LoginSign Up
← Back to all sparks
M

Miniflux

COLLAB
Velocity2.5

Minimalist self-hosted feed reader

miniflux.app ↗

A minimal RSS reader that made passkeys the only way in, then went back to polishing the reading experience.

rsspasskeyspostgresqlapi-firstself-hostedsecurity-hardening
◆Current state
Miniflux ships a release roughly monthly, and the 2.2.19-through-2.3.1 stretch was almost entirely security work: OIDC token signature verification, PKCE state cleanup, SHA1 replaced with HMAC-SHA256 for Google Reader API auth, an OAuth account-binding vulnerability, an open redirect, and a possible SQL injection in dynamically built ORDER BY clauses. The two most recent releases return to product — full-text search on PostgreSQL's websearch_to_tsquery, an expanded API v1, and feed language detection.
◆Where it's heading
Two threads run in parallel. The security thread has systematically closed off every authentication path that was not cryptographically strict, culminating in 2.3.0 restricting WebAuthn login to discoverable passkeys only. The product thread is API-shaped: entry ID pagination, bulk starred updates, tag filtering, and a Go client that now exposes the full feed record — all aimed at people driving Miniflux from other software rather than its own UI.
◆Prediction
The API surface is the area with visible momentum, so the next release most likely extends filtering or bulk operations further. Whether the passkey-only stance loosens to accommodate post-password MFA is the open question these notes raise but do not answer.

◆Recent moves

  1. 10d ago

    Feeds and entries now carry declared language

    Miniflux reads language from RSS, Atom, RDF and JSON Feed, stores it on both feeds and entries, and renders content with a matching lang attribute — which improves screen reader pronunciation, hyphenation and browser translation prompts. Consistent with the API thread, the field is exposed through both the HTTP API and the Go client.

    View source ↗
  2. 1mo ago

    Search gains phrases, OR and negation; new bulk entry endpoints

    Full-text search moves to PostgreSQL's websearch_to_tsquery, so quoted phrases, OR and -term negation work as users expect from a search box. The API additions — paginated entry IDs, bulk starred updates, tag filtering — are the clearest evidence of the integration-first direction.

    View source ↗
  3. 2mo ago

    OAuth binding, open redirect and SQL injection issues fixed

    Four security fixes including an OAuth account-binding flaw that let users attach arbitrary identities to their account, plus a partial retreat: the cross-origin protection middleware added in 2.3.0 was reverted after it blocked legitimate requests in some self-hosted setups.

    View source ↗
  4. 2mo ago

    WebAuthn login restricted to passkeys only

    ⚡ SPARK

    The hard edge of the security thread: only discoverable credentials can be used to sign in, which removes an entire class of WebAuthn key from first-factor login. The CSRF and POST-only changes shipped alongside it complete the lockdown of every non-safe request path.

    View source ↗
  5. 4mo ago

    OIDC token verification and Google Reader API auth hardened

    The release that started the auth overhaul — OIDC ID token signatures and claims are actually verified, identity overwrite on linked accounts is blocked, PKCE and CSRF state are cleared after use, and Google Reader API auth moves from SHA1 to HMAC-SHA256. Secrets are also scrubbed from log output.

    View source ↗