From 1e5f3245796b57fc2899787ff41ae07c0401c563 Mon Sep 17 00:00:00 2001 From: Florian Sylvain Date: Mon, 5 Oct 2026 16:24:12 +0200 Subject: [PATCH] release: v2.8.2-beta Security headers and clearer log in errors --- docs/release-notes.md | 1 + docs/releases/v2.8.2-beta.md | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 docs/releases/v2.8.2-beta.md diff --git a/docs/release-notes.md b/docs/release-notes.md index fee9122..44ecc12 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -32,3 +32,4 @@ Each body lives in `docs/releases/.md`. Publish with `tea releases create - | `v2.7.0-beta` | v2.7.0-beta - Markdown and block article bodies | | `v2.8.0-beta` | v2.8.0-beta - API keys and API reference | | `v2.8.1-beta` | v2.8.1-beta - Docker deployment | +| `v2.8.2-beta` | v2.8.2-beta - Security headers and clearer log in errors | diff --git a/docs/releases/v2.8.2-beta.md b/docs/releases/v2.8.2-beta.md new file mode 100644 index 0000000..1851ded --- /dev/null +++ b/docs/releases/v2.8.2-beta.md @@ -0,0 +1,18 @@ +This release hardens the server with browser security headers on every response and makes the log in form clearer when the username is wrong. + +## Improvements and fixes + +- RenewCMS now sends security headers on every response, including the web app and uploaded images: a Content Security Policy that forbids framing, `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy` and `Cross-Origin-Opener-Policy`. With `ENVIRONMENT=production` it also sends `Strict-Transport-Security`. +- The log in form now tells you when you typed an email address instead of your username, and when the username is longer than 20 characters, instead of only asking for at least 3 characters. The messages are available in English and French. + +## Under the hood + +- Add a security headers middleware, mounted on the whole router, with tests. +- Document the headers, the Google Fonts and `https:` image allowances in the policy, and the advice not to duplicate them in the reverse proxy in the deployment guide. + +## Upgrading + +- Replace the binary, or pull the new image. No schema change and no new environment variable. +- If your reverse proxy already adds the same security headers, remove them there, or browsers will receive them twice. +- The policy allows scripts from the same origin only. A custom script injected by your proxy will be blocked. +- Serve the site over HTTPS only when `ENVIRONMENT=production`, because the server then asks browsers to remember HTTPS for a year.