Varnish Controller 7.0.1 Release

Adjustment of default behavior in the Controller-UI

This release contains an updated version of the Gorilla CSRF protection library with a fix to CVE-2025-24358. This fix makes it necessary to explicitly turn off checks of the HTTPS-specific Origin header.

See the security settings for the Controller-UI examples for further details.

Necessary change for plaintext installations

Installations, that do NOT use TLS need to add the -no-tls flag to their UI server startup command.

Not adding the -no-tls flag will result in the error message Forbidden - origin invalid when trying to log in.

Possible problem with reverse proxies

Running the Controller-UI behind a reverse proxy such as Varnish or nginx might result in the error message Forbidden - origin invalid if the HTTP Host header is changed by the proxy.

In Varnish, make sure to not change the req.http.host variable.

In nginx, add the following configuration directive behind the proxy_pass directive:

proxy_set_header Host $http_host;

Other installation types

Installations that use the -tls parameter or TLS termination through external software such as Hitch or relayd do not need to change anything.

IDP callback parameter now obsolete

When using external identity provider with external TLS termination, the parameter -idp-https-redirect doesn’t need to be set any longer, since the correct URL can not be determined from the -no-tls parameter.

Setting -idp-https-redirect does not have an effect any longer. It should be removed since with the next major release, setting the parameter will result in an error.

Further changes

• UI now has support for loadAllSans option in certificates.
• Allow to stop aggregation queries from running when using the -keep-stats-* configurations.
• Add support to export routing healths in prometheus for monitoring purposes.
• Fixed duplicate labels on Prometheus output.
• Fixed cleaning counter names for S3 and UDO statistics from IP addresses.
• Upgrade dependencies to resolve CVEs.
• API documentation has been updated with a lot of bug fixes and improvements. Note that these changes could break API generators. However, the API itself has not been changed.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.