From 0df9d4830ff831d37c4de31b6195083d0f529bc0 Mon Sep 17 00:00:00 2001 From: nesquena-hermes Date: Fri, 10 Apr 2026 01:27:09 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20v0.43.1=20=E2=80=94=20CSRF=20reverse=20?= =?UTF-8?q?proxy=20fix=20(#220)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Nathan Esquenazi --- CHANGELOG.md | 4 ++++ static/index.html | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6613a4d..3109989 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ --- +## [v0.43.1] — 2026-04-10 + +- **CSRF fix for reverse proxies** (PR #219): The CSRF check now accepts `X-Forwarded-Host` and `X-Real-Host` headers in addition to `Host`, so deployments behind Caddy, nginx, and Traefik no longer reject POST requests with "Cross-origin request rejected". Security is preserved — requests with no matching proxy header are still rejected. Fixes #218. + ## [v0.43.0] — 2026-04-10 ### Features diff --git a/static/index.html b/static/index.html index d5c5e9c..8bcb985 100644 --- a/static/index.html +++ b/static/index.html @@ -14,7 +14,7 @@