Release v1.28.0

This release focuses on Security Hardening following a comprehensive security audit. It implements several critical improvements to session management, authentication verification, and data protection.

Security Improvements

• Cookie Hardening:
  • Enforced Secure flag for all session and authentication cookies when GIN_MODE is not set to debug. This ensures sensitive cookies are only transmitted over encrypted connections.
  • Implemented global SameSite=Lax middleware for all session and OIDC state cookies to mitigate Cross-Site Request Forgery (CSRF) attacks.
• TLS Verification:
  • Removed support for insecure TLS verification bypasses (OIDC_SKIP_TLS_VERIFY and LDAP_SKIP_TLS_VERIFY). The server now always validates certificates for OIDC providers and LDAP servers.
• Access Control:
  • Restricted asset deletion (DELETE /assets/:machine_id) to the adminGroup, ensuring only authenticated administrators can remove data.
• Information Disclosure Prevention:
  • All /v1/ API endpoints now return generic error messages to clients, preventing internal database schema or logic details from leaking.
  • Credential masking in the administration interface now uses a fixed-length string (********), preventing the disclosure of sensitive value lengths.
• Health Check Optimization:
  • The health check endpoint now reuses the application's main database connection pool instead of opening separate connections, improving stability.
• Login Fix:
  • Fixed an issue where the /login handler would optimistically redirect users based on cookie presence without proper session validation.

Full Changelog: v1.27.0...v1.28.0