Zuar Portal v1.19.1

Notes

Security

Session sign-in cookies are now issued with the HttpOnly flag, so the session token can no longer be read by page scripts.
Restricted TLS to strong, modern (AEAD) cipher suites.
Security headers (Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy, and X-Content-Type-Options) are now applied consistently to every response, and unauthenticated visitors are redirected straight to the HTTPS login page.

Bug Fixes

Fixed the Forgot Password flow, which could fail with a server error and never send a reset email. Reset emails are now delivered reliably, and the response no longer reveals whether a given username exists.
Fixed theme logos supplied as embedded (data) images not displaying because of the Content-Security-Policy.

Breaking Changes

None.

Issues Resolved in this Release

New Features

Issue	Summary	Resolution

Improvements

Issue	Summary	Resolution

Bug Fixes

Issue	Summary	Resolution
POR-2539	FE// Theme logo/favicon do not render - CSP blocks the blob: asset request	Done
POR-2510	SEC// Account enumeration on /forgot-password (existing user → 500, non-existent → 200); reset is also broken	Done
POR-2486	SEC// JWT session cookie missing HttpOnly flag — readable from JavaScript	Done

Tasks

Issue	Summary	Resolution
POR-2533	Intradiem Portal after creating their own domain - security vulernabilities	Done
POR-2532	Security test identified Weak Cypher Issue	Done