Skip to content
ArchForge
☰ Menu
Sign up
archadmin/archforge-external-statuspublic

Repository files, collaboration, releases and project activity.

◫ Insights
More
MilestonesCommitsWikiDiscussionsProjectsActivityCODEOWNERSArch LinuxInsights
archforge-external-status / CHANGELOG-1.0.5.mdmain
↓ Download raw⑂ Commit Blame◷ File history
▤ CHANGELOG-1.0.5.md993 bytes

ArchForge External Status 1.0.5 — Admin Origin Hotfix

  • Fix /admin/login returning 403 Invalid origin before checking credentials, including default HTTPS port normalization and canonical host casing.
  • Keep strict operator-configured public origin; do not blindly trust Host, X-Forwarded-Host, or arbitrary external origins.
  • Check both Origin and Referer where provided. Reject HTTP downgrade and foreign domains.
  • Preserve CSRF validation, Secure/SameSite cookies, password hashing and TOTP 2FA.
  • Add root-only Git recovery command bash ./fix-admin-origin.sh to synchronize STATUS_PUBLIC_URL with the configured Caddy site for status.archforge.nl and deploy safely.
  • Configuration backup, existing database backup and code rollback via deployed release mechanism.
  • Regression tests for same-origin logins behind Caddy, normal port normalization, rejected foreign origins and still-enforced CSRF.

No changes to VPS 1 / ArchForge 11.3.6, no database reset.