LeafWiki v0.7.0 – Security Upgrade, Authentication & UX Improvements

[perber]

Hey folks,

I’m excited to announce that LeafWiki v0.7.0 is now available!
This release focuses on security, authentication, and several UX improvements based on direct user feedback.

Security & Authentication Upgrade

• Session-based authentication backed by a local database
• Secure, HttpOnly cookies enabled by default
• CSRF protection for all state-changing requests
• Rate limiting on authentication-related endpoints
• Configurable access and refresh token timeouts
• New --allow-insecure flag for HTTP-only setups
• New --disable-auth flag for trusted internal environments

These changes provide safer defaults while still allowing flexibility for local development and internal use cases.

---

Access Control

• Added a viewer role for read-only access
• Allow editing without login when authentication is disabled

---

UI/UX Improvements

Several improvements in this release are directly based on user feedback:

• Sidebar is now open by default on desktop (thanks @Tak-MK for the suggestion)
• Images can now be zoomed when clicked (idea by @Tak-MK)
• Fixed a bug when changing the theme while editing a page (reported by @Tak-MK)
• Added Metadata to pages (created at, updated at, ...)

Thanks 🙌

• A big thank you to @Tak-MK for multiple UX reports and ideas that directly shaped this release.
• Thanks to @nicgord for providing the community importer tool to bootstrap existing Markdown structures.
• And as always, thanks to @Hugo-Galley for bringing in ideas and hands-on contributions, and to @magnus-madsen for his continued feedback.

This release is a bigger step forward for LeafWiki, and I hope you enjoy using it as much as I enjoyed building it!

If you experience any issues, please feel free to open an issue on GitHub.

[Tak-MK]

Thanks a lot for the update and for how quick was it! 😄