Ridu v0.20.1

Ridu 0.20.1

The embedded admin signs in behind a hosting platform's TLS proxy, such as Railway's, without
listing its own origin in RIDU_ALLOWED_ORIGINS.

Fixes

• Behind a proxy that terminates HTTPS and forwards plain HTTP from addresses outside
  RIDU_TRUSTED_PROXY_CIDRS, Ridu saw every request as http. The browser sent the page's
  https origin, so Ridu refused the admin's own sign-in and every other write with
  origin_denied. When a request arrives as plain HTTP from an address Ridu doesn't trust, Ridu
  now accepts the HTTPS origin of the host the request names: only a page served over HTTPS from
  that host sends it. Ridu still follows the scheme a trusted proxy reports, refuses an HTTP origin
  on an HTTPS request, and accepts no other host or port this way. See
  Proxies and HTTPS.
• Ridu refused browser writes from unlisted origins without logging anything. It now logs the
  first refusal of each origin, with request_origin, the origin it computed for the request, for
  up to 32 origins.

Upgrade

Update the Go module and all Ridu npm packages to 0.20.1 together, and rebuild the admin and
application binary. No contract changes.

On Railway and similar platforms, you can remove your application's own HTTPS origin from
RIDU_ALLOWED_ORIGINS if you added it to work around this. Keep the origins of other browser
applications that call the API.

Ridu requires Go 1.26.9 or newer. Go 1.27.0 and 1.27.1 meet that minimum but still have the
standard-library vulnerabilities described in the 0.20.0 notes, so build and deploy with Go 1.26.9
or a later 1.26 release, or with Go 1.27.2 or later.