TOKEN_COOKIE_TTL and PROXY_REFRESH_COOKIE_TTL.
  • Stale Refresh Cookie Cleanup: When the IdP rejects an expired refresh token (invalid_grant), the gateway immediately clears the nocr_refresh cookie to prevent repeated futile round-trips.
  • Refresh Token Rotation Safety: Added singleflight deduplication to performTokenRefresh — concurrent requests for the same refresh token share a single IdP round-trip, preventing race conditions with strict refresh token rotation.
Assets 2
Loading