Add multiple security hardenings across the server and web console: enforce proof-of-possession for /ws/bd-mgmt using Ed25519-signed headers with timestamp/nonce and replay protection (public key binding, canonicalization, storage, verification, and tests); remove legacy API key query param and config-table fallback in favor of scoped api_keys (migrate bootstrap key into api_keys); tighten WebSocket origin handling for relay and signal servers to allow only localhost origins by default unless an explicit allowlist is set; update auth middleware public paths and test helpers to use X-API-Key header; add ensureScopedAPIKey migration and related helpers; add a GitHub Secret Scan workflow and an audit report. Misc: propagate audit logging on bd-mgmt connect/disconnect and validate enrollment public keys during device register.
Critical security fix banning a device in the web console now actually
blocks that device from:
Go Server (signal/handler.go):
- handleRegisterPeer: reject banned peers on UDP heartbeat
- handleRegisterPeer: check DB IsPeerBanned for new peer registration
- handlePunchHoleRequestTCP: reject connections to banned targets
- handleRequestRelay (UDP): reject relay to banned targets
- handleRequestRelayTCP: reject relay to banned targets
Go Server (signal/ws.go):
- handleRegisterPeerWS: reject banned peers on WS heartbeat
- handleRegisterPeerWS: check DB for new WS registrations
Go Server (api/server.go):
- handleBanPeer: remove peer from memory map (immediate disconnect)
- handleBanPeer: update DB peer status to OFFLINE
Node.js Client API (rustdesk-api.routes.js):
- POST /api/heartbeat: reject heartbeats from banned devices
- POST /api/sysinfo: reject sysinfo from banned devices
- POST /api/login: reject login from banned devices
Root cause: ban flag (entry.Banned / is_banned) was correctly stored in
database and memory but never checked in any signal handler. The signal
handler only checked the separate blocklist system (IsIPBlocked/IsIDBlocked)
which is a completely different feature. Banned peers continued to register,
heartbeat, and participate in PunchHole/Relay operations normally.
Added test: TestBanRemovesPeerFromMap verifies end-to-end that banning via
API removes the peer from the in-memory map and sets OFFLINE status.
Add a new betterdesk-server Go codebase (server, api, auth, db, relay, signal, metrics, audit, ratelimit, proto, tools, tests) and related deployment/migration scripts. Add a comprehensive SECURITY_AUDIT_2026-03-01 report and .gitattributes; update copilot-instructions (ALL-IN-ONE v2.4.0), README, VERSION, Dockerfiles, scripts, docker-compose and entrypoint. Large updates to web-nodejs (translations, routes, services, frontend assets and middleware) and numerous new utilities; remove legacy Flask web files and archive hbbs-patch-v2 artifacts. Prepares repository for PostgreSQL support, DB migration tooling and the new Go server as the production backend.
UNITRONIX