v1.0.39 — Path ACL precedence and safer path validation

Fixes issue #35: a client allowed by a specific path ACL can now reach that path even when the root ACL would deny it.

Review existing ACL policies before upgrading

This changes access-control behavior for existing sites. Previously, requests had to pass every matching ACL. Now the most specific matching path selects the ACL; the blank or / rule is the fallback. For example, /admin/reports overrides /admin, which overrides /. An allow-all path policy also overrides a restrictive root policy.

Review every path ACL that relied on inherited root or parent restrictions. Put required restrictions into that path's policy. ACL includes merge IP entries using most-specific-IP matching and deny-on-ties; they do not reproduce an intersection of independent policies. No database migration converts cumulative policies automatically.

Passing the selected ACL continues through existing authentication, method checks, rate limiting, WAF processing and proxy handling. Existing explicit trusted-IP bypass behavior is unchanged.

Path matching remains case-insensitive and respects segment boundaries. Legacy case-equivalent attachments retain all their restrictions; new duplicates are rejected. Ambiguous requests are checked on the decoded path before dot-segment cleanup, including on WebSocket and detection-only routes. Intermediate semicolon parameters, such as /app;tenant=one/admin, receive HTTP 400 on sites with path ACLs and cannot be saved as new attachment prefixes. Review any existing attachments using that form. Terminal parameters such as /admin;session=1 remain supported.

Images and upgrade

Production images target linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.39
• ghcr.io/socfortress/waf-admin-api:1.0.39
• ghcr.io/socfortress/waf-admin-ui:1.0.39

Back up the database, configuration and deployment settings, review the ACL changes above, and schedule a maintenance window. Preserve project names, volumes, mounts and local Compose overrides. Installations older than v1.0.37 must follow its CRS management prerequisites. Existing experimental NTLM limitations still apply.

Update the deployment files with git pull --ff-only, preserving customizations, and set these values together in .env:

WAF_IMAGE_TAG=1.0.39
CRS_CADDY_DIGEST=sha256:9a5771b8ca8b9a504f2ca1a522d8644b295b5d44ff151d75c7724281d9a41ab8

The digest takes precedence over the tag. Both production Caddy and the CRS validator must use the matching digest. Verify docker compose config, stop configuration edits, then upgrade the services together:

docker compose pull
docker compose stop admin-ui admin-api caddy-waf waf-sandbox
docker compose up -d --wait postgres redis http-echo caddy-waf waf-sandbox
docker compose up -d --wait admin-api admin-ui
docker compose ps

There is no new schema migration in this release. Confirm startup synchronization and test allowed and denied clients on root, parent and child paths. Changing backend code alone does not rewrite a running Caddy configuration until configuration synchronization/reload occurs.

Validation

Both independent-review findings were fixed and re-reviewed with no remaining blockers. After the fixes, 95 targeted ACL/Caddy tests and 111 real-Caddy checks passed. During implementation, 100 frontend tests and the frontend production build also passed.

The Caddy fixture covers nested and allow-all overrides, IPv4/IPv6, normalized paths, ambiguous components erased by dot-segment cleanup, authentication, method exceptions, WebSocket and detection-only paths, rate limits and GeoIP. Ambiguous requests must return 400 without reaching auth or upstream services. Tests use a controlled HTTP backend; IIS-specific path normalization was not tested against IIS.

Images are built from merged source a0be287b72f2488d6e70c6001c897972336bd8b8. See publication verification for image digests, revisions and platforms.

Rollback

Restore a consistent pre-upgrade database/configuration backup and matching image versions if reverting. Review ACL changes made since upgrading: the older API regenerates cumulative rules, while the new API generates path overrides. Changing only the Caddy image does not restore the previous ACL policy. Preserve matching Caddy/validator pins and the existing CRS recovery prerequisites.

This release does not deploy changes to the lab or production servers.