FreddleSpl0it
7a3f1cbd41
Merge pull request #7530 from ThxGiving/fix/eas-auth-challenge
...
[Nginx] Send Basic auth challenge for unauthenticated ActiveSync requests
2026-11-10 01:39:28 +01:00
FreddleSpl0it
1a42c19050
[Nginx] Accept a trailing slash in /edit and /qhandler links
2026-11-09 23:08:14 +01:00
FreddleSpl0it
3c03f8e567
Merge branch 'fix/sec' into fix/rework-bugs
2026-11-04 11:46:47 +01:00
FreddleSpl0it
e96fb24a67
[Nginx][Web] Pass the client address to sogo-auth for EAS/DAV logins
2026-11-02 14:44:09 +01:00
FreddleSpl0it
4c7e2ec036
[Nginx] Limit request body size, configurable via NGINX_MAX_BODY_SIZE
2026-10-28 16:54:26 +01:00
FreddleSpl0it
085d10118d
[Nginx][Web] Client address and autodiscover adjustments
2026-10-28 16:36:16 +01:00
Sebastian Müller
8db3cae826
[Nginx] Send Basic auth challenge for unauthenticated ActiveSync requests
...
Outlook for iOS/Android connects through Microsoft's sync service, which
sends each EAS command without credentials first and only retries with
Basic auth after a 401 + WWW-Authenticate challenge. SOGo answers these
unauthenticated POSTs (Provision, FolderSync, Sync, ...) with 403, so the
Outlook apps never get past Provision and show an empty mailbox (#5846 ).
Answer requests without an Authorization header with a Basic challenge
in nginx before they reach SOGo. Clients that send credentials up front
are not affected.
2026-10-20 20:48:30 +02:00
FreddleSpl0it
91d3b7246a
[Web] Minor hardening across web UI and nginx
2026-08-18 09:08:17 +02:00
FreddleSpl0it
ddd76d99cd
[Web] Add sogo_auth_internal nginx marker for sogo-auth.php
2026-07-23 10:10:29 +02:00
FreddleSpl0it
e848226062
[SOGo] Update paths from /usr/lib/ to /usr/local/lib/
2026-03-06 16:26:13 +01:00
Patrik Kernstock
ae3ef391ee
Remove deprecated 'X-XSS-Protection' header ( #6871 )
2025-11-13 15:16:44 +01:00
DerLinkman and FreddleSpl0it
c39712af67
pf/php: add mta-sts support (outbound) ( #6686 )
...
* added mta-sts-resolver into postfix config + daemon
* [Web] Add MTA-STS support
* [Web] Fix mta-sts server_name
* updated .gitignore
* [ACME] fetch cert for mta-sts subdomain
* [Web] change MTA-STS id to human-readable timestamp
* [Web] Remove MTA-STS version STSv2
* [Web] Fix MTA-STS DNS check
* [Web] add max_age limit for MTA-STS policy
* Added tooltips and info texts to mta-sts webui page
* postfix: replace mta-sts-resolver with postfix-tlspol
---------
Co-authored-by: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com >
2025-08-26 09:57:05 +02:00
FreddleSpl0it
a567d5dc31
[Nginx] Add support for trusted proxies via env var
2025-02-18 11:03:34 +01:00
FreddleSpl0it
3a81b84cf7
[Nginx] Fix #6275
2025-01-30 14:49:18 +01:00
FreddleSpl0it
7bcd61ecb5
[Nginx] Generate includes for custom configs
2025-01-22 14:30:47 +01:00
FreddleSpl0it
Sebastian Müller
Patrik Kernstock
DerLinkmanandFreddleSpl0it
FreddleSpl0it