Skip to content

feat: enforce HTTPS for BOOKSTACK_BASE_URL - #71

Merged
paradoxbound merged 2 commits into
mainfrom
feat/enforce-https
Mar 8, 2026
Merged

paradoxbound merged 2 commits into
mainfrom
feat/enforce-https

Conversation

@paradoxbound

Copy link
Copy Markdown
Owner

Summary

  • Rejects BOOKSTACK_BASE_URL values that do not use https:// — server exits with a clear error on startup
  • Updates SECURITY.md threat assessment to reflect that insecure transport is now enforced, not advisory
  • Bumps version to 2.6.0 (minor bump — behaviour change for operators using http://)

Test plan

  • Starting server with BOOKSTACK_BASE_URL=http://... prints error and exits
  • Starting server with BOOKSTACK_BASE_URL=https://... starts normally
  • npm run type-check passes

🤖 Generated with Claude Code

Signed-off-by: Paradoxbound <paradoxbound@users.noreply.github.com>
Signed-off-by: Paradoxbound <paradoxbound@users.noreply.github.com>
@paradoxbound
paradoxbound merged commit d763dc0 into main Mar 8, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant