Security / 安全修复
响应缓存可能把带凭据请求的响应提供给其他访客。 v0.6.5.2 及更早版本中，开启了内存响应缓存且「默认时长」大于 0 的反向代理站点，会缓存带 X-Emby-Token、X-Api-Key、X-Plex-Token 等凭据请求头，或带 api_key、token、access_token 等查询参数的请求的响应，其他访客请求同一地址时可能拿到这份响应；站点同时开启跨域时，缓存的跨域响应头可被某个来源"投毒"，导致其他来源的跨域请求失败。v0.6.5.3 起：带常见凭据请求头或凭据查询参数的请求在任何模式下都不缓存；缓存不保存 Gately 按访客来源写入的跨域头，命中时按本次请求重新生成；后端 Vary 含 Accept-Encoding（开启跨域时还有 Origin）以外的请求头时不缓存；路径含 ;、\、%2F、%5C 的请求不走缓存。使用响应缓存的站点建议尽快升级。
Response cache could serve a response to a credentialed request to other visitors. In v0.6.5.2 and earlier, a reverse proxy site with the in-memory response cache enabled and a default duration above 0 cached responses to requests carrying credential headers such as X-Emby-Token, X-Api-Key or X-Plex-Token, or credential query parameters such as api_key, token or access_token, so other visitors requesting the same URL could receive them; with CORS enabled as well, one origin could poison the cached CORS headers so cross-origin requests from other origins failed. From v0.6.5.3, requests with common credential headers or parameters are never cached in any mode; cache entries leave out the CORS headers Gately writes for the visitor's origin and a hit regenerates them for the current request; responses whose Vary lists request headers other than Accept-Encoding (and Origin with CORS) are not cached; paths containing ;, \, %2F or %5C bypass the cache. Sites using the response cache should upgrade.
中文
导航面板（#78）
「Web → 导航面板」管理面板库，把常用服务的链接按分组汇总成一页，再添加类型为「导航面板」的站点发布。链接有外网地址与可选的内网地址，内网访客自动使用内网地址并可切换；每个链接最多 8 个其他访问方式（IPv6 直连、frp、STUN、Cloudflare 隧道等）；内置 110 个图标，也可用 emoji、图片地址或上传图片；地址支持 {host}、{port}、{1} 与 STUN 变量；页面由服务端生成，带随机 nonce 的 CSP，站点认证、IP 访问控制、国家过滤与 WAF 照常生效。
访客审计
「Web → 访客审计」按访客地址汇总全部站点的访问：首次与最近访问、每天的请求与拦截数、状态码、拦截原因、站点、路径、身份与 User-Agent，支持筛选、搜索、封禁与查看访问日志。只保存聚合计数，不记录查询串、请求体、Cookie 与凭据；保留天数（默认 30）与访客上限（默认 10000）可调。
网络拓扑回放
开启录制后每 5 秒在内存中保存一次拓扑快照，按容量（默认 8 MB）保留最新数据；时间轴显示流量并标红异常时段，可拖动、单步、1×–60× 播放并跳过空闲。默认关闭。
按路径缓存规则（#77）
反向代理站点的缓存可按路径设置不缓存、单独时长或强制缓存（仍尊重 private），更具体的规则优先；可查看缓存占用，清空全部或某条规则路径的缓存。
Web 终端
随主机指纹记录密钥类型（如 ECDSA SHA256:...），只协商该类型；类型缺失或不符时逐个尝试其他类型，只接受与记录一致的密钥，ssh-keyscan 得到的任一类型指纹都可直接使用。主机证书类型显示为 ED25519-CERT 等短名。
日志面板
拖动调整高度、全屏、翻看历史时不被新日志拉回、「回到最新」显示新增条数。
问题修复
- 用 IPv6 地址访问时，重定向与路径重写中的
{host}保留方括号；路径重写代入{host}时检查字符，非法 Host 返回 400。 - 导航面板预览不再记为配置变更、不再触发变更通知。
更新说明：https://gately.cn/news/v0.6.5.3
English
Navigation panels (#78)
Web → Navigation panels manages a library of link pages grouped by section, published through a site of the new "Navigation panel" type. Links have an internet address and an optional LAN address used automatically for LAN visitors (switchable on the page), up to 8 other access methods each (direct IPv6, frp, STUN, Cloudflare tunnel…), 110 built-in icons or emoji, image URLs and uploads, and {host}, {port}, {1} and STUN variables. Pages are rendered on the server with a nonce-based CSP; site auth, IP access control, country filtering and WAF apply as usual.
Visitor audit
Web → Visitor audit summarizes visits to every site per visitor address: first and last visit, daily requests and blocks, status codes, block reasons, sites, paths, identities and User-Agents, with filters, search, ban and a link to the access log. Only aggregated counts are kept; query strings, bodies, cookies and credentials are never recorded. Retention (30 days) and the visitor limit (10000) are adjustable.
Topology replay
When recording is on, a snapshot of the topology is kept in memory every 5 seconds, limited by size (8 MB by default, newest kept). The timeline shows traffic and marks problems in red; seek, step, play at 1×–60× and skip idle periods. Off by default.
Per-path cache rules (#77)
A reverse proxy site's cache can be turned off, given its own duration or forced (still honoring private) per path, the more specific rule winning; current usage is shown and the whole cache or one rule's path can be purged.
Web terminal
The host key type is recorded with the fingerprint (shown as ECDSA SHA256:...) and only that type is negotiated; when it is missing or stale, the other types are tried and only a key matching the recorded fingerprint is accepted, so a fingerprint of any type from ssh-keyscan works. Host certificate types show as ED25519-CERT and similar.
Log panel
Resize by dragging, full screen, no jumping back to the bottom while browsing history, and a Jump to latest button with the count of new logs.
Fixes
- With an IPv6 address in the Host,
{host}in redirects and rewrite rules keeps its brackets; rewrite rules check{host}like redirect variables and answer 400 for an invalid Host. - The navigation panel preview is no longer recorded as a configuration change and no longer triggers change notifications.
Release notes: https://gately.cn/en/news/v0.6.5.3