Gately v0.6.5.3 released

November 10, 2026

Download v0.6.5.3 · GitHub Release

Security fix: response cache

Until now, a reverse proxy site with the in-memory response cache on and a "Default duration" above 0 cached responses to requests carrying credential headers such as X-Emby-Token, X-Api-Key and X-Plex-Token, or credential query parameters such as api_key, token and access_token; other visitors requesting the same address could then receive that response. In addition, when a site had both CORS and caching on, the cache stored the CORS headers written for one origin along with the response, so cross-origin requests from other origins failed. In this release:

• Requests with common credential headers or credential query parameters are never cached in any mode, the same as Authorization and Cookie;
• Cache entries do not store the CORS headers Gately writes for the visitor's origin; they are generated again for each request on a hit. Responses are not cached when the backend's Vary lists request headers other than Accept-Encoding (and Origin when the site has CORS on);
• Requests whose path contains ;, \, %2F or %5C bypass the cache.

Sites that use the response cache should upgrade soon.

Navigation panels (#78)

"Web → Navigation panels" in the left menu manages a panel library: it gathers links to the services you use into one page, by group. Then add a site of type "Navigation panel" in the Web service and choose the panel.

• Each link has a name, group, description, public address and an optional LAN address, an icon and a color; LAN visitors (loopback, private and link-local addresses, or the panel's extra LAN ranges) use the LAN address automatically, and the page can switch between them;
• Each link can carry up to 8 "Other access methods", for example direct IPv6, frp, STUN traversal or a Cloudflare tunnel;
• 110 built-in icons (Gately modules, common apps, systems and network devices, generic icons), or an emoji, an image URL or an uploaded image;
• Addresses accept {host}, {port}, {1} and STUN variables, and links can be created with "Add from Web service sites"; the page has search and light and dark themes;
• The page is generated by the server and runs only built-in styles and scripts with a random nonce; site authentication, IP access control, country filtering and the WAF apply as usual.

LAN or public is decided by the visitor's direct address: when public visitors come in through a local frpc, cloudflared or a Docker port mapping, turn on the PROXY protocol on the listener or configure trusted proxies. See Web Service · Navigation panels.

Visitor audit

"Web → Visitor audit" summarizes access to all sites by visitor address: first and latest visit, requests and blocks per day, status code distribution, block reasons, and the sites, paths, identities and User-Agents seen. Statistics cover today, 7 days, 30 days or the whole retention period, with filters for blocked, authenticated, administrator, currently banned and scanner visitors plus search; the details let you ban the address or open its access log directly.

Only per-visitor aggregate counts are stored, and only the path part of each URL; query strings, request bodies, cookies and credentials are never recorded. The data is compressed and kept in the configuration directory (outside configuration backups); the retention days (30 by default) and the visitor limit (10000 by default) are adjustable, and the feature can be turned off. See Web Service · Visitor audit.

Network topology replay

The network topology gains "Replay": once recording is on, a snapshot of the whole topology is saved every 5 seconds, in memory only, keeping the newest data within a capacity limit (8 MB by default), so periods with little traffic cover a longer span. The timeline shows traffic as an area chart and marks in red the periods when a listener failed to start or a backend had errors; you can drag to a point, step frame by frame, play at 1× to 60× and skip idle periods, and the seven layouts, filters, masking and focus on activity all work during replay. Recording is off by default, and turning it off clears the data.

Per-path cache rules (#77)

The response cache of a reverse proxy site accepts per-path rules: "Don't cache", a separate duration, or "Force cache" (ignores the backend's no-store, no-cache and max-age, still respects private). More specific rules take precedence; the "Traffic" tab shows the number of cached entries and their size, and can clear the whole cache or the cache under one rule's path. Force-cached responses are shared by all visitors, so use it only for content that does not depend on who the visitor is.

Web terminal: host fingerprints checked by key type

Servers usually have several host keys at once: ECDSA, RSA and Ed25519. The Web terminal now records the key type with the fingerprint (shown as ECDSA SHA256:...) and negotiates only that key type; when the type is missing or does not match, it tries the other types one by one and accepts only a key that matches the recorded fingerprint. A fingerprint of any type obtained from tools such as ssh-keyscan can be used directly, without a false "Host key has changed" warning. The host key is still checked before authentication, and no password is sent when no fingerprint matches.

Log panel

The drag bar below the log area adjusts its height (arrow keys work too), a double click restores the default, and the browser remembers the height; the toolbar gains a "Full screen" button, and Esc exits; while you read older entries, new logs no longer pull the view back to the bottom, and the "Jump to latest" button shows how many entries arrived in the meantime.

Fixes

• When a site is accessed by IPv6 address, {host} in redirect and path rewrite rules keeps its brackets; path rewrite rules check the characters of {host} the same way as redirect variables, and a Host with invalid characters gets a 400.