Skip to content

OpenShield v1.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Oct 04:05
· 26 commits to main since this release
v1.1.1
b87779c

Security

  • Serve auth — Bearer token is now required on every openshield serve request, including loopback binds. CORS is an allowlist (Tauri and localhost origins, plus [desktop] allowed_origins). Host is validated against loopback names, the bind address, the LAN address on wildcard binds, and [desktop] allowed_hosts (DNS rebinding). Token comparison is constant-time. POST /api/v1/pair requires the master token, is limited to 5 requests per 60s, and stores at most 32 pairing tokens.

Changed

  • Clients must send the token — Desktop reads ~/.config/openshield/desktop.token. HTTP requests use Authorization: Bearer. WebSocket upgrades may pass ?token= because browsers cannot set headers on the handshake.
Assets 13
Loading