github greenpau/caddy-security v1.5.0
on GitHub

4 hours ago

caddy-security v1.5.0 adds opt-in backend companions, shared Consul storage, durable SQLite integrations, stronger authorization controls, and new portal capabilities. Compared with v1.4.1, it upgrades go-authcrunch from v1.3.11 to v1.4.1, incorporating changes from both upstream v1.4.0 and v1.4.1.

Upgrade notes

All 17 companions under plugins/ require explicit selection. Importing github.com/greenpau/caddy-security, including through the default authcrunch command, registers the core security integrations. Add each companion your configuration uses through its own xcaddy --with argument, pinned to the same version as the core module. For example, to include SQLite password identities: 

xcaddy build \
  --with github.com/greenpau/caddy-security@v1.5.0 \
  --with github.com/greenpau/caddy-security/plugins/identity-stores-sqlite@v1.5.0

Go integrations must import concrete companion configuration types from the companion package. Shared factory and runtime contracts live in pkg/plugin. See the opt-in companion migration.

Storage and backend companions

  • SQLite backends: password accounts and offline administration, API-key issuance and revocation, secret snapshots, durable messaging outboxes with bounded SMTP workers, email-confirmed signup, and browser-bound single-use sign-in tickets. These integrations use pure-Go SQLite. Signup requires explicit portal selection; ticket issuance remains a trusted application operation. See the Caddy identity integration, registration integration, AuthCrunch SQLite accounts, AuthCrunch enrollment, and upstream bounded SMTP delivery.
  • Pending OAuth/OIDC login storage: named SQLite and Consul stores preserve pending state, nonce and PKCE evidence with single-use consumption. The Consul backend lets a callback recover a login started on another replica when the provider selects the shared store and deployment namespace. This partially addresses caddy-security #508; the remaining state-sharing limits are described below. Caddy integration, AuthCrunch storage contract.
  • Managed refresh storage: named SQLite and Consul backends persist refresh families, rotation and replay history. Root generation checks retire obsolete credentials; uncertain commits require recovery rather than blind retries. Caddy integration, AuthCrunch generation handling.

The six Consul companions are:

  • plugins/oauth-login-storage-consul
  • plugins/identity-stores-consul
  • plugins/identity-providers-consul — trusted application ticket login
  • plugins/session-and-refresh-storage-consul
  • plugins/credential-authenticators-consul — API-key authentication
  • plugins/secrets-consul

Build with each required companion and github.com/pteich/caddy-tlsconsul. The companions reuse that storage module's client, prefix and AES key. Configure global storage consul and explicitly select the corresponding security backends. API-key revocation uses fresh shared reads; secret changes are adopted through snapshots on successful configuration reload. Consul identity, ticket and refresh integration, Consul credentials and secrets integration.

Consul does not yet make every portal state interchangeable across hosts. Managed refresh still requires exclusive root state and supports same-root restart; independently running roots cannot share refresh authority simply by selecting the same backend. Portal sessions, sandbox/MFA checkpoints, cross-device state, downstream OIDC grants and direct-policy sessions retain separate state owners. Provider account attachments still target root-owned local stores. Keep affinity where these flows require it.

Authorization and signing

Authentication and portal experience

Fixes and maintenance

Full changes

Full changes

Changelog

  • d894fca app: add Consul credential authentication and secrets companions
  • 0da95fc app: add Consul identity, ticket and refresh storage companions
  • 70b8505 app: establish backend module ownership and policy bindings
  • 225a6e4 app: make backend companion plugins opt-in
  • 855123c authenticate: add encrypted Documents API integration
  • 4ef25e4 authenticate: add named SQLite refresh storage and recovery coverage
  • 18ad726 authenticate: resolve provider renewal modes and qualify snapshot sessions
  • 55306d7 authenticate: validate and enforce explicit portal mounts
  • c210ac5 authn: integrate selected access signers and strict token profiles
  • b813e7a authorize: add SQLite API-key authentication and private provisioning
  • 6961718 authorize: add required HTTP JSON external authorization
  • ecaa9ce authorize: add static claims enrichment for policy ACLs
  • 8727db1 authorize: prevent reload deadlocks with downstream streams
  • 1487141 identity: add SQLite password stores and offline account administration
  • 4175025 identity: integrate connected accounts and explicit local attachments
  • 556920b identity: integrate trusted SQLite ticket login
  • 4ccdac1 local: administer automatically provisioned attached accounts
  • dbd4ac0 messaging: add SQLite outboxes and bounded SMTP delivery workers
  • 3b11ca2 oauth: add shared login transaction storage
  • 543554b oauth: share pending login transactions through Caddy's Consul storage
  • 132b2ec refactor: extract backend companions with category-specific contracts and tests
  • aa24efb registration: add durable SQLite signup with explicit portal selection
  • a1eefcc secrets: add SQLite snapshots and private record provisioning
  • af4937d skills: clarify commit evidence and refresh storage limits
  • 598d6e6 ui: enforce language arity and verify localized portal flows

go-authcrunch changes

github.com/greenpau/go-authcrunch was updated from v1.3.11 to v1.4.1.

