OWASP Juice Shop Files

🎯 Challenges

• Added new Passkey Bypass ⭐⭐⭐⭐⭐-challenge (including coding challenge)
• Added new Passkey Hijack ⭐⭐⭐⭐⭐-challenge (including coding challenge)
• big thanks to the authors of the "The State of Passkey" paper for the challenge inspiration, special kudos to @lonetis for helping to review the challenges
• Tagged challenges with new Technology tags (e.g. SQL, NoSQL/MongoDB, JWT, OAuth, 2FA/TOTP, XML)

🎨 User Interface

• Added Passkey/WebAuthn passwordless authentication and dedicated passkey management screen (including provider name and icon display)
• Put challenge tags in the Score Board filter settings into groups (Constraints, Flavor, Learning, Technique, Technology) with translatable labels and delayed tooltips
• Highlighted Tutorial and Coding Challenge buttons on challenge cards when filtering for the corresponding tag
• Increased Score Board filter dropdown box sizes to prevent unnecessary scrolling
• Added missing Windows icon to challenges unavailable warning card
• Modernized layout and styling of alternative login options on the login screen
• Enhanced contrast of the lime-green theme
• [#3716]: Restructured product review list with edit pencil icon, animated like counter on the thumb icon and rejection of whitespace-only reviews (kudos to @bogminic)
• [#3720]: Standardized layout of saved addresses table and address form with more intuitive input field order (kudos to @bogminic)
• [#3703]: Added button to edit user messages in the AI chat (kudos to @sumezulike)

🛒 Shop

• Added new customer user passkey-user (for passkey challenges)

🐛 Bugfixes

• [#3713]: Fixed duplicate WebSocket listeners on the Score Board (kudos to @arunvox)
• Fixed Customer Feedback form from going into invalid state after successful submission
• Fixed product reviews being liked multiple times by quickly clicking repeatedly (kudos to @bogminic)
• Submit a present process.env.LLM_API_KEY also during LLM model availability check as Authorization: Bearer token
• [#3707]: LLM token metrics are now properly tracked and reported (kudos to @sumezulike)

🧹 Technical Debt

• Reduced number of backend dependencies
• Replaced several module dependencies with native Node.js function calls
• Replaced several module dependencies with small narrow-scoped functions or libraries
• Migrated product review and address forms to Angular Signal Forms (kudos to @bogminic)
• [#3719]: Fixed user session handling when running the frontend via ng serve during development (kudos to @bogminic)
• Migrated end-to-end tests to Cypress 16.x and stabilized their CI/CD execution
• Extended unit test coverage of backend and frontend components

⚙️ DevOps Automation

• Added GitHub Actions workflow for spam issue checking similar to the existing pull request compliance checking

📜 Policy

• Vulnerability reports via email must not contain any attachments as these will not be opened for security reasons
• Clarified in AGENTS.md that unsolicited AI-driven bug-hunting pull requests are not wanted

🌐 I18N

• Updated translations for multiple languages via Crowdin