Linus Rath 5622eca36b fix: refuse a used impersonation link after a restart or on another replica ...

Used impersonation token ids were only remembered in process memory, so
a captured handoff link could be redeemed a second time within its five
minute lifetime once the process restarted, or on another replica. Each
used id now also leaves a marker file in the state directory, created
exclusively, which every replica sharing the state volume sees; markers
are pruned once the token could no longer verify.

The absolute session limit comes from the eight-hour app password that
Stalwart itself expires.

2026-09-26 16:34:58 +02:00

..

impersonate

fix: refuse a used impersonation link after a restart or on another replica

2026-09-26 16:34:58 +02:00

oauth/metadata

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

pair

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

reauth/sso/complete

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

session

fix: keep the Stalwart master password out of impersonated sessions

2026-09-26 14:05:05 +02:00

sso

fix: leave out the id token when sign-in cookies would overflow nginx's header buffer #1096

2026-09-24 18:23:11 +02:00

stalwart-context

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

token

fix: never follow redirects on OAuth token and revocation requests

2026-09-26 15:13:41 +02:00

totp-token-exchange

fix: stop reflecting a user-chosen server's error body from the TOTP login

2026-09-26 15:08:35 +02:00

verify

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00