namailu
e446052e06
JMAP session urls follow the requested host (STALWART_PUBLIC_URL_HOSTS)
...
The session document hands the client absolute urls built from the single
configured public url, so a client that discovered the server on one brand's
hostname was told to continue on another brand's hostname.
With STALWART_PUBLIC_URL_HOSTS=namailu.cz,mailows.com the session follows the
host the request came in on; anything not on that allowlist (including a spoofed
Host header) keeps the configured public url, which still serves OAuth metadata,
its issuer and the web admin links — those must stay on one stable host.
2026-08-18 00:39:01 +02:00
root
831f3dc677
feat(auth): verify Basic credentials through OIDC provider
2026-07-29 02:31:01 +02:00
Maurus Decimus
6fb4d2b628
IMAP: Mailbox object-quota only enforced in JMAP
2026-07-19 07:52:31 +02:00
Maurus Decimus
764c2c1e1c
v0.16.13
2026-07-12 19:18:29 +02:00
Maurus Decimus
2543ec7067
Bump dependencies
2026-07-12 11:39:02 +02:00
Maurus Decimus
548ff03f30
OAuth resource indicators: Accept imap, smtp, pop3 and sieve as valid resource indicators for OAuth access tokens
2026-07-06 15:37:57 +02:00
Maurus Decimus
00ca557340
Fix OIDC: Allow ports in redirect_uri for loopback addresses
2026-07-04 07:39:16 +02:00
Maurus Decimus
94b33187a0
DKIM2 tests
2026-07-03 20:07:37 +02:00
Maurus Decimus
186d9feecb
DKIM2 verification
2026-07-01 16:20:02 +02:00
Maurus Decimus
e3c6f95bfd
Bump to mail-auth 0.11
2026-06-30 11:53:55 +02:00
Maurus Decimus
0eb08b9fb3
Fix DANE: Treat DNSSEC bogus as a temporary failures to prevent downgrade attacks
2026-06-25 19:24:10 +02:00
Maurus Decimus
df164e07c8
DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records
2026-06-22 23:13:45 +02:00
Maurus Decimus
88412f9540
Troubleshoot tool: Use the configured source IP address when connecting to remote servers ( fixes #2867 )
2026-06-19 17:04:43 +02:00
Maurus Decimus
169590208d
Fix JMAP: Reject requests that do not specify application/json in the Content-Type header
2026-06-18 18:17:55 +02:00
Maurus Decimus
b1880c8670
HTTP: Add redirectRoot option to Http object
2026-06-17 19:30:36 +02:00
Maurus Decimus
8778e1bc45
OAuth client secret verification for confidential clients
2026-06-17 19:04:01 +02:00
Maurus Decimus
a6e1f97915
OAuth Profile for Open Public Clients
2026-06-17 18:04:46 +02:00
Maurus Decimus
3f2c5632b8
Fix OIDC: Add default domain name to groups that are not email addresses
2026-06-16 21:51:48 +02:00
Maurus Decimus
4121518c4a
ACME: Allow specifying a preferred certificate chain
2026-06-15 16:32:34 +02:00
Maurus Decimus
0d131afc03
Fix Autodiscover v2: Read email address from query parameters
2026-06-15 15:29:58 +02:00
Maurus Decimus
33f288d0ea
Fix JMAP: */changes methods leak ids of non-shared objects
2026-06-10 13:51:36 +02:00
Maurus Decimus
0fdcdd4f87
Bump dependencies
2026-06-03 19:57:12 +02:00
Maurus Decimus
838a839290
OAuth: Rework access tokens to an AES-256-GCM-SIV AEAD format that carries the account name for proxy routing and revokes tokens on credential change
2026-06-03 18:14:48 +02:00
Maurus Decimus
086383a045
Fix HTTP: Reject requests from blocked IPs when Keep-Alive is enabled
2026-05-28 16:43:53 +02:00
Maurus Decimus
4866cd331a
Bump to dns-update 0.5.0
2026-05-23 19:20:25 +02:00
Maurus Decimus
777cf1252b
RateLimit header fields for HTTP
2026-05-23 11:41:43 +02:00
Maurus Decimus
f048e0f0bb
Sieve: Allow User Sieve scripts to access orcpt
2026-05-19 17:40:45 +02:00
Maurus Decimus
415036dd64
Fix DAV: acl-principal-prop-set REPORT enforced the wrong privilege
2026-05-12 15:47:32 +02:00
Maurus Decimus
bdba3f20e1
v0.16.5
2026-05-11 17:14:26 +02:00
Maurus Decimus
3420287be2
Fix Autodiscover v2 endpoint unreachable
2026-05-11 12:31:48 +02:00
Maurus Decimus
af583c19c1
Fix HTTP: Use permissive CORS headers for .well-known endpoints
2026-05-08 08:06:18 +02:00
Maurus Decimus
015d437027
Bump mail-auth to 0.9
2026-05-05 19:41:15 +02:00
Maurus Decimus
9a575d9438
Timezone changes from the AccountSettings object return invalidProperties
2026-05-01 14:55:38 +02:00
Maurus Decimus
8b7f7b091a
Fix live tracing in community and OSS versions
2026-05-01 09:19:25 +02:00
Maurus Decimus
295cd7b127
Fix Registry: Allow changing object variants
2026-04-29 14:05:16 +02:00
Maurus Decimus
0b7492240b
Fix log viewer: All events show as INFO.
2026-04-29 09:02:34 +02:00
Maurus Decimus
ed849e86ba
v0.16.2
2026-04-28 16:11:49 +02:00
Maurus Decimus
242bea67d9
Allow HTTP to be used for configuring the server
2026-04-27 07:48:36 +02:00
Maurus Decimus
52733408dc
Reduce minimum TLS certificate validity from 86400 to 3600 seconds
2026-04-24 20:18:38 +02:00
Maurus Decimus
e73b65c5a3
Box::pin authenticate function
2026-04-24 19:58:03 +02:00
Maurus Decimus
2fd3f208bd
Add STALWART_HTTPS_PORT variable
2026-04-22 08:41:46 +02:00
Maurus Decimus
8abe783677
Do not include port number when constructing HTTP base URLs
2026-04-21 15:27:02 +02:00
Maurus Decimus
3ad4aa82cb
v0.16.0
2026-04-20 17:50:58 +02:00
Maurus Decimus
1edd85486b
Bootstrapping fixes
2026-04-20 16:35:21 +02:00
Maurus Decimus
eaf0601742
Include OAuth public endpoint in PACC responses
2026-04-19 14:35:06 +02:00
Maurus Decimus
af23099e35
Box large futures
2026-04-19 08:11:56 +02:00
Maurus Decimus
dd95efe3ce
WebDAV and other minor fixes
2026-04-18 10:42:21 +02:00
Maurus Decimus
e6fbd189d6
Allow HTTP OAuth in recovery mode
2026-04-18 08:15:54 +02:00
Maurus Decimus
06663389a0
HTTP: Fix 204 CORS preflight responses
2026-04-17 20:26:52 +02:00
Maurus Decimus
95d1268308
Bootstrapping implementation
2026-04-17 20:02:06 +02:00
