Skip to content

v1.9.0

Choose a tag to compare

View all tags
@tirthpatell tirthpatell released this 18 Apr 00:22
· 17 commits to main since this release
v1.9.0
991530c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security-focused release. Hardens OAuth against login CSRF (CWE-352) and tightens log redaction, ownership checks, and rate-limit thread-safety. Contains API breakage on the auth surface only.

Breaking changes

  • Authenticator.GetAuthURL now returns (authURL, state, err) instead of just a URL string. Callers must persist state (session/cookie) and pass it back on exchange.

  • Authenticator.ExchangeCodeForToken now requires (ctx, code, expectedState, receivedState). The two states are compared with crypto/subtle.ConstantTimeCompare before any network call; mismatch or empty values return a ValidationError.

    Migration: see examples/authentication/main.go.

Security fixes

  • OAuth state CSRF (HIGH, CWE-352): state is generated with crypto/rand and surfaced to the caller; the predictable time-based fallback was removed (fail-closed on rand errors).
  • Debug-log redaction: access_token, client_secret, input_token, code, and refresh_token are redacted from request URLs before logging.
  • validatePostOwnership: prefers numeric owner ID over username and fails closed on empty identifiers — previously two empty strings compared equal and silently authorised deletion.
  • DisableRateLimiting / EnableRateLimiting: the HTTPClient's limiter is now an atomic.Pointer so toggling from one goroutine is race-safe against an in-flight request on another.

CI / chores

  • Bump schneegans/dynamic-badges-action v1.7.0 → v1.8.0 (supersedes #25).
  • Bump codecov/codecov-action v5 → v6 (supersedes #26).
  • Drop TestIntegration_GIFPosts — Tenor API deprecated.

Full Changelog: v1.8.0...v1.9.0

Assets 2
Loading