Changelog

Security (35)

• JSON bodies hold at most 200 000 values (was 1 000 000), counted on the derive's direct path too, so a body of tiny values ([[],[],...]) stays near 15 MB of memory.
• Edge fetch: fetch ids skip ones a stream still reads after they wrap; a status outside 100 to 599 is a 502.
• Header values with a control byte other than tab (C0 controls, DEL) are refused in responses (dropped and logged) and in HTTP/2 requests (stream reset, as HTTP/1 already answered 400), pseudo-headers included.
• HTTP/2: a WINDOW_UPDATE that grants room when nothing was sent since the last one spends the idle-frame budget (a flood ends with ENHANCE_YOUR_CALM); the DATA byte count behind the body-rate check is a u64, so it cannot wrap on 32-bit targets.
• WebSocket: a message sent in pieces (a frame or fragments) must make progress every 10 s and come whole at 1 KB/s after that, or the socket closes with 1008, on the built-in server, HTTP/2 and raw edge connections.
• redirect(..) with a control byte (but tab) left inside the location is a 500, not a response with a bad location.
• A kept (CACHE) answer with its own content-encoding says vary: accept-encoding.
• OAuth: Provider::redirect must be https (or loopback http) with no fragment; in dev without ORIGIN the callback uses the Host only when it is loopback; an https OIDC issuer's discovered endpoints must be https.
• Dev mode on an address other than loopback (a debug build with HOST=0.0.0.0) signs with a key of its own process, never the .wisp/secret a checkout or image may carry.
• Cookies are Secure (the session, flash and OAuth ones __Host-) with no setting, except in dev, for plain http to localhost or a loopback address, an onion, or a proxy named by WISP_CLIENT_IP_HEADER that sends x-forwarded-proto: http; one warning names a Secure cookie that plain http will not return.
• x-forwarded-proto and x-forwarded-host are read from the trusted end of the header (WISP_CLIENT_IP_DEPTH, counted from the right), and x-forwarded-proto is believed only when WISP_CLIENT_IP_HEADER names a proxy.
• HTTP/2: a host header beside :authority must name the same host, or the request is malformed.
• Backoff (login lockout) keeps its lockouts under a flood of other keys: when the table is full, unlocked keys go first and then the newest lockouts, so a flood of made-up names drops its own, never an older lockout.