v1.0.38 — Experimental NTLM upstream compatibility

This release addresses issue #33 with an experimental, off-by-default per-site NTLM upstream compatibility setting. Caddy now includes http.reverse_proxy.transport.http_ntlm; enable the setting in a site's Backend section when the application handles Windows authentication.

Each downstream connection gets a private upstream transport from its first request, including anonymous requests and authentication headers with unusual formatting. After upstream loss, a private transport can reconnect and the backend can challenge the client again. Existing Host, TLS server-name and CA controls remain available, and the setting does not create a WAF bypass.

Supported scope and limits

Use direct HTTP/1.1 clients and a single backend. NTLM hostnames advertise HTTP/1.1 over TLS; other HTTP versions and known forwarded/proxy connections are rejected. Backend pools, forward auth, JWT and API-key authentication cannot be combined with this option. A proxy that removes all forwarding evidence cannot be detected and is unsupported.

Windows/IIS browser SSO, Kerberos, Extended Protection/channel binding and production capacity remain unverified. The tests use real NTLM messages with a controlled pyspnego backend and independent clients; this is not Windows/IIS certification. Please test against your application and share results on issue #33. Do not weaken upstream TLS or authentication policy to make a test pass.

See the operator guide.

Images and upgrade

Production images target linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.38
• ghcr.io/socfortress/waf-admin-api:1.0.38
• ghcr.io/socfortress/waf-admin-ui:1.0.38

Caddy remains 2.11.4, coraza-caddy 2.6.2 and Coraza 3.8.1. Use these values together in .env:

WAF_IMAGE_TAG=1.0.38
CRS_CADDY_DIGEST=sha256:fae1bcdba35dacd7c7a572653308341dcfb5aa2511a4766adea623339093106f

A digest pin takes precedence over a tag. Update production Caddy and the CRS validator to the same digest. Preserve your project name, persistent volumes, bind mounts and port overrides. Back up your database and configuration before upgrading. Installations older than v1.0.37 must first follow the CRS management upgrade prerequisites, including confirmed-boot storage and the matching sandbox.

Update deployment files with git pull --ff-only, preserving local customizations, set the values above, and verify the resolved configuration with docker compose config. Schedule a maintenance window and stop configuration edits:

docker compose pull
docker compose stop admin-ui admin-api caddy-waf waf-sandbox
docker compose up -d --wait postgres redis http-echo caddy-waf waf-sandbox
docker compose up -d --wait admin-api admin-ui
docker compose ps
docker exec caddy-waf caddy list-modules | grep http_ntlm

The API applies migration 0041_upstream_ntlm; existing sites default to NTLM disabled. Confirm startup synchronization and existing sites before enabling this option on a test site. Upgrade API, UI, Caddy and validator together.

Validation

Independent review findings were fixed and re-reviewed with no remaining blockers. After the fixes, 61 targeted backend tests and 12 frontend tests passed, along with the Caddy build and Go transport race tests. Earlier full-suite validation passed 557 backend tests, 100 frontend tests and the frontend production build.

Real NTLM integration covers 32 isolated concurrent sessions, valid/invalid/anonymous authentication, TLS trust/name checks, WAF GET/POST blocking, NTLM ALPN, ordinary-site HTTP/2 retention, actual HTTP/2 rejection and proxy guards. New regressions reproduce identity inheritance with tolerant authentication parsing on the pre-fix image and pass on the fixed image. A persistent downstream socket successfully reauthenticates after upstream close and idle expiry over both HTTP and HTTPS upstreams.

All three production images built and published successfully from merged source 63759ffc713044998f1445769305204d4126a8fe. Anonymous registry checks verified linux/amd64, version 1.0.38, the source revision and matching latest/1.0 aliases. Publication evidence.

The exact published Caddy digest exposes http.reverse_proxy.transport.http_ntlm and passed the complete NTLM fixture, including the persistent-client regressions and generated platform routes. This ran the production linux/amd64 image under emulation on a Mac with native fixture clients; it was not a Windows/IIS test or a lab deployment. Runtime results. The public Compose example resolves production Caddy and the validator to the same verified digest.

Rollback

Before reverting Caddy to an image without NTLM support, disable affected sites and confirm that configuration is applied. Ordinary shared HTTP pooling is unsuitable for NTLM applications. Preserve a consistent pre-upgrade database/configuration backup and restore matching platform images and state if reverting the platform; do not simply downgrade Caddy while a saved configuration still references http_ntlm.

Publishing this release does not deploy it to a lab or production server.