search

google / nginx-sxg-module

NGINX SXG module
Apache License 2.0
78 stars 18 forks source link

feat: add sxg_fallback_host option #87

Closed orisano closed 3 years ago

orisano commented 3 years ago

We want to specify a fallback URL origin manually.

Background

architecture

Currently, this module uses the Host header field's value to construct the fallback URL. In this case, the fallback URL's origin is origin.example.com. We have to specify the validity URL's origin to example.com. (cannot access origin from the internet)

But "validity-url" parameter is must be same-origin with requestUrl (fallback URL).

If the signature's "validity-url" parameter (Section 3.1) is not same-origin with requestUrl, return "invalid".

https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#cross-origin-trust

We want to add sxg_fallback_host option.