Build the optional test helper with -DBUILD_SECURITY_TESTS=ON. The helper exercises response formatting, framing, session handling, and argument quoting using the production implementation.
Run python3 tests/security_server.py /absolute/path/to/build for basic local server checks. It starts a daemon on a temporary loopback port, uses temporary logbook/configuration data, and stops the daemon afterward. It requires Python 3 and a Unix-like host.
For sanitizer checks, configure both compiler and executable linker flags with -fsanitize=address,undefined -fno-omit-frame-pointer.
Compatibility notes for these fixes:
- Reverse proxies must be listed by their connection IPv4 address in
[global] Trusted proxiesand must replace client-supplied forwarded headers. - Previously issued pending-registration links need to be reissued; new registrations use a separate pending activation token. Existing active accounts are unaffected.
- Outbound HTTPS now requires a trusted certificate matching the remote hostname. OpenSSL's normal certificate trust configuration applies.