19 Releases 150 Tags

RSS Feed

• v0.10.2-beta.6 fbd0f71639

  Compare

  feat(gateway): entry-point hardening (alias headers, encoded path chars) + Traefik pinned to v3.7

  LastSkywalker released this 2026-09-02 14:23:56 +03:00 | 78 commits to main since this release

  Traefik 3.7 logs two start-up warnings: aliasHeadersStrategy unset (a client
  can send X_Forwarded_For / X.Real.IP, which PHP/CGI/WSGI/nginx collapse into
  the real header → spoofing what Traefik sets) and the encodedCharacters
  defaults (%2F %5C %00 … accepted in paths → split-view against sloppy
  backends). Both are now node-stats defaults, configurable in the Gateway
  node card ("Request hardening"):

  alias_headers_strategy delete (default) | reject | keep
  encoded_path_policy strict (default: reject %2F %5C %00, allow the
  rest) | permissive (all, Traefik default) | paranoid

  Rendered on web/websecure/ping in both static configs (compose flags and
  native traefik.yml). All seven encodedCharacters flags are always explicit —
  that is what silences Traefik's default-values warning; one informational
  WRN remains at start-up while anything is rejected (documented in the UI).

  Versions: the managed image moves traefik:v3.3 → traefik:v3.7 (needs ≥3.7.12
  for aliasHeadersStrategy); the native installer follows the newest v3.7.x
  instead of "newest v3", upgrades an installed binary older than 3.7.12 in
  place (checksum-verified, throttled retries, restart), and gates each key on
  the detected traefik version so a pinned/un-upgraded binary keeps booting.

  Verified on traefik:v3.7 (3.7.12) with the rendered config: %2F/%5C → 400,
  %3B → 200, X_Forwarded_For from the client no longer reaches the upstream,
  alias warning gone.

  Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)