aiden
/
mastodon
mirror of https://github.com/mastodon/mastodon
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mastodon/config/initializers
History
Ben Lubar 13e049d772 Allow cross-origin requests to /.well-known/* URLs. () 
Right now, this includes three endpoints: host-meta, webfinger, and change-password.

host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser.

change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled.

The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.
..
0_post_deployment_migrations.rb Add post-deployment migration system ()
1_hosts.rb Set Content-Security-Policy rules through RoR's config ()
active_model_serializers.rb Disable AMS logging ()
application_controller_renderer.rb Upgrade to Rails 5.0.0.1
assets.rb HTML e-mails for UserMailer ()
backtrace_silencers.rb Initial commit
blacklists.rb Quick best practice cleanup of views/helpers ()
chewy.rb Fix : Use pull queue for chewy jobs ()
content_security_policy.rb Add manifest_src to CSP, add blob to connect_src ()
cookies_serializer.rb Upgrade to Rails 5.0.0.1
cors.rb Allow cross-origin requests to /.well-known/* URLs. ()
devise.rb feat(cookies): Use the same-site attribute to lax ()
doorkeeper.rb Add unread indicator to conversations ()
fast_blank.rb fix can toot whitespace ()
ffmpeg.rb add ffmpeg initializer ()
filter_parameter_logging.rb Added optional two-factor authentication
http_client_proxy.rb lint pass 2 ()
httplog.rb Version bumps for ruby and misc gems ()
inflections.rb Add ActivityPub inbox ()
instrumentation.rb Improve StatsD instrumentation
kaminari_config.rb adjust public profile pages 2 ()
mime_types.rb Set correct content-type for ActivityPub JSON ()
oj.rb Remove rabl dependency ()
omniauth.rb lint pass 2 ()
open_uri_redirection.rb rubocop issues - Cleaning up ()
pagination.rb Pagination improvements ()
paperclip.rb Rename S3_CLOUDFRONT_HOST to S3_ALIAS_HOST. ()
premailer_rails.rb HTML e-mails for UserMailer ()
rack_attack.rb lint pass 2 ()
rack_attack_logging.rb Log rate limit hits ()
redis.rb Set config.cache_store in environments file. ()
session_activations.rb Revocable sessions ()
session_store.rb feat(cookies): Use the same-site attribute to lax ()
sidekiq.rb lint pass 2 ()
simple_form.rb Redesign forms, verify link ownership with rel="me" ()
single_user_mode.rb Add single user mode
statsd.rb Fix that Rails.cache information could not be sent via StatsD ()
stoplight.rb Add a circuit breaker for ActivityPub deliveries ()
strong_migrations.rb Fix migration failure due to StrongMigrations on production env ()
suppress_csrf_warnings.rb Suppress CSRF token warnings ()
trusted_proxies.rb Fix error
twitter_regex.rb Lint pass ()
vapid.rb Lint pass ()
wrap_parameters.rb Upgrade to Rails 5.0.0.1