Repository navigation

Security fixes - #256

Merged

rthellend merged 54 commits into

mainfrom

security-review

Oct 7, 2026

Merged

Security fixes#256
rthellend merged 54 commits into
mainfrom
security-review

Commits on Oct 7, 2026
- Match SSO rules against the clean path only
  
  rthellend
  and
  claude
  committed
  de86bdd
- Bind trusted issuer keys to their issuer
  
  rthellend
  and
  claude
  committed
  52261d8
- Reject invalid SSH certificate TTLs
  
  rthellend
  and
  claude
  committed
  2bd4b32
- Fix infinite recursion in QUICConn
  
  rthellend
  and
  claude
  committed
  e79e68d
- Check the Host header before authenticating requests
  
  rthellend
  and
  claude
  committed
  c670893
- Verify OCSP responder authorization and freshness
  
  rthellend
  and
  claude
  committed
  dabecfe
- Restrict DNS names in PKI server certificates
  
  rthellend
  and
  claude
  committed
  7fd766c
- Add timeouts and a connection limit to the plain HTTP server
  
  rthellend
  and
  claude
  committed
  9a42de0
- Limit pending OIDC requests and vacuum less often
  
  rthellend
  and
  claude
  committed
  1284c6e
- Check URL token hosts on login and logout, add expiration
  
  rthellend
  and
  claude
  committed
  3ca71b6
- Use absolute URLs when redirecting to the current request
  
  rthellend
  and
  claude
  committed
  30839d6
- Bind SAML requests to the browser
  
  rthellend
  and
  claude
  committed
  5560b7d
- Record ECH events only for known server names
  
  rthellend
  and
  claude
  committed
  4d5e2c9
- Strip spoofable forwarding and identity headers
  
  rthellend
  and
  claude
  committed
  281a3aa
- Check local handler scopes when no SSO rule matches
  
  rthellend
  and
  claude
  committed
  e29af4d
- Bound pending login state in identity providers
  
  rthellend
  and
  claude
  committed
  02e2ced
- Check clientData.origin in passkey assertions
  
  rthellend
  and
  claude
  committed
  6346ae0
- Bind OIDC authorization requests to the requesting user
  
  rthellend
  and
  claude
  committed
  f2d4946
- Show the client and scopes on the device verification page
  
  rthellend
  and
  claude
  committed
  473a749
- Make fake passkey credential IDs look real
  
  rthellend
  and
  claude
  committed
  1feb33d
- Fix nil pointer dereference on /.sso/ without SSO
  
  rthellend
  and
  claude
  committed
  ffe5a14
- Fix stale CRLs and a data race in the built-in PKI
  
  rthellend
  and
  claude
  committed
  13c63e1
- Skip the CSRF check only for valid bearer tokens
  
  rthellend
  and
  claude
  committed
  0f5dc01
- Compare OIDC client secrets in constant time
  
  rthellend
  and
  claude
  committed
  143e323
- Check redirect_uri and PKCE at the OIDC token endpoint
  
  rthellend
  and
  claude
  committed
  0489863
- Mark email_verified finding as declined
  
  rthellend
  and
  claude
  committed
  565384a
- Check the WebAuthn signature counter
  
  rthellend
  and
  claude
  committed
  46af659
- Close connections when their client cert is revoked
  
  rthellend
  and
  claude
  committed
  2355c29
- Reject DSA keys in the SSH CA
  
  rthellend
  and
  claude
  committed
  f2ed292
- Don't hold the SSH CA lock while reading requests
  
  rthellend
  and
  claude
  committed
  0c5b828
- Verify OCSP responses against the verified chain in tlsclient
  
  rthellend
  and
  claude
  committed
  20dfef2
- Warn when the passphrase is passed on the command line
  
  rthellend
  and
  claude
  committed
  194c18b
- Quote client-provided SNI and ALPN in QUIC logs
  
  rthellend
  and
  claude
  committed
  1887023
- Limit connection-level resource use
  
  rthellend
  and
  claude
  committed
  74d4aed
- Mark MemProfileRate finding as declined
  
  rthellend
  and
  claude
  committed
  5a00413
- Fix data race on the ECH keys
  
  rthellend
  and
  claude
  committed
  791ebc5
- Don't overwrite the request in the OIDC callback handler
  
  rthellend
  and
  claude
  committed
  8567966
- Redact more secrets from the metrics page config
  
  rthellend
  and
  claude
  committed
  97061f9
- Only send the CSRF token to the same origin in proxy.mjs
  
  rthellend
  and
  claude
  committed
  1251ba0
- Don't match group names against emails in ACLs
  
  rthellend
  and
  claude
  committed
  d382785
- Mark OCSP delegate IsCA finding as not needing a change
  
  rthellend
  and
  claude
  committed
  e4e791d
- Mark PKI owner=all finding as declined
  
  rthellend
  and
  claude
  committed
  4e6783e
- Bound the ephemeral certificate manager's cost per name
  
  rthellend
  and
  claude
  committed
  ff8fdbb
- Don't let backends set the proxy's cookies
  
  rthellend
  and
  claude
  committed
  e62ea25
- Remove the security review TODO list
  
  rthellend
  and
  claude
  committed
  445c659
- Add release notes for the security fixes
  
  rthellend
  and
  claude
  committed
  3d6ddbb
- Fix the remaining data race on the ECH keys
  
  rthellend
  and
  claude
  committed
  aa43f6e
- Don't charge the forward rate limit twice for QUIC streams
  
  rthellend
  and
  claude
  committed
  5020b84
- Undo certmanager optimization
  rthellend
  committed
  e412f2d
- Change urltoken exp to a week
  rthellend
  committed
  f4db193
- Fix X-Forwarded-For and X-Forwarded-Client-Cert header overrides
  rthellend
  committed
  9613fae
- Make the certmanager cache size settable for tests
  
  rthellend
  and
  claude
  committed
  6a45c0c
- Address review findings
  
  rthellend
  and
  claude
  committed
  c297760
- Use "next" placeholder for changelog
  rthellend
  committed
  86ba943

Commits

Commits on Oct 7, 2026