Phalcode/gamevault-backend 17.2.0

Version 17.2.0

on GitHub

Changes

• Login errors no longer reveal whether a username exists, and both cases take the same amount of time.
• Failed password logins are now rate limited per client address and username (AUTH_RATE_LIMIT_ENABLED, AUTH_RATE_LIMIT_MAX_ATTEMPTS, AUTH_RATE_LIMIT_WINDOW_SECONDS). Successful logins, token refreshes and SSO logins are not affected.
• Password hashes now use bcrypt cost 12 and existing hashes are upgraded on the next successful login.
• The OAuth2 client secret and the default archive password are no longer included in the startup log.
• GET /api/auth/sessions no longer returns the stored refresh token hash.
• Rejected bearer tokens now return a WWW-Authenticate header, and token responses are marked as non-cacheable.
• OAuth2 callback sessions now use SameSite=Lax, HttpOnly and Secure on HTTPS, and expire after 24 hours instead of living in memory until a restart.
• Fixed OAuth2/SSO login in the legacy desktop client (1.17.x): the callback page no longer leaves the login window hanging, so the client picks up its new session again. The web UI and the new desktop app keep using the validated return address.
• Fixed the server-wide download bandwidth limit (SERVER_MAX_DOWNLOAD_BANDWIDTH_IN_KBPS) having no effect: the configured value was converted to bytes twice, and clients that did not send their own limit bypassed it entirely. The server value is now enforced as a cap that clients can only lower.
• OIDC id_tokens can be verified against the identity provider's JWKS (AUTH_OAUTH2_ISSUER_URL, AUTH_OAUTH2_JWKS_URL, AUTH_OAUTH2_VERIFY_ID_TOKEN, AUTH_OAUTH2_REQUIRE_NONCE). Disabled by default.
• Access tokens can be bound to their session (AUTH_ACCESS_TOKEN_SESSION_BINDING_ENABLED), so revoking a session also revokes its access tokens. Disabled by default.
• The served Web UI can send a Content-Security-Policy (WEB_UI_CSP_MODE). Disabled by default.
• The server can now send anonymous usage reports (ANALYTICS_ENABLED, on by default) to help prioritise work: startup and snapshot statistics, aggregated request counts, downloads, registrations, progress updates, savefile usage and sampled server errors with cleaned messages. No user names, ids, IPs, game titles or file paths are sent. The reports go to the first reachable collector from ANALYTICS_ENDPOINTS. You can turn it off with ANALYTICS_ENABLED=false.
• The served Web UI now always uses the newest stable release of the server's major version, so a new Web UI feature no longer waits for a server release. When GitHub cannot be reached or no matching release exists, the server keeps the build it already cached instead of switching to the unstable development build. Pre-release builds are opt-in with WEB_UI_VERSION=unstable or WEB_UI_VERSION=early-access, and any other value pins an exact release.