fuomag9/caddy-proxy-manager v1.6

on GitHub

Highlights

• Strip client-supplied X-CPM-* forward-auth headers before proxying upstream.
• Make mTLS trust handling fail closed when configured certificates, roles, or CAs resolve to no active trust anchors.
• Gate OAuth registration behind AUTH_ALLOW_OAUTH_REGISTRATION and enforce safe role/status defaults for OAuth-created users by default.
• Add active session management for listing and revoking sessions from the profile page.
• Add anti-clickjacking and content-type security headers to public pages.
• Isolate the Docker socket proxy and L4 port manager on an internal network.

Configuration

• Set AUTH_ALLOW_OAUTH_REGISTRATION=true to allow new users to register through OAuth.
• Set AUTH_ALLOW_OAUTH_ROLE_FROM_CLAIMS=true to allow OAuth claims to provide role/status instead of enforcing safe defaults.

Review and update your Docker Compose and environment configuration from this release.

Changes

• ba795f8 Update development dependencies
• f96cf87 Update production dependencies
• 8f97f6e Disallow self registration by default
• 3257b8d Strip inbound forward-auth headers and make mTLS fail closed
• 3ae17c4 Force safe role/status defaults for OAuth-created users
• a4eba25 Gate OAuth signup, fix mTLS CA fallback, and isolate socket proxy
• 1bd877c Add active session management and public-page security headers
• 756a5aa Fix unauthenticated OAuth/session end-to-end test state
• 928fc46 Add opt-out for OAuth role/status enforcement

Full Changelog: v1.5.1...v1.6