new-api

mirror of https://gh-proxy.org/https://github.com/klinsmaya/new-api.git synced 2026-11-08 01:17:09 +08:00

Files

T

History

CaIon 5900426821 fix(task): restrict query redirect credentials to allowed hosts

Reuse the channel base host and plugin allowedHosts for redirected query
credentials. Keep anonymous redirects working, prevent credentials from
returning after an untrusted hop, and restrict body replay to trusted hosts.
Preserve SSRF and redirect limits, reject HTTPS downgrades, and redact signed
URLs from redirect-policy errors. Document the existing allowedHosts contract.

Validation: go test ./relay/channel/task/jsplugin -count=1
Passed against clean 6347fb0aa plus this patch, without an overlay.
Covers single/batch polling, 301/302/303/307/308, host and port boundaries,
multi-hop credentials, SSRF, downgrade rejection, and real HTTP receivers.

Related OWASP ASVS v5.0.0 controls: 14.2.3, 1.3.6, 12.3.1, 16.2.5.
https://github.com/OWASP/ASVS/tree/v5.0.0/5.0/en

2026-10-20 22:43:11 +08:00

channel

fix(channel): improve proxy client compatibility and cache lifecycle (#6157 )

2026-07-20 18:11:22 +08:00

images

feat: add Aion UI link to README files

2026-02-11 18:05:08 +08:00

installation

Update docs/installation/BT.md

2026-03-20 20:13:30 +08:00

openapi

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329 )