Repository files, collaboration, releases and project activity.
ARCHFORGE HISTORY
Blame · CHANGELOG-1.0.5.md
Branch main · the Commit author is not necessarily a verified ArchForge account.
b0c4351f2earchadmin2026-10-11
1 # ArchForge External Status 1.0.5 — Admin Origin Hotfixb0c4351f2earchadmin2026-10-11
2 b0c4351f2earchadmin2026-10-11
3 - Fix `/admin/login` returning **403 Invalid origin** before checking credentials, including default HTTPS port normalization and canonical host casing.b0c4351f2earchadmin2026-10-11
4 - Keep strict operator-configured public origin; do **not** blindly trust `Host`, `X-Forwarded-Host`, or arbitrary external origins.b0c4351f2earchadmin2026-10-11
5 - Check both Origin and Referer where provided. Reject HTTP downgrade and foreign domains.b0c4351f2earchadmin2026-10-11
6 - Preserve CSRF validation, Secure/SameSite cookies, password hashing and TOTP 2FA.b0c4351f2earchadmin2026-10-11
7 - Add root-only Git recovery command `bash ./fix-admin-origin.sh` to synchronize `STATUS_PUBLIC_URL` with the configured Caddy site for `status.archforge.nl` and deploy safely.b0c4351f2earchadmin2026-10-11
8 - Configuration backup, existing database backup and code rollback via deployed release mechanism.b0c4351f2earchadmin2026-10-11
9 - Regression tests for same-origin logins behind Caddy, normal port normalization, rejected foreign origins and still-enforced CSRF.b0c4351f2earchadmin2026-10-11
10 b0c4351f2earchadmin2026-10-11
11 **No changes to VPS 1 / ArchForge 11.3.6, no database reset.**