44 lines
2.3 KiB
Markdown
44 lines
2.3 KiB
Markdown
# AOC v1.7.12 Release Notes
|
|
|
|
**Release Date:** 2026-04-27
|
|
|
|
## Security Hardening (Penetration Test Remediation)
|
|
|
|
This release addresses all findings from the internal soft penetration test of v1.7.11.
|
|
|
|
### Critical Fix: CORS Credentials Leak
|
|
- **Issue:** When `AUTH_ENABLED=true` and `CORS_ORIGINS="*"`, the CORS middleware reflected any origin with `Access-Control-Allow-Credentials: true`, allowing cross-origin authenticated requests from attacker-controlled domains.
|
|
- **Fix:** When auth is enabled with a wildcard origin, `allow_credentials` is now forced to `False`. CORS still works for unauthenticated requests, but bearer tokens cannot be leaked cross-origin.
|
|
|
|
### High Fix: Missing Security Headers
|
|
- Added `X-Content-Type-Options: nosniff`
|
|
- Added `X-Frame-Options: DENY`
|
|
- Added `Referrer-Policy: strict-origin-when-cross-origin`
|
|
- Added `Permissions-Policy` restricting browser features (accelerometer, camera, geolocation, gyroscope, magnetometer, microphone, payment, USB)
|
|
|
|
### Medium Fixes
|
|
- **Rate limiter fail-closed:** Previously, a Redis outage silently disabled all rate limiting. The rate limiter now returns `429` when Redis is unreachable.
|
|
- **OpenAPI docs exposure:** `/docs`, `/redoc`, and `/openapi.json` are disabled by default. Set `DOCS_ENABLED=true` to re-enable (intended for development only).
|
|
|
|
### Low Fixes
|
|
- **Information disclosure:** `/api/config/auth` no longer leaks `tenant_id` and `client_id` when `auth_enabled=false`.
|
|
- **Webhook validation token:** Added length cap (1024 chars) and ASCII-only validation before echoing `validationToken`. Response now includes `X-Content-Type-Options: nosniff`.
|
|
|
|
## Files Changed
|
|
|
|
| File | Change |
|
|
|------|--------|
|
|
| `backend/main.py` | CORS fix, security headers middleware, conditional OpenAPI docs |
|
|
| `backend/config.py` | Added `DOCS_ENABLED` setting |
|
|
| `backend/rate_limiter.py` | Fail-closed on Redis errors |
|
|
| `backend/routes/config.py` | Hide tenant/client IDs when auth disabled |
|
|
| `backend/routes/webhooks.py` | Validate validationToken before echo |
|
|
| `backend/tests/conftest.py` | Enhanced FakeRedis mock with `incr`/`expire` |
|
|
| `.env.example` | Documented `DOCS_ENABLED` |
|
|
| `VERSION` | Bumped to 1.7.12 |
|
|
|
|
## Test Results
|
|
|
|
- **80/80 pytest tests passing**
|
|
- Penetration test report: `PEN_TEST_REPORT_v1.7.11.md`
|