search

qzind / tray

Browser plugin for sending documents and raw commands to a printer or attached device.
https://qz.io
Other
848 stars 276 forks source link

Add new CORS rules for Chromium #703

Open tresf opened 4 years ago

tresf commented 4 years ago

Summary:

[Chromium will] begin requiring servers on a user's machine (127.0.0.1) or intranet (as defined by RFC1918) to explicitly opt-in to connections originating from the public internet.

This impact was originally anticipated and unwelcomed (Dropbox authors opposed this), but the recent change to fix this with CORS is much preferred. It means services (such as Dropbox, QZ Tray) can explicitly opt-in for connection attempts/internet-originated traffic.

Assigning to @bberenz to investigate and add the necessary CORS connection headers. Any further information (such as how to test such a change, when this will land in production version of Chrome, etc) are welcome.

akberenz commented 4 years ago

It looks like the websocket portion of this revision is still under consideration and a decision between headers/preflights/both hasn't yet been made. 3.2, i#4 I'm not sure it makes sense for us to add anything yet until this gets into a more determined state.

tresf commented 4 years ago

@bberenz we'll need it for the JSON API (e.g. https://localhost:8181/json) through https:// so we can prepare a branch/PR in advance to cover one and potentially cover the other now, no?