RenewCMS/docs/releases/v2.8.2-beta.md

This release hardens the server with browser security headers on every response and makes the log in form clearer when the username is wrong.

Improvements and fixes

• RenewCMS now sends security headers on every response, including the web app and uploaded images: a Content Security Policy that forbids framing, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Cross-Origin-Opener-Policy. With ENVIRONMENT=production it also sends Strict-Transport-Security.
• The log in form now tells you when you typed an email address instead of your username, and when the username is longer than 20 characters, instead of only asking for at least 3 characters. The messages are available in English and French.

Under the hood

• Add a security headers middleware, mounted on the whole router, with tests.
• Document the headers, the Google Fonts and https: image allowances in the policy, and the advice not to duplicate them in the reverse proxy in the deployment guide.

Upgrading

• Replace the binary, or pull the new image. No schema change and no new environment variable.
• If your reverse proxy already adds the same security headers, remove them there, or browsers will receive them twice.
• The policy allows scripts from the same origin only. A custom script injected by your proxy will be blocked.
• Serve the site over HTTPS only when ENVIRONMENT=production, because the server then asks browsers to remember HTTPS for a year.