Yeraze/meshmonitor v2.4.4

on GitHub

🔒 Security Enhancements

CSRF Token Improvements

• Automatic Retry Mechanism: Frontend now automatically refreshes CSRF tokens and retries requests when encountering 403 CSRF errors
• Validation: Retry logic validates error messages to ensure only genuine CSRF errors trigger token refresh
• App.tsx Enhancement: Added intelligent retry to authFetch() matching API service behavior

HSTS Configuration Fix

• HTTP Support: Fixed HSTS (HTTP Strict Transport Security) headers to respect COOKIE_SECURE environment variable
• Issue: Server was forcing HTTPS upgrades even when COOKIE_SECURE=false was set
• Solution: HSTS now only enabled when both NODE_ENV=production AND COOKIE_SECURE !== 'false'
• Impact: Allows intentional HTTP-only deployments without browser HTTPS enforcement

📖 Documentation

NODE_ENV Clarification

• Fixed: Clarified that NODE_ENV defaults to development when not specified
• Update: Getting Started guide troubleshooting section now correctly states development is the default mode
• Previous: Incorrectly suggested NODE_ENV=development needed to be explicitly set

🛠️ Technical Details

Files Changed

• src/App.tsx: Added CSRF retry logic with validation
• src/server/server.ts: HSTS configuration respects COOKIE_SECURE setting
• docs/getting-started.md: Documentation accuracy improvements
• package.json & helm/meshmonitor/Chart.yaml: Version bump to 2.4.4

Related PRs

• #189: Implement CSRF retry mechanism with validation
• #188: Comprehensive CSRF protection implementation

🚀 Upgrading

Pull the latest image:
```bash
docker compose pull
docker compose up -d
```

Or for specific version:
```yaml
image: ghcr.io/yeraze/meshmonitor:v2.4.4
```

Full Changelog: v2.4.3...v2.4.4

🚀 MeshMonitor v2.4.4

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:v2.4.4

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.