specter/mastodon
1
0
Fork 0
forked from fedi/mastodon
Code Pull requests Activity

Allow cross-origin requests to /.well-known/* URLs. (#9083)

Browse source 
Right now, this includes three endpoints: host-meta, webfinger, and change-password.

host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser.

change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled.

The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.
This commit is contained in:
Ben Lubar 2018-10-24 20:13:35 -05:00 committed by Eugen Rochko
parent 4ea718ef18
commit 13e049d772
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
config/initializers/cors.rb
View file

@ -9,6 +9,10 @@ Rails.application.config.middleware.insert_before 0, Rack::Cors do
allow do allow do
origins '*' origins '*'
resource '/.well-known/*',
headers: :any,
methods: [:get],
credentials: false
resource '/@:username', resource '/@:username',
headers: :any, headers: :any,
methods: [:get], methods: [:get],