# ArchForge External Status 1.0.5 — Admin Origin Hotfix

- Fix `/admin/login` returning **403 Invalid origin** before checking credentials, including default HTTPS port normalization and canonical host casing.
- Keep strict operator-configured public origin; do **not** blindly trust `Host`, `X-Forwarded-Host`, or arbitrary external origins.
- Check both Origin and Referer where provided. Reject HTTP downgrade and foreign domains.
- Preserve CSRF validation, Secure/SameSite cookies, password hashing and TOTP 2FA.
- Add root-only Git recovery command `bash ./fix-admin-origin.sh` to synchronize `STATUS_PUBLIC_URL` with the configured Caddy site for `status.archforge.nl` and deploy safely.
- Configuration backup, existing database backup and code rollback via deployed release mechanism.
- Regression tests for same-origin logins behind Caddy, normal port normalization, rejected foreign origins and still-enforced CSRF.

**No changes to VPS 1 / ArchForge 11.3.6, no database reset.**