TeamPiped-mirror/Piped-Docker
1
0
Fork 0
mirror of https://github.com/TeamPiped/Piped-Docker.git synced 2024-08-14 23:56:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

Update CORS headers to be more strict

Browse source 
When running the frontend CORS was set to `*` on the proxy and unset on the API.
Updated to use the `FRONTEND_HOSTNAME` instead.
This commit is contained in:
Nick the Sick 2021-09-26 21:58:35 -07:00
parent eb62697497
commit bc8dbbb136
3 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
template/Caddyfile
View file

@ -24,8 +24,14 @@ FRONTEND_HOSTNAME {
} }
BACKEND_HOSTNAME { BACKEND_HOSTNAME {
reverse_proxy varnish:80 reverse_proxy varnish:80 {
# remove `*` from the `Access-Control-Allow-Origin` header
header_down -Access-Control-Allow-Origin
}
header { header {
# enable CORS for the frontend hostname
Access-Control-Allow-Origin https://FRONTEND_HOSTNAME
# disable FLoC tracking # disable FLoC tracking
Permissions-Policy interest-cohort=() Permissions-Policy interest-cohort=()
@ -48,7 +54,8 @@ PROXY_HOSTNAME {
} }
header { header {
Access-Control-Allow-Origin * # enable CORS for the frontend hostname
Access-Control-Allow-Origin https://FRONTEND_HOSTNAME
Access-Control-Allow-Headers * Access-Control-Allow-Headers *
# disable FLoC tracking # disable FLoC tracking

2
template/pipedapi.conf
View file

@ -6,5 +6,7 @@ server {
proxy_pass http://varnish:80; proxy_pass http://varnish:80;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Connection "keep-alive"; proxy_set_header Connection "keep-alive";
proxy_set_header Access-Control-Allow-Origin FRONTEND_HOSTNAME;
proxy_set_header Access-Control-Allow-Headers *;
} }
} }

2
template/ytproxy.conf
View file

@ -1,4 +1,4 @@
add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Origin FRONTEND_HOSTNAME;
add_header Access-Control-Allow-Headers *; add_header Access-Control-Allow-Headers *;
if ($request_method = OPTIONS ) { if ($request_method = OPTIONS ) {
return 200; return 200;