Repository navigation
Restricting access to some HTTP API endpoints to top domain - #1073
Conversation
megoth
changed the title
megoth
changed the title
|
This is an attempt to fix #1031 |
|
I need to do a bit more to make sure that capability discovery does not break (making sure the URLs point to the top domain endpoints). Don't merge this before that is in place. |
|
I'm closing this until I have the other part in place - will work on it tomorrow, and reopen the PR when it's done. |
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692
Login and logout should be accessible on subdomains Restricting access to API endpoints to top domain
abc0d6c to
f02987d
Compare
Should be able to login and logout and keep tokens updated via endpoints on subdomain
|
Ok, have laxed a bit on some resources that I think should be accessible via subdomain. These are |
|
Capability discovery should be working as expected now, if I have understood it correctly. Maybe @RubenVerborgh, @dmitrizagidulin and/or @kjetilk can give this a new look? |
kjetilk
left a comment
kjetilk
left a comment
There was a problem hiding this comment.
This looks sane to me, but I would like more reviews, as I'm not too confident about it myself.
[Snyk] Fix for 1 vulnerable dependencies
Closes #1106.
Revert "Making proper use of strictOrigins"
Expand SolidHost config constructor, plus tests
Login and logout should be accessible on subdomains Restricting access to API endpoints to top domain
Should be able to login and logout and keep tokens updated via endpoints on subdomain
…solid-server into feature/prevent-api-spoofing
There was a problem hiding this comment.
Approving this to unblock the 5.0.0 release, since technically this is a breaking change, but since this PR does not add any tests to cover the new functionality, we have to be careful: As discussed on gitter, we'll be relying on @kjetilk's manual testing to make sure this does not, for instance, accidentally break these endpoints on the top domain somehow.
kjetilk
left a comment
kjetilk
left a comment
There was a problem hiding this comment.
I have tested it manually, and it looks good.
8 participants
This is to prevent attempts at spoofing such as
https://[subdomain]/register.