Files

T

me0nline 42916dc8ee

CI Test Suite / Run Component Tests & Pipeline Verification (push) Successful in 1m35s

Details

Release Binaries & Packages / Build & Release Standalone Binaries (Linux & Windows Cross-Compilation) (push) Canceled after 1m4s

Details

2026-09-25 23:55:05 +02:00

LOGAR Release v3.0.1

Mandatory Admin Authentication: Enforced strict administrator authentication across all fleet management endpoints (/api/clients, /api/clients/approve, /api/clients/revoke, /api/clients/delete, /api/client/export-profile) and license management APIs.
Brute-Force Mitigation & Rate Limiting: Implemented thread-safe sliding-window IP rate limiting on /login (10 attempts/min) and /api/client/enroll (15 attempts/min) with progressive delays and HTTP 429 throttling.
Cookie Security Flags: Session cookies now enforce HttpOnly=True, SameSite="Lax", and dynamic Secure=True for HTTPS connections and reverse-proxy deployments (X-Forwarded-Proto).
Cryptographic Random Secrets: Server Hub and License Authority session secrets are now generated with 256-bit CSPRNG (secrets.token_hex(32)) on initialization.
License Renewal Validation: Hardened /api/license/renew with explicit PEM structure and database validation, preventing unhandled exceptions.

FastAPI Lifespan Handlers: Migrated legacy startup events to modern ASGI lifespan context managers.
OpenPGP Compression Preferences: Aligned Server public key compression algorithms (ZIP, ZLIB, BZ2, Uncompressed) with client preferences.
Cross-Platform Compilation: Unified automated packaging for standalone Windows and Linux binaries.