JPKCom DB
View on GitHub

Changelog — localproxy

Version history of localproxy — the local HTTP proxy for the JPKCom Developer Tools.

Version history of proxy-jpkcom-dev-tools. Entries are taken verbatim from the project's README. A hands-on guide with tips is available in the project guide.

v1.1.0

Security-focused release. No changes are required in client code — existing fields keep their meaning and only additive fields were introduced.

New

  • /inspect and /page report an http3 boolean derived from the target's Alt-Svc field (RFC 7838, ALPN token h3 per RFC 9114). This answers "does this site support HTTP/3?" without a QUIC stack — see HTTP/3 detection. Draft tokens like h3-29 are ignored.

Security

  • SSRF is now enforced in the dialer, after DNS resolution and before connect. The previous hostname pre-check resolved the name separately from the HTTP client, so an attacker-controlled zone with a short TTL could answer with a public address for the check and a loopback address for the connection. The pre-check remains as a fast-fail path only.
  • Blocked ranges extended: reserved and special-purpose IPv4 space (0/8, 192.0.0.0/24, 198.18/15, multicast, 240/4) plus the IPv6 forms that embed an IPv4 address — IPv4-mapped, NAT64 (64:ff9b::/96) and 6to4 (2002::/16). 64:ff9b::7f00:1 reaches 127.0.0.1 on a NAT64 network and was previously invisible to a v4-only check.
  • Host-header check: requests must address the proxy as 127.0.0.0/8, localhost or [::1], blocking DNS rebinding against the proxy itself. Override with --allow-any-host.
  • Credential and identity headers are no longer forwarded to targets: Cookie, Cookie2, Authorization, Proxy-Authorization, Origin, Referer and Sec-Fetch-*. Headers the caller sets deliberately — Accept, User-Agent, Accept-Language, custom X-* — still pass through.
  • Bounded work per request: /page derives one overall time budget from the client's request context. Redirect hops and encoding probes previously used context.Background(), so a client disconnect stopped nothing and 20 slow redirects could keep a handler alive for minutes.
  • DNS lookups in the SSRF pre-check are now bounded (5 s) instead of able to hang indefinitely against a black-holed resolver.
  • Constant-time token comparison via crypto/subtle.
  • Truncated bodies no longer break the response: when a body exceeds --max-mb, the upstream Content-Length is dropped (it would promise more bytes than are delivered, aborting the connection) and X-Upstream-Truncated: 1 is set instead.
  • Error responses are now readable by the caller: all 4xx responses carry CORS headers and a JSON body with a machine-readable code (bad_request, forbidden, blocked_target, method_not_allowed). A wrong token used to be indistinguishable from an unreachable proxy. Rejected origins still get a bare 403 with no CORS headers, by design.
  • X-Content-Type-Options: nosniff on all proxy-generated responses.

Fixes & quality

  • Content-Encoding: deflate now decodes both zlib-wrapped (RFC 1950) and raw DEFLATE (RFC 1951). Only raw was handled, so zlib-wrapped bodies — which a large share of servers send — came back empty or corrupt.
  • Headers named in a Connection header are treated as hop-by-hop (RFC 9110 §7.6.1).
  • Vary: Origin is now always set, not only when a CORS origin was echoed.
  • SSL info includes IP SANs, not just DNS names.
  • --port, --timeout and --max-mb are validated at startup; --timeout 0 previously produced an already-expired context and failed every request.
  • Upstream Content-Length is sanity-checked before being reported as transferSize.
  • Shared handler preamble replaces the duplicated method/origin/token/URL/SSRF blocks across the three endpoints.
  • JSON encoding errors are logged rather than silently discarded.

Build & CI

  • Built with Go 1.26.5 — security fixes in crypto/tls (GO-2026-5856 / CVE-2026-42505, ECH handshake de-anonymisation) and os
  • go.mod toolchain directive bumped from go 1.26.4 to go 1.26.5
  • CI now runs on every push and pull request, not only on tags — a broken test no longer surfaces first at release time
  • govulncheck and a gofmt check added to CI
  • GITHUB_TOKEN scoped to read-only by default; only the release job gets write

v1.0.5

  • Built with Go 1.26.4 — picks up upstream stdlib fixes for crypto/tls, crypto/x509, net/http, and the runtime
  • go.mod toolchain directive bumped from go 1.26.3 to go 1.26.4

v1.0.4

  • Built with Go 1.26.3 — picks up upstream stdlib fixes for crypto/tls, crypto/x509, net/http, and the runtime
  • go.mod toolchain directive bumped from go 1.26.0 to go 1.26.3

v1.0.3

  • Hardened /inspect and /page body decompression: the decompressed stream is now also capped at --max-mb, preventing zip-bomb-style payloads where a small compressed body would expand to gigabytes of memory
  • Breaking (JSON shape): /inspect and /page now return headers as map[string][]string (JSON arrays of values) instead of map[string]string (joined with ", "). This fixes RFC 6265 §3 — multiple Set-Cookie headers used to be joined with ", ", producing an unparseable string because cookie expiry dates contain literal commas (e.g. expires=Sun, 27 Apr 2025 14:03:58 GMT). Browser-side consumers should access values via headers["X"][0] for single-value or headers["X"].join(", ") for display. A Array.isArray() guard makes code compatible with both old and new format.
  • CI now runs staticcheck ./... on linux/amd64 before producing release binaries; any finding blocks the release
  • Code formatted with gofmt -w (struct alignment cleanup)

v1.0.2

  • Built with Go 1.26.2 — includes upstream security fixes for crypto/tls, crypto/x509, net/url, and net/http
  • CI now runs go test -race -v ./... on linux/amd64 before producing release binaries; failed tests block the release
  • Expanded README testing section with -race and -cover examples and a summary of what main_test.go covers

v1.0.1

  • Added --version CLI flag to print version information
  • Added /version endpoint returning version, license, author, and repo as JSON
  • Added GPL-2.0-or-later license
  • Startup banner now shows version, license, author, and repository URL
  • Startup banner groups Address/Token, DNS/Origins, and License/Author/Repo into visually separated sections
  • Fixed resource safety: response body in redirect chain tracing is now closed immediately after receiving the response
  • Added FreeBSD (amd64, arm64), OpenBSD (amd64), and NetBSD (amd64) release binaries

v1.0.0

  • Initial release
  • Streaming proxy (/proxy), metadata inspection (/inspect), full page analysis (/page)
  • Per-session cryptographic token authentication
  • Origin allowlist, SSRF protection, configurable DNS resolver
  • CORS with Private Network Access support
  • Cross-platform binaries via GitHub Actions