Compare: greenpau/go-authcrunch@v1.3.11...v1.4.1

  • skills: document plugin architecture and scaffold category directories (8db9874)
  • github: select affected tests before full CI and add make change-test (55fcd1c)
  • authz: add request-time claims enrichment and static plugin (5709a9f)
  • kms: add local PS256 signing plugin and strict verification (09f20b5)
  • @rhurling has signed the CLA in greenpau/go-authcrunch#118 (5ebcf61)
  • authz: add HTTP JSON external authorization and runtime enforcement (f134835)
  • authn: add pure-Go SQLite refresh storage plugin (80177a8)
  • feat: add pure-Go SQLite secrets plugin (89ec472)
  • authproxy: add SQLite API keys and fresh credential verification (92d5439)
  • ids: add SQLite password accounts with transactional portal issuance (7831893)
  • messaging: add durable SQLite outbox and runtime provider bindings (663a52e)
  • registry: add recoverable SQLite email-confirmed registration (7b558ae)
  • idp: add browser-bound SQLite sign-in tickets (9cd11c4)
  • fix: harden plugin validation, expiry and claims attachment (1d373e4)
  • github: raise test budgets and parallelize full CI validation (8745bce)
  • github: split portal and other tests into eight parallel CI jobs (8a5015d)
  • feat: add validated OpenAPI contracts, Scalar reference, and CI exports (57d7bb7)
  • skills: synchronize test workflows and CLI documentation (c2fd707)
  • tests: handle Make startup output in OpenAPI E2E (c9779b9)
  • security: Improve authentication event logging (#116) (d813a28)
  • ops: refresh OpenAPI source review after authentication logging changes (cd33d5c)
  • ui: improve cross-device sign-in layout and accessibility (6be56a6)
  • authn: localize portal and OIDC browser flows (2a6baa3)
  • tests: expose login redirect path escapes and cross-tab destination races (cc286d6)
  • authn: return each browser tab to its own page after login (e0b85a5)
  • authn: isolate login destinations across authentication flows (db2ca1f)
  • authn: guard route ownership and reserved portal mounts (4897d53)
  • authn: add explicit OAuth/OIDC provider snapshot renewal (907403a)
  • security: remediate CodeQL credential logging and hashing alerts (1d8490f)
  • authn: add opt-in end-to-end encrypted Documents API (761890b)
  • authn: attach external logins to local identities (2e0eaef)
  • oauth: add shared login transaction storage (0342435)
  • skills: document Actions retention and historical cleanup (2dcfc32)
  • ops: released v1.4.0 (e22638c)
  • config: accept caller-owned identity stores in root assembly (55ca7fe)
  • messaging: support bounded SMTP delivery for durable outbox workers (20480df)
  • registry: bind caller-owned signup workflows through the root (749cc21)
  • idp: bind caller-owned identity providers into the root runtime (576aabf)
  • authn: attribute checkpoint events to their portal and canonical realm (902df77)
  • authn: isolate pending browser login proofs by sandbox (971eaff)
  • authn: add explicit portal mounts and shared route validation (5f4b443)
  • authn: omit raw provider identities from login diagnostics (0b30d37)
  • authn: align Documents mounts with portal route contracts (36e3d14)
  • config: bind external providers to local account stores and recheck credentials (c8d2565)
  • kms: bind selected access signers to strict portal and policy profiles (4f293ad)
  • authn: activate durable refresh stores with transactional generation checks (91318f9)
  • ops: qualify patched Go builds and HTTP/2 dependencies (6ca6de6)
  • breakfix: fix fresh-login test and add checks for external configuration collections (7a2f058)
  • breakfix: fix SQLite ticket concurrency bug (fec0f8d)
  • bugfix: fix SQLite locking bug with blocking behavior (de64297)
  • test: increase TEST_WALL_TIMEOUT (ad5d98e)
  • ops: released v1.4.1 (7390ece)
Check out latest releases or
releases around greenpau/caddy-security v1.5.0

Don't miss a new caddy-security release

NewReleases is sending notifications on new releases.

Get notifications