LoginSign Up
← Back to all sparks
M

Miniflux

COLLAB
Velocity5.0

Minimalist self-hosted feed reader

miniflux.app ↗

Miniflux adds group-based admin roles and lets passkeys be the only login.

rsspasskeysoidcself-hostedsecurity-hardening
◆Current state
Miniflux 2.3.5 adds OpenID Connect admin role mapping from group claims, a force option on the feed refresh API and validation of CSS selectors in rewrite and scraper rules. Passkeys can now serve as the only login method when local authentication is disabled. The security list is long again, covering session sign-out on password change, feed cookie scoping and SSRF bypass blocks, following similar work in 2.3.4.
◆Where it's heading
The two threads from earlier this year continue, but the security work has broadened from authentication strictness to the server's network and session behavior. SSO is the new thread: admin mapping and an authentication settings page make Miniflux easier to run for a group rather than one person. API additions and validation messages keep serving people driving it from other software.
◆Prediction
The next release likely adds more identity options around OIDC and further SSRF hardening, since both have moved in consecutive releases. Neither is promised in these notes.

◆Recent moves

  1. 16h ago

    2.3.5 adds OIDC admin role mapping and passkey-only login

    Adds OIDC admin role mapping and passkey-only login, moving the security thread toward group deployments. Most of the rest is session, cookie and SSRF hardening, plus Fever API correctness fixes.

    View source ↗
  2. 13d ago

    2.3.4 adds Gotify and tightens SSRF protections

    Adds Gotify notifications and smaller indexes, and continues the hardening run with reserved IP blocking and tighter enforcement of DISABLE_LOCAL_AUTH. Per-feed proxies on private networks now need an explicit setting.

    View source ↗
  3. 3mo ago

    Feeds and entries now carry declared language

    Miniflux reads language from RSS, Atom, RDF and JSON Feed, stores it on both feeds and entries, and renders content with a matching lang attribute — which improves screen reader pronunciation, hyphenation and browser translation prompts. Consistent with the API thread, the field is exposed through both the HTTP API and the Go client.

    View source ↗
  4. 4mo ago

    Search gains phrases, OR and negation; new bulk entry endpoints

    Full-text search moves to PostgreSQL's websearch_to_tsquery, so quoted phrases, OR and -term negation work as users expect from a search box. The API additions — paginated entry IDs, bulk starred updates, tag filtering — are the clearest evidence of the integration-first direction.

    View source ↗
  5. 5mo ago

    OAuth binding, open redirect and SQL injection issues fixed

    Four security fixes including an OAuth account-binding flaw that let users attach arbitrary identities to their account, plus a partial retreat: the cross-origin protection middleware added in 2.3.0 was reverted after it blocked legitimate requests in some self-hosted setups.

    View source ↗
  6. 5mo ago

    WebAuthn login restricted to passkeys only

    ⚡ SPARK

    The hard edge of the security thread: only discoverable credentials can be used to sign in, which removes an entire class of WebAuthn key from first-factor login. The CSRF and POST-only changes shipped alongside it complete the lockdown of every non-safe request path.

    View source ↗