-
Release v3.1.1
StableAll checks were successfulCI / build (push) Successful in 4m10smaxpeterkaya released this
2026-09-25 12:09:27 -04:00 | 2 commits to main since this releaseChangelog
Other Work
- af708: Fixed web-proxy to use v3 auth package instead of legacy package. (@maxpeterkaya)
- f45e6: The web proxy module has been updated to version v3. (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release v3.1.0
StableAll checks were successfulCI / build (push) Successful in 5m55s2026-09-23 21:19:10 -04:00 | 4 commits to main since this releaseChangelog
New Features
- 2c089: Added Echo v5 middleware adapter to the auth package. (@maxpeterkaya)
- 5074a: Embedded forms login template added. (@maxpeterkaya)
- cf023: Embedded forms bootstrap template added with improved styling and layout. (@maxpeterkaya)
- a6a67: Fixed OIDC runtime to use a more secure session store and to sweep expired sessi (@maxpeterkaya)
- 20e88: Added HTTP middleware core and credential checks. (@maxpeterkaya)
- 742e6: Fixed forms login flow to include session cookies and rate limiting. (@maxpeterkaya)
- 3a3b0: Added Authenticator type with improved configuration and validation for OIDC set (@maxpeterkaya)
- f756d: Added path matcher to prevent unauthorized access by checking if a URL path matc (@maxpeterkaya)
- 1026a: Added GenerateKey and bearer key validation functionality. (@maxpeterkaya)
- 72fbc: The SHA256Hash function now correctly handles errors when generating the digest. (@maxpeterkaya)
Refactors
- d0174: Moved login form template into auth package. (@maxpeterkaya)
- 04f0d: Moved bootstrap template into auth package, making it accessible to forms. (@maxpeterkaya)
- 3ea87: Moved hashing helper into auth package. (@maxpeterkaya)
- e71bf: Moved key helpers to auth package. (@maxpeterkaya)
- da2f6: Moved path matcher into auth package, removing its standalone functionality. (@maxpeterkaya)
- 5b32f: Moved forms authentication logic to auth package. (@maxpeterkaya)
- a6b57: Fixed package script usage to fall back on alternative scripts when necessary. (@maxpeterkaya)
- 6a839: Moved middleware core into auth package. (@maxpeterkaya)
- a4112: Added constant for API key header to simplify usage. (@maxpeterkaya)
- 3b6a0: Fixed embedded template and added dependency for HTML rendering. (@maxpeterkaya)
- eb9d2: Fixed authenticator usage to use the new auth module instead of globals. (@maxpeterkaya)
- 71ac5: Added reusable authentication middleware and challenge templates. (@maxpeterkaya)
- cece1: The authentication configuration has been made reusable by projecting the enviro (@maxpeterkaya)
Documentation
- c159c: Added standalone auth middleware example with basic and bearer authentication. (@maxpeterkaya)
- 0e7c8: Added standalone auth middleware and library example. (@maxpeterkaya)
- 36cb6: Added standalone authentication middleware documentation and example usage. (@maxpeterkaya)
Tests
- 9773e: Moved bearer key tests to auth package. (@maxpeterkaya)
- f2bdd: Excluded paths were updated to correctly exclude paths with trailing slashes and (@maxpeterkaya)
- e4438: Fixed package script usage to fall back on alternative scripts when necessary. (@maxpeterkaya)
- 45745: Moved middleware tests into auth package. (@maxpeterkaya)
- 675fb: Fixed API key header usage to use the new constant. (@maxpeterkaya)
- 37f96: Fixed authentication helper usage in challenge tests. (@maxpeterkaya)
- 05a1a: New guard authentication with valid key bypass. (@maxpeterkaya)
- 22f55: Fixed rooted path filtering to correctly drop unrooted paths. (@maxpeterkaya)
- 6c3f1: Covered echo v5 adapter functionality. (@maxpeterkaya)
- 71da9: Fixed OIDC flow, sessions, and identity headers. (@maxpeterkaya)
- e5278: Covered middleware credential acceptance. (@maxpeterkaya)
- 1bf2a: Path exclusion and gated requests have been implemented to restrict access to ce (@maxpeterkaya)
- c2f9a: Fixed key validation to correctly identify valid and invalid keys. (@maxpeterkaya)
Chores
- 9886d: Updated workflow actions to use v2 changelog version. (@Renovate Bot)
Other Work
- cf48b: Refreshed checksums for modules after path changes. (@maxpeterkaya)
- e61d4: Fixed module path to vc.maxkaya.com/maxpeterkaya/web-proxy. (@maxpeterkaya)
- 9742d: Updated changelog action to v2. (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 3.0.0
StableAll checks were successfulCI / build (push) Successful in 5m27s2026-09-23 12:52:03 -04:00 | 47 commits to main since this releaseChangelog
