LoginSign Up
← Back to all sparks
R

RaspAP

DEVOPS
Velocity5.0

Web interface for managing wireless access points

raspap.com ↗

RaspAP follows its big VPN release with a security pass on the API and admin login.

raspberry-piwifiaccess-pointvpnsecurity-hardeningself-hosted
◆Current state
RaspAP 3.5.6 in late September merged the Insiders-only features into the public release, and 3.5.9 on 1 November rebuilt VPN handling with WireGuard kill-switch fixes, an uplink watchdog and NetworkManager support. 3.5.10 on 12 November is a hardening release: the REST API now refuses requests without a key and runs as its own system user, reset, update and debug endpoints require POST, OpenVPN and login files are kept private, and admins must change the default password after three logins. It also fixes 802.11n detection and allows 802.11n on 5 GHz.
◆Where it's heading
After a command-injection fix in 3.5.8 and the large 3.5.9 rework, the project is tightening defaults for exposed installs: private files, authenticated API calls and forced password changes. A small group of contributors now ships most of the changes, and release cadence has picked up from bimonthly to every few weeks.
◆Prediction
Expect more point releases in the 3.5 line that close review findings and tighten defaults, rather than a new headline feature soon.

◆Recent moves

  1. 2d ago

    3.5.10 locks down the REST API and forces an admin password change

    A hardening release after the 3.5.9 rework: the REST API rejects keyless requests and runs as its own user, state-changing endpoints require POST, sensitive files are made private, and the admin must replace the default password after three logins. It continues the security work that began with the 3.5.8 injection fix.

    View source ↗
  2. 12d ago

    3.5.9: VPN kill-switch fixes, uplink watchdog, NetworkManager support

    Dozens of pull requests: WireGuard kill-switch fixes, an uplink watchdog, NetworkManager for Wi-Fi client networks, captive-portal access while the kill switch is on, and login required for QR code pages. It moves the project's effort from the dashboard into VPN and routing correctness.

    View source ↗
  3. 1mo ago

    3.5.8 fixes command injection in SSID and OpenVPN handling

    Fixes command injection in SSID and OpenVPN configuration handling. A security fix that matters for any RaspAP install reachable by untrusted users.

    View source ↗
  4. 1mo ago

    3.5.7 removes repository checks from the plugin handler

    Removes repository checks from the plugin handler and updates README images. Cleanup after the Insiders merge.

    View source ↗
  5. 1mo ago

    3.5.6 merges Insiders-only features into the open release

    Merges the Insiders-exclusive features into the public release and extends user theme customisation. It changes what the free version includes, though the notes don't list which features moved.

    View source ↗
  6. 4mo ago

    Dynamic IP bridged mode toggle and non-ASCII SSID fix

    Adds a dynamic IP toggle for bridged mode and fixes handling of non-ASCII SSIDs that previously raised a TypeError, plus compiled translation files. Small, practical fixes of the kind that dominate this feed between the larger interface drops.

    View source ↗