GoBlog 0.12.0: a safer GitHub login and half the blocking CSS

GoBlog 0.12.0 fixes a weakness in signing in with GitHub and takes most of the CDN stylesheets off the critical path. If you run GoBlog, upgrade.

Signing in with GitHub is the server's job now

The GitHub login used to finish in the browser: the login page read the code GitHub sent back and posted it to /api/login, which exchanged it and set the session. Nothing tied that code to the visitor who started the login, so a code obtained for one account could be replayed into another visitor's browser, leaving them signed in as somebody else.

/login/github now creates an unguessable state, keeps it in the session and sends it to GitHub. The code is exchanged only if that state comes back unchanged, and the state is spent either way. /api/login has been removed.

Pages stop waiting on cdnjs

Render-blocking CSS on a public page drops from 67.6 KB to 31.3 KB gzipped. Each stylesheet got its own answer, based on how much of it GoBlog actually used:

• Bootstrap stays blocking, because its rules do the layout.
• Font Awesome loads asynchronously.
• Tachyons is removed. GoBlog used four rules from it, which now live in a small stylesheet GoBlog serves itself, so every theme keeps working.
• bootstrap-social loads on the login page only.

The install wizard reports its own failures

The Test Database button could turn green on a request the server never looked at, and when a request did fail the reason never appeared. Both are fixed.

Update your theme

If you run Forest or Minimal, install the new version:

• Forest v1.3.0
• Minimal v1.1.0

Older versions build the GitHub login URL themselves, without a state. You will not be locked out: GoBlog restarts the login when a callback arrives with no state. But it costs an extra round trip to GitHub, so update the theme. Both themes now require GoBlog 0.12.0, and the theme directory offers them only once you are on this release.

Full notes: v0.12.0 on GitHub.