New Features
- c3e66: Fixed middleware to include guard and log fields for error responses. (@maxpeterkaya)
- 88100: Added Guard configuration with various settings. (@maxpeterkaya)
- 4e2f7: Added challenge interstitial view with verification functionality. (@maxpeterkaya)
- 47446: Added proof-of-work challenge layer to the guard. (@maxpeterkaya)
- 94798: Fixed guard logic to enforce severity tiers and score requests. (@maxpeterkaya)
- 00fe8: Fixed good bot verification to use reverse DNS and forward confirmation. (@maxpeterkaya)
- aad90: Embedded feeds with fast IP and UA matching loaded. (@maxpeterkaya)
- 685b8: Added build-time feed generator to generate and embed IP and user-agent lists in (@maxpeterkaya)
- b4c90: Added baseline user-agent patterns for common non-browser clients and tools. (@maxpeterkaya)
- 84499: Blocked requests based on user agent and IP range patterns. (@maxpeterkaya)
Bug Fixes
- bfbf9: Fixed block list parsing to use CSV parsing for both user agents and IPs. (@maxpeterkaya)
Refactors
- 143aa: Blocked requests are now restricted to user agents and IP addresses specified in (@maxpeterkaya)
Documentation
- 4d460: A built-in bot guard feature has been added to the web application. (@maxpeterkaya)
- 99fac: The bot guard has been added with customizable scoring, tiers, and challenge mod (@maxpeterkaya)
- 8bea0: Added bot guard example documentation and updated curated feeds refresh interval (@maxpeterkaya)
- 19557: Added example of bot guard compose file with default settings. (@maxpeterkaya)
- c5339: Blocked user agent and client IP filtering added to web-proxy. (@maxpeterkaya)
- 3a9b8: Added blocking compose example with default proxy settings. (@maxpeterkaya)
- 40f55: A blocking match semantics change was made to user agent and IP blocking configu (@maxpeterkaya)
- 1fb2f: Blocked requests can now be restricted by user agent substring or client IP and (@maxpeterkaya)
Tests
- cb84c: Fixed challenge token verification to prevent tampering and ensure secure transm (@maxpeterkaya)
- fdceb: Fixed package script usage to fall back on alternative scripts when necessary. (@maxpeterkaya)
- ed391: Fixed block request logic to correctly handle user agents and IP addresses. (@maxpeterkaya)
Chores
- f478c: Fixed addition of curated malicious user-agent feed data. (@maxpeterkaya)
- 2abc7: Added curated malicious IP feed data to guarddata/ips.txt. (@maxpeterkaya)
Other Work
- 2a67b: Refreshed guard feeds before release. (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 2.5.2
StableAll checks were successfulCI / build (push) Successful in 3m52s2026-09-16 12:43:44 -04:00 | 73 commits to main since this releaseChangelog
New Features
- f5a40: Fixed authentication for excluded paths to skip authentication when necessary. (@maxpeterkaya)
- aa82d: Improved path exclusion logic to correctly match request paths against configure (@maxpeterkaya)
- 39c2a: Config now includes an optional AUTH_EXCLUDE_PATHS list to skip authentication f (@maxpeterkaya)
Documentation
- 85ab9: Excluded paths can be configured to skip authentication for specific request pat (@maxpeterkaya)
Tests
- f0588: Path exclusion logic improved to correctly handle encoded separators and dot seg (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 2.5.1
StableAll checks were successfulCI / build (push) Successful in 4m23s2026-09-16 12:25:09 -04:00 | 78 commits to main since this releaseChangelog
New Features
- 75b04: Fixed authentication to handle bearer tokens from API clients. (@maxpeterkaya)
- 69c55: Verified OIDC access tokens are now validated against the discovered provider's (@maxpeterkaya)
Documentation
- 2e1f7: Machine clients now verify access tokens against the provider's JWKS and accept (@maxpeterkaya)
Tests
- 043a2: Fixed bearer access token verification to reject insecure issuers. (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 2.5.0
StableAll checks were successfulCI / build (push) Successful in 4m11s2026-09-15 20:49:59 -04:00 | 82 commits to main since this releaseChangelog
New Features
- bc040: Fixed API key to be sent on provider calls. (@maxpeterkaya)
- 0cc66: Fixed outbound API key to be sent on HTTP probes. (@maxpeterkaya)
- 29292: Fixed outbound API key to be sent to upstreams with additional configuration. (@maxpeterkaya)
- 65368: Added outbound API key transport to the client. (@maxpeterkaya)
- 2539b: Fixed authentication to accept bearer key via X-Api-Key header. (@maxpeterkaya)
