v1.2.1

What's Changed

• Query Parameter Attack Surface Hardening (checkQuery / check_query):
  • Across all gateway plugins (traefik-warden, caddy-warden, nginx-warden), query parameter inspection now examines both parameter keys and values.
  • Neutralizes evasion attempts where payload paths are placed in parameter names (e.g., /?foo=bar&.env=1 or /?settings.py=).
  • Added recursive path normalization on candidate query parameters.
• Client IP Extraction & Port/Bracket Normalization (ip_filter):
  • Hardened IP address parsing across all gateways when upstream reverse proxies, load balancers, or CDNs (Cloudflare, AWS ALB, NGINX) include ports or brackets in X-Forwarded-For or X-Real-IP headers (e.g., 192.168.1.1:8080, [2001:db8::1]:54321, or bracketed IPv6 [2001:db8::1]).
  • Implemented automatic port and bracket stripping (clean_ip / cleanIP) before passing to standard IP/CIDR evaluation, preventing false rejections of legitimate whitelisted IPs.
• Response Modes & Silent Drop Parity (silentDrop / silent_drop):
  • Standardized silentDrop mode across all gateways to match the modern response.mode: silentDrop configuration (replacing deprecated direct silentDrop: bool configs).
• Honeypot Evaluation Scope (fakeSuccess):
  • Ensured fakeSuccess honeypot evaluation across Traefik, Caddy, and NGINX inspects both normalized URL paths and raw request URIs to prevent bypasses via URI manipulation.
• Traefik Logging Clean-Up (traefik-warden):
  • Standardized debug logging to stdout and eliminated duplicate stderr log messages.

Full Changelog: v1.2.0...v1.2.1

v1.2.0

What's Changed

• Fix legacy Traefik config by @aman400 in #28

Full Changelog: v1.1.0...v1.2.0

v1.1.0

What's Changed

• Expanded Default Block Patterns:
  • Added built-in protection across Traefik, Caddy, and NGINX for private cryptographic keys and certificates (*.pem, *.key, *.crt, *.pfx, *.p12, *.jks, *.kdb).
  • Added container manifest blocking (Dockerfile*, docker-compose*.yml, docker-compose*.yaml).
  • Added OS directory structure leak protection (.DS_Store).
  • Added CMS and framework configuration file protection (wp-config.php*, configuration.php*, settings.py, local_settings.py).
• Header Injection & Forwarded Path Inspection (checkHeaders / check_headers):
  • Configurable header inspection list to neutralize HTTP reverse-proxy header smuggling (X-Forwarded-Uri, X-Rewrite-URL, X-Original-URL, X-Custom-Path).
  • Headers are passed through candidate path extraction and normalization before regex matching.
• Path Normalizer Fuzz Testing:
  • Implemented continuous fuzz testing (FuzzExtractCandidatePaths) in test suites targeting percent-decoding, null bytes, backslashes, and matrix parameters.

Full Changelog: v1.0.0...v1.1.0

v1.0.0

What's Changed

• First stable release v1.0.0

Full Changelog: v0.3.3...v1.0.0

v0.3.3

What's Changed

• fix: some of the config flags and mode are missing in config
• securityLog flag added to support crowdsec logging format export

Full Changelog: v0.3.2...v0.3.3

v0.3.2

What's Changed

• Package rename due to Yaegi Compliance
• Add test cases for Yaegi Compliance
• Handle silent mode response
• Debug flag supported

Full Changelog: v0.3.1...v0.3.2

v0.3.1

What's Changed

• Fix go version for Traefik by @aman400 in #17

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• Granular HTTP Method Filtering (methods / method):
  • Traefik Middleware Configuration: Added methods array property to path pattern rules (pathPatterns[].methods and allowPatterns[].methods), accepting standard HTTP verbs (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, etc.).
• Improved Test coverage

Full Changelog: v0.2.4...v0.3.0

v0.2.4

What's Changed

• Migrate docs and repo by @aman400 in #12

Full Changelog: v0.2.3...v0.2.4

v0.2.3

What's Changed

• Configurable Default Whitelist Flag (enableDefaultAllowPatterns):
  • Added enableDefaultAllowPatterns configuration flag (boolean, defaults to true).
  • When set to false, RouteWarden disables the built-in public whitelist (/robots.txt, /sitemap.xml, /ads.txt, /security.txt, and /.well-known/*), giving operators total zero-trust control over allowlists.
  • Retains backward compatibility where built-in paths remain automatically permitted by default.
• Production Case Studies Suite (docs/examples/):
  • Added 6 in-depth architectural production case studies with Traefik configurations and threat model breakdowns:
    • Dual-Router Immich Photo Sharing: Exposing public sharing while cloaking internal administration and microservices (with Traefik routing rules and Immich external domain configuration).
    • Zero-Trust Stripe & GitHub Webhook Ingress: Locking down webhook receivers with payload inspection bypass while silently cloaking other paths.
    • Prometheus & Spring Boot Actuator Cloaking: VPN/LAN restriction of metrics, diagnostics, and management ports without exposing sensitive internal metadata.
    • WordPress & CMS Admin Shielding: Hardening wp-login.php, xmlrpc.php, and brute-force endpoints with dynamic IP bypass or CAPTCHA challenge.
    • Vaultwarden Admin Lockdown: Completely severing exposure of /admin endpoints while keeping password synchronization functional across mobile and browser clients.
    • Honeypot Deflection, Silent Drops & Active Defense: Deceiving automated vulnerability crawlers using HTTP 200 decoy responses, connection resets via silentDrop, active crawler neutralization via gzipBomb, and staging environment cloaking.
• Dedicated Top Navigation & Homepage Discovery:
  • Promoted "Case Studies" to the top navigation bar and sidebar in VitePress.
  • Added an interactive visual card grid on the documentation homepage highlighting key architectures and real-world threat protections.
• Wildcard & Regex Subpath Pattern Conformance:
  • Expanded test coverage and documentation on regex subpath matching (e.g., prefix anchors ^/api/users.*$, exact paths, and query string separation).
• Mobile Responsive Design Improvements:
  • Compact collapsible search icon button on mobile screens (<768px) to prevent navigation clipping.
  • Mobile-optimized table horizontal scrolling and single-column responsive card layouts.
• SEO & Social Preview Metadata:
  • Added OpenGraph (og:title, og:description, og:image, og:url) and Twitter Card metadata to documentation pages.
• Gzip Bomb Active Defense Mode (mode: gzipBomb / mode: bomb):
  • Added native decompression bomb response mode for active bot and vulnerability scanner neutralization.
  • Serves an HTTP 200/403 response with Content-Encoding: gzip streaming compressed zeroes using Go's compress/gzip with best compression.
  • Configurable gzipBombMB option (defaults to 10MB, requiring negligible server bandwidth while expanding to ~10GB in client memory, triggering OOM crashes on crawlers and scanners).
• Static High-Resolution Icon:
  • Rendered crisp 512×512 PNG asset (assets/icon.png and docs/public/icon.png) derived from the animated SVG vector.

Changed

• Enhanced routewarden_test.go and config_test.go with test assertions for enableDefaultAllowPatterns and wildcard patterns.

Full Changelog: v0.2.2...v0.2.3