Yeraze/meshmonitor v2.0.1

v2.0.1 - Cookie Security & Reverse Proxy Support

on GitHub

🔐 Cookie Security & Reverse Proxy Support

Version 2.0.1 adds configurable cookie security settings and proper reverse proxy support, fixing login issues for users behind HTTPS proxies or accessing over HTTP.

✨ New Features

Cookie Security Configuration

• COOKIE_SECURE environment variable to override secure cookie requirement

  • Default: true in production, false in development
  • Set to false for direct HTTP access (not recommended)
  • Includes warning when disabled in production

• COOKIE_SAMESITE environment variable to customize SameSite policy

  • Default: strict in production, lax in development
  • Supports: strict, lax, none

Reverse Proxy Support ⭐ Recommended

• TRUST_PROXY configuration for HTTPS reverse proxy deployments
  • Automatically defaults to 1 (trust first proxy) in production
  • Supports custom configurations: true, false, number of hops, IP/CIDR
  • Allows MeshMonitor to detect HTTPS via X-Forwarded-Proto header
  • More secure than disabling secure cookies

🐛 Bug Fixes

• Fixed login issues behind reverse proxies (#153)
  • Users experienced successful authentication but no persistent session
  • Session cookies now work correctly with HTTPS reverse proxies
  • Proper handling of X-Forwarded-* headers

📚 Documentation

• Comprehensive troubleshooting guide for login/session issues
• Three deployment scenarios with clear configuration guidance:
  • Scenario A: HTTPS Reverse Proxy (use TRUST_PROXY=true)
  • Scenario B: Direct HTTP Access (use COOKIE_SECURE=false)
  • Scenario C: Direct HTTPS Access (no config needed)
• Reverse proxy examples for nginx, Traefik, and Caddy
• Diagnostic steps for cookie-related issues
• Updated environment variable documentation

🔧 Configuration Examples

For HTTPS Reverse Proxy (Recommended)

environment:
  - NODE_ENV=production
  - TRUST_PROXY=true
  - SESSION_SECRET=your-secret-here

For Direct HTTP Access (Not Recommended)

environment:
  - NODE_ENV=production
  - COOKIE_SECURE=false
  - SESSION_SECRET=your-secret-here

📦 Deployment

Docker:

docker pull ghcr.io/yeraze/meshmonitor:2.0.1
# or
docker pull ghcr.io/yeraze/meshmonitor:latest

Helm:

helm upgrade meshmonitor ./helm/meshmonitor --version 2.0.1

🔗 Related Issues

• Fixes #153 - Login succeeds but immediately logs out
• Includes #155 - TZ environment variable documentation

📋 Full Changelog

v2.0.0...v2.0.1

🤖 This release was created with Claude Code

🚀 MeshMonitor v2.0.1

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:v2.0.1

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.