You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Ben Lubar 13e049d772 Allow cross-origin requests to /.well-known/* URLs. (#9083) ... Right now, this includes three endpoints: host-meta, webfinger, and change-password. host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser. change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled. The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.		6 years ago
..
environments	…
initializers	Allow cross-origin requests to /.well-known/* URLs. (#9083)	6 years ago
locales	…
webpack	…
application.rb	…
boot.rb	…
brakeman.ignore	…
database.yml	…
deploy.rb	…
environment.rb	…
i18n-tasks.yml	…
navigation.rb	…
puma.rb	…
routes.rb	…
secrets.yml	…
settings.yml	…
sidekiq.yml	…
themes.yml	…
webpacker.yml	…