vavallee/bindery v1.1.1

v1.1.1 — Security

on GitHub

Security

• API key exposed to non-admin users — GET /api/v1/auth/config returned the global API key to every authenticated account. Since the key is also accepted via the ?apikey= query string, any regular user could authenticate with full API access. The key is now redacted unless the caller has role=admin.
• Cross-user author visibility — GET /api/v1/author returned all authors regardless of owner_user_id, letting one user see (and enumerate) another user's library. The list is now scoped to the authenticated user.
• Non-admin auth-mode escalation — PUT /api/v1/auth/mode lacked a RequireAdmin guard. A regular user could switch the instance to local-only, granting unauthenticated access to every client on the local network. The endpoint now requires admin role.
• Untrusted X-Forwarded-* header injection — X-Forwarded-Proto and X-Forwarded-Host were accepted from any client when BINDERY_TRUSTED_PROXY was not set, enabling OPDS base-URL injection and spurious HSTS headers. All forwarded headers are now stripped from requests that do not originate from a configured trusted proxy.