You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Ben Lubar 13e049d772 Allow cross-origin requests to /.well-known/* URLs. (#9083) ... Right now, this includes three endpoints: host-meta, webfinger, and change-password. host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser. change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled. The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.		6 years ago
..
0_post_deployment_migrations.rb	Add post-deployment migration system (#8182)	6 years ago
1_hosts.rb	Set Content-Security-Policy rules through RoR's config (#8957)	6 years ago
active_model_serializers.rb	Disable AMS logging (#7623)	6 years ago
application_controller_renderer.rb	…
assets.rb	…
backtrace_silencers.rb	…
blacklists.rb	…
chewy.rb	…
content_security_policy.rb	Add manifest_src to CSP, add blob to connect_src (#8967)	6 years ago
cookies_serializer.rb	…
cors.rb	Allow cross-origin requests to /.well-known/* URLs. (#9083)	6 years ago
devise.rb	feat(cookies): Use the same-site attribute to lax (#8626)	6 years ago
doorkeeper.rb	Add unread indicator to conversations (#9009)	6 years ago
fast_blank.rb	…
ffmpeg.rb	add ffmpeg initializer (#8855)	6 years ago
filter_parameter_logging.rb	…
http_client_proxy.rb	lint pass 2 (#8878)	6 years ago
httplog.rb	…
inflections.rb	…
instrumentation.rb	…
kaminari_config.rb	…
mime_types.rb	…
oj.rb	…
omniauth.rb	lint pass 2 (#8878)	6 years ago
open_uri_redirection.rb	rubocop issues - Cleaning up (#8912)	6 years ago
pagination.rb	…
paperclip.rb	Rename S3_CLOUDFRONT_HOST to S3_ALIAS_HOST. (#8423)	6 years ago
premailer_rails.rb	…
rack_attack.rb	lint pass 2 (#8878)	6 years ago
rack_attack_logging.rb	Log rate limit hits (#7096)	7 years ago
redis.rb	…
session_activations.rb	…
session_store.rb	feat(cookies): Use the same-site attribute to lax (#8626)	6 years ago
sidekiq.rb	lint pass 2 (#8878)	6 years ago
simple_form.rb	Redesign forms, verify link ownership with rel="me" (#8703)	6 years ago
single_user_mode.rb	…
statsd.rb	Fix that Rails.cache information could not be sent via StatsD (#8831)	6 years ago
stoplight.rb	…
strong_migrations.rb	…
suppress_csrf_warnings.rb	…
trusted_proxies.rb	…
twitter_regex.rb	Lint pass (#8876)	6 years ago
vapid.rb	Lint pass (#8876)	6 years ago
wrap_parameters.rb	…