Harden control-plane responses before they can influence VPN runtime configuration.
Changes
Disable HTTP redirects for control-plane requests
Limit control responses to 256 KiB
Bind session responses to the expected nonce
Make cancellation generation-scoped
Validate VLESS UUID and REALITY/XHTTP fields
Pin the tunnel destination to the compiled public IP
Pin the tunnel port to 443
Reject private, reserved, malformed or unexpected addresses
Build VLESS URLs with Uri instead of manual concatenation
A compromised API/domain can fail a session but cannot silently redirect the VPN tunnel to another server.
## Summary
Harden control-plane responses before they can influence VPN runtime configuration.
## Changes
- Disable HTTP redirects for control-plane requests
- Limit control responses to 256 KiB
- Bind session responses to the expected nonce
- Make cancellation generation-scoped
- Validate VLESS UUID and REALITY/XHTTP fields
- Pin the tunnel destination to the compiled public IP
- Pin the tunnel port to 443
- Reject private, reserved, malformed or unexpected addresses
- Build VLESS URLs with Uri instead of manual concatenation
A compromised API/domain can fail a session but cannot silently redirect the VPN tunnel to another server.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Harden control-plane responses before they can influence VPN runtime configuration.
Changes
A compromised API/domain can fail a session but cannot silently redirect the VPN tunnel to another server.