Repository navigation
Conversation
/policy/v3/* now gets the generic wildcard CORS policy (no Access-Control-Allow-Credentials). share_security_fairing keeps only the security and cache headers; the Share-only origin parameter is removed. Details: TC-2192
Details: TC-2192
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Browser calls from https://tinycloud.chat (and tauri://localhost) to
/policy/v3/*were blocked by CORS because the node answered with only the Share origin. This gives/policy/v3/*the same CORS as/invoke:Access-Control-Allow-Origin: *, same methods/headers,Access-Control-Max-Ageon preflights, and noAccess-Control-Allow-Credentials(no/policy/v3handler uses cookies or ambient credentials).share_security_fairingnow sets onlyCache-Control: no-store,X-Content-Type-Options,Referrer-Policy;cors_fairingis the single owner of CORS. Theshare_email.allowed_originsconfig and validation are unchanged (the email trust bundle still usesreturn_origin).Behavior note:
/policy/v3/*CORS headers are now emitted only whencorsis enabled, like/invoke.Refs TC-2192. No version bump or changelog.
test-ruling: TC-2192 (Naomi's ruling, in this builder's thread). Existing test lines changed,
tinycloud-node-server/src/lib.rs(pre-change numbering):chromium_policy_admission_preflight_allows_authorization: removedassert_eq!(ACAO, Some("https://share.tinycloud.xyz")).chromium_policy_admission_preflight_allows_authorization->policy_admission_preflight_keeps_security_headers(approved by Naomi).Cache-Control: no-store,X-Content-Type-Options: nosniff,Referrer-Policy: no-referrer.share_security_fairing("https://share.tinycloud.xyz".into())->share_security_fairing(); same arg removal inattach_response_fairings(...)callers at lib.rs:2657, auth_guards.rs:438, routes/public.rs:458.max_age_is_not_sent_on_actual_or_share_responsesrenamedmax_age_is_not_sent_on_actual_responses./policy/v3/*gets the generic CORS policy, same as/invoke".Some("https://share.tinycloud.xyz")->Some("*").Access-Control-Max-Ageis_none()->== Some("7200").New test:
cors_fairing_tests::policy_v3_preflight_and_post_match_invoke_for_any_origin(preflight + POST on/policy/v3/enforcer-bindingsand/challenges, from both origins, production fairing order: wildcard origin, no credentials, security/cache headers kept). It failed before the change.Staging stack note:
deploy/share-email/docker-compose.staging.yamlsetsTINYCLOUD_CORS=false. The current staging inventory (docs/plans/staging-environments.md, row 45) says tinycloud-node has no hosted non-production instance and describes this compose as hand-run and unused; repository references show no deployment workflow or browser Share consumer for it. No browser Share traffic through this stack is evidenced, so the CORS setting is unchanged.