- 210a0: Fixed addition of ProxyAPIKey setting to config structure. (@maxpeterkaya)
Documentation
- f5bd5: Added support for optional
X-Api-Keyheader for authenticated requests. (@maxpeterkaya)
Tests
- 422f9: Added outbound API key transport to the proxy server. (@maxpeterkaya)
- 127a7: Fixed X-Api-Key bearer authentication to work with alternative authentication me (@maxpeterkaya)
Chores
- 4c632: Added missing module checksums for the go-oidc and go-jose dependencies. (@maxpeterkaya)
- 25ce0: Fixed go version to 1.26. (@maxpeterkaya)
- ca14c: Fixed module dependency to version v3.21.0 of github.com/coreos/go-oidc/v3. (@maxpeterkaya)
- 51962: Fixed module dependency golang.org/x/oauth2 to version v0.37.0. (@maxpeterkaya)
- e341f: Fixed dependency on golang.org/x/oauth2 updated to version v0.37.0. (@Renovate Bot)
- 4bce2: Fixed module dependency to version v3.21.0 of github.com/coreos/go-oidc/v3. (@Renovate Bot)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 2.4.0
StableAll checks were successfulCI / build (push) Successful in 4m34s2026-09-13 22:49:19 -04:00 | 97 commits to main since this releaseChangelog
New Features
- 693b9: Fixed OIDC configuration validation and started session janitor when authenticat (@maxpeterkaya)
- 1aa94: Fixed authentication middleware to support OIDC identity verification. (@maxpeterkaya)
- 137a1: Fixed the OIDC provider discovery to retry until successful. (@maxpeterkaya)
- 523f7: Added OIDC relying-party settings to the Authentication struct. (@maxpeterkaya)
Documentation
- acb0a: Added support for OIDC authentication with customizable issuer, client ID, and s (@maxpeterkaya)
- 2a399: Added support for OpenID Connect authentication with secure configuration requir (@maxpeterkaya)
- a0a73: Fixed access control to include OpenID Connect for additional authentication opt (@maxpeterkaya)
Tests
- 4279e: Fixed OIDC tests to use a different server for the authorization endpoint. (@maxpeterkaya)
Chores
- b52c4: Updated OIDC dependencies to v3.16.0 and v4.1.4. (@maxpeterkaya)
- 55a29: Fixed package script usage to fall back on alternative scripts when necessary. (@maxpeterkaya)
Other Work
- e302c: This is a Go code snippet that appears to be part of an Echo framework applicati (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 2.3.0
StableAll checks were successfulCI / build (push) Successful in 4m21s2026-09-13 18:01:00 -04:00 | 108 commits to main since this releaseChangelog
New Features
- cd910: Fixed HTTP health check to probe path when configured. (@maxpeterkaya)
- 33858: Fixed PROXY_HEALTHCHECK_PATH setting to be configurable via environment variable (@maxpeterkaya)
Documentation
- d70da: Fixed healthcheck path in compose to use HTTP probe instead of TCP. (@maxpeterkaya)
- de2b7: Added documentation for PROXY_HEALTHCHECK_PATH. (@maxpeterkaya)
- ec4ee: Added PROXY_HEALTHCHECK_PATH to enable probing an HTTP path for health checks. (@maxpeterkaya)
- f7030: - Added HTTP health checks to ensure reliable backend communication. (@maxpeterkaya)
Tests
- 91979: Added HTTP path probe to healthcheck functionality. (@maxpeterkaya)
Chores
- 672d3: Updated changelog action to v1.8.0. (@Renovate Bot)
Other Work
- 7812e: Updated changelog action to v1.8.0. (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 2.2.0
StableAll checks were successfulCI / build (push) Successful in 3m56s2026-09-06 01:37:46 -04:00 | 117 commits to main since this releaseChangelog
New Features
- 38cc8: Authenticates requests using a single, unified authentication middleware. (@maxpeterkaya)
- f85c7: Fixed authentication middleware to include alternative auth types. (@maxpeterkaya)
- 481a9: Config now accepts multiple authentication types simultaneously. (@maxpeterkaya)
Documentation
- c740a: Added support for multiple authentication types. (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Release 2.1.0
StableAll checks were successfulCI / build (push) Successful in 5m25s2026-09-06 00:34:32 -04:00 | 121 commits to main since this releaseChangelog
New Features
- da0dc: Fixed IP extraction logic to use alternative methods when XFF header is not trus (@maxpeterkaya)
- 1455f: Fixed forms login functionality to include rate limiting and IP-based session ma (@maxpeterkaya)
- 4271d: Added support for secure cookie configuration. (@maxpeterkaya)
Documentation
- d4cf9: Fixed package script usage to fall back on alternative scripts when necessary. (@maxpeterkaya)
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads