github polterguy/magic v9.3.5
Tightening security

latest releases: v17.3.9, v17.3.8, v17.3.7...
3 years ago

This release allows you to manually provide a JWT token during setup. By default it will use some CSRNG gibberish, but you can manually override it, and provide manual seeds. This is important first of all to more easily allow for updating your Magic installation without throwing out existing users due to JWT parsing failures - However, more important, the JWT/auth secret is also used to seed the CSRNG Magic is using, or rather to add to its existing seed, both during setup and during restarts. This increases entropy in the internal CSRNG algorithm Magic is using as it is generating cryptography key pairs, session keys for crypto operations, etc - And hence is actually a significant tightening of the internal cryptographic operations within Magic's core, providing far better entropy for all cryptographic operations.

In addition the frontend is now built through its Docker images much more optimised, having turned on AOT, and other settings, that should result in smaller size, and faster execution speeds, etc.

Other changes includes more easily allowing for setting SMTP settings during pipeline builds, due to placeholders in the default "appsettings.json" file. Trapping JSON parsing exceptions in the "Endpoints" menu item if you invoke a payload endpoint, and you've got an error in your JSON syntax. Etc, etc, etc.

Don't miss a new magic release

NewReleases is sending notifications on new releases.