Ghost Release: 4.48.7

TL;DR

Ghost v4.48.7 introduces important CORS handling improvements that fix potential caching issues with cross-origin requests. This release adds proper Vary: Origin headers to both Admin API and Frontend responses, ensuring that CORS requests are correctly cached based on their origin. The update is particularly important for Ghost installations behind caching proxies or CDNs.

Highlight of the Release

• Fixed CORS handling to properly set Vary: Origin headers for OPTIONS requests
• Improved caching behavior for cross-origin requests in both Admin API and Frontend
• Enhanced CORS middleware to prevent header leakage to non-CORS requests

Migration Guide

No migration steps are required for this release. The CORS handling improvements are applied automatically when you upgrade to v4.48.7.

Upgrade Recommendations

This release is recommended for all Ghost users, especially those running Ghost behind caching proxies, CDNs, or those who rely on cross-origin requests to their Ghost installation. The CORS fixes address important caching behavior that could affect API functionality.

Bug Fixes

CORS Handling Improvements

• Fixed CORS header handling in Admin API: Added proper Vary: Origin header values for OPTIONS requests to ensure correct caching of CORS responses in shared caches and CDNs.

• Fixed CORS header handling in Frontend: Implemented the same Vary: Origin header for OPTIONS requests on frontend endpoints to properly bucket "allowed CORS" and "disallowed CORS" responses.

• Fixed CORS vary header modification: Modified the CORS middleware to only set the 'Vary' header with 'Origin' value when processing OPTIONS requests, preventing header leakage to other parts of the request pipeline.

• Improved CORS middleware unit tests: Updated tests to properly use the OPTIONS request method, ensuring test coverage for the actual CORS handling logic used in production.

New Features

No new features were introduced in this release. This update focuses exclusively on fixing CORS-related issues.

Security Updates

While not explicitly labeled as security fixes, the CORS improvements in this release address potential security concerns related to cross-origin resource sharing. Proper implementation of the Vary: Origin header helps prevent cache poisoning scenarios where CORS responses might be incorrectly served across different origins.

Performance Improvements

This release doesn't include specific performance improvements, but the CORS-related fixes will improve caching efficiency for cross-origin requests, potentially resulting in better performance for sites using CDNs or caching proxies.

Impact Summary

Ghost v4.48.7 focuses on fixing CORS (Cross-Origin Resource Sharing) handling issues that could affect sites using caching proxies or CDNs. By properly implementing the Vary: Origin header for OPTIONS requests in both the Admin API and Frontend, this release ensures that CORS responses are correctly cached based on their origin.

This is particularly important for Ghost installations that:

• Are deployed behind CDNs or caching proxies
• Serve content to multiple origins
• Have third-party integrations that make cross-origin requests

The fixes prevent scenarios where cached CORS responses might be incorrectly served across different origins, which could lead to API access issues or frontend functionality problems. While this is a minor release with focused changes, it addresses an important aspect of web standards compliance and proper HTTP caching behavior.

Full Release Notes