From c35ca8d45ddeb6f13ee19d209d5d159ba775a7bb Mon Sep 17 00:00:00 2001 From: Github Actions Date: Wed, 26 Aug 2026 16:17:22 +0000 Subject: [PATCH 1/6] Version bump --- box.json | 2 +- changelog.md | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/box.json b/box.json index fd9d7cb..c5b6db1 100644 --- a/box.json +++ b/box.json @@ -1,6 +1,6 @@ { "name":"ColdBox Security", - "version":"3.7.2", + "version":"3.8.0", "location":"https://downloads.ortussolutions.com/ortussolutions/coldbox-modules/cbsecurity/@build.version@/cbsecurity-@build.version@.zip", "author":"Ortus Solutions.com ", "slug":"cbsecurity", diff --git a/changelog.md b/changelog.md index b320c26..8afda08 100644 --- a/changelog.md +++ b/changelog.md @@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [3.7.2] - 2026-08-26 + ### 🐛 Fixed - Updates for MySQL indexes on version 8+ and index keys to avoid max key length issues with long VARCHAR fields. The `DBLogger` model now creates indexes with a 255 character prefix for `userAgent`, `host`, `path`, and `referer` fields when using MySQL to prevent exceeding the 3072 byte key limit. @@ -432,7 +434,8 @@ settings = { - Created first module version -[unreleased]: https://github.com/coldbox-modules/cbsecurity/compare/v3.7.1...HEAD +[unreleased]: https://github.com/coldbox-modules/cbsecurity/compare/v3.7.2...HEAD +[3.7.2]: https://github.com/coldbox-modules/cbsecurity/compare/v3.7.1...v3.7.2 [3.7.1]: https://github.com/coldbox-modules/cbsecurity/compare/v3.7.0...v3.7.1 [3.7.0]: https://github.com/coldbox-modules/cbsecurity/compare/v3.6.0...v3.7.0 [3.6.0]: https://github.com/coldbox-modules/cbsecurity/compare/v3.5.0...v3.6.0 From 393c0c2ca56f458773e1d0c384f5fbe64c7a4712 Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Sun, 13 Sep 2026 23:35:18 -0600 Subject: [PATCH 2/6] fix: upgrade cbauth for thread-safe authentication startup --- box.json | 2 +- .../specs/integration/CBSecuritySpec.cfc | 24 +++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/box.json b/box.json index c5b6db1..03bf178 100644 --- a/box.json +++ b/box.json @@ -24,7 +24,7 @@ ], "dependencies":{ "jwt-cfml":"^1.0.0", - "cbauth":"^6.0.0", + "cbauth":"^7.0.0", "cbcsrf":"^3.0.0" }, "devDependencies":{ diff --git a/test-harness/tests/specs/integration/CBSecuritySpec.cfc b/test-harness/tests/specs/integration/CBSecuritySpec.cfc index 19372e7..39387c6 100644 --- a/test-harness/tests/specs/integration/CBSecuritySpec.cfc +++ b/test-harness/tests/specs/integration/CBSecuritySpec.cfc @@ -41,6 +41,30 @@ component extends="coldbox.system.testing.BaseTestCase" appMapping="/root" { cbauth.logout(); } ); + it( "registers the authentication singleton with thread-safe publication", function(){ + expect( + getWireBox() + .getBinder() + .getMapping( "authenticationService@cbauth" ) + .getThreadSafe() + ).toBeTrue(); + } ); + + it( "can log in and out through the cbauth provider", function(){ + var security = getInstance( "CBSecurity@cbsecurity" ); + var user = getInstance( "User" ).setId( "cbauth-compatibility" ); + try { + expect( security.isLoggedIn() ).toBeFalse(); + cbauth.login( user ); + expect( security.isLoggedIn() ).toBeTrue(); + expect( security.getUser().getId() ).toBe( user.getId() ); + cbauth.logout(); + expect( security.isLoggedIn() ).toBeFalse(); + } finally { + cbauth.logout(); + } + } ); + it( "can retrieve user,auth and mixin services", function(){ var e = get( "/main/cbsecuremixin" ); expect( e.getRenderedContent() ).toBeJSON(); From 9727b8cff357e13bb54022876275c61736ac8e40 Mon Sep 17 00:00:00 2001 From: Dave L Date: Fri, 18 Sep 2026 11:52:55 -0700 Subject: [PATCH 3/6] Fix HSTS header formatting by removing colon+space https://ortussolutions.atlassian.net/browse/BOX-176 Fixes malformed header output --- interceptors/SecurityHeaders.cfc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/interceptors/SecurityHeaders.cfc b/interceptors/SecurityHeaders.cfc index 978031a..9325fd1 100644 --- a/interceptors/SecurityHeaders.cfc +++ b/interceptors/SecurityHeaders.cfc @@ -250,7 +250,7 @@ component extends="coldbox.system.Interceptor" { } if ( variables.settings.securityHeaders.hsts.enabled ) { - var headerValue = "max-age: #variables.settings.securityHeaders.hsts[ "max-age" ]#;"; + var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#;"; if ( variables.settings.securityHeaders.hsts.includeSubDomains ) { headerValue &= " includeSubDomains"; } From 5b95c9f098286b480df0a3c2188b5cecdaafbe13 Mon Sep 17 00:00:00 2001 From: Dave L Date: Fri, 18 Sep 2026 11:59:02 -0700 Subject: [PATCH 4/6] Fix HSTS header value formatting Fixed semicolon --- interceptors/SecurityHeaders.cfc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/interceptors/SecurityHeaders.cfc b/interceptors/SecurityHeaders.cfc index 9325fd1..0ffecf2 100644 --- a/interceptors/SecurityHeaders.cfc +++ b/interceptors/SecurityHeaders.cfc @@ -250,12 +250,12 @@ component extends="coldbox.system.Interceptor" { } if ( variables.settings.securityHeaders.hsts.enabled ) { - var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#;"; + var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#"; if ( variables.settings.securityHeaders.hsts.includeSubDomains ) { - headerValue &= " includeSubDomains"; + headerValue &= "; includeSubDomains"; } if ( variables.settings.securityHeaders.hsts.preload ) { - headerValue &= " preload"; + headerValue &= "; preload"; } event.setHTTPHeader( name: "Strict-Transport-Security", value: headerValue ); } From 1a9f05017e4f206e0f44a063e3d258bf6ff75f6b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 21 Sep 2026 09:24:03 +0000 Subject: [PATCH 5/6] docs: update changelog for 3.8.0 release Co-authored-by: lmajano <137111+lmajano@users.noreply.github.com> --- changelog.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/changelog.md b/changelog.md index 8afda08..92983b4 100644 --- a/changelog.md +++ b/changelog.md @@ -9,6 +9,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [3.8.0] - 2026-09-21 + +### Changed + +- Upgraded `cbauth` to `^7.0.0` to support thread-safe authentication startup. + +### Fixed + +- Corrected the `Strict-Transport-Security` header formatting by removing the extra `": "` in the rendered header value. + ## [3.7.2] - 2026-08-26 ### 🐛 Fixed From 8e44c252458e4797a7567421e2fc1a371e8a7f0f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 21 Sep 2026 09:42:12 +0000 Subject: [PATCH 6/6] docs: keep release notes under Unreleased Co-authored-by: lmajano <137111+lmajano@users.noreply.github.com> --- changelog.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/changelog.md b/changelog.md index 92983b4..561c8e9 100644 --- a/changelog.md +++ b/changelog.md @@ -9,8 +9,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -## [3.8.0] - 2026-09-21 - ### Changed - Upgraded `cbauth` to `^7.0.0` to support thread-safe authentication startup.