diff --git a/CHANGELOG.md b/CHANGELOG.md index 6613a4d..3109989 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ --- +## [v0.43.1] — 2026-04-10 + +- **CSRF fix for reverse proxies** (PR #219): The CSRF check now accepts `X-Forwarded-Host` and `X-Real-Host` headers in addition to `Host`, so deployments behind Caddy, nginx, and Traefik no longer reject POST requests with "Cross-origin request rejected". Security is preserved — requests with no matching proxy header are still rejected. Fixes #218. + ## [v0.43.0] — 2026-04-10 ### Features diff --git a/static/index.html b/static/index.html index d5c5e9c..8bcb985 100644 --- a/static/index.html +++ b/static/index.html @@ -14,7 +14,7 @@