Open nunziotocci opened 6 years ago
After some quick research this still seems to be a viable solution.
I've checked IE11, Edge, Firefox, and Google Chrome on Windows 10 and they send the Referer header on same-origin and cross-origin AJAX requests as long as the AJAX destination is behind HTTPS.
Also, I feel inclined to say that it seems like public_referer_list
should be called public_api_referer_list
. It took me a couple minutes to remember that these are only supposed to affect the API.
Ok, while writing the code for this, I found that the Origin
header needs to be used for Websockets. It could in theory be used for AJAX calls, but I'm going to use Referer
if it's available and fall back on Origin
.
Ok, this feature has only been intrusive when it comes to accept(nc)_* functions.
I will add a parameter to disable the check for accept(nc)* functions. The developer would then be responsible for making sure that the accept functions don't make any database updates.
In order to prevent CORS attacks, we should add two configuration parameters:
api_referer_list
andpublic_referer_list
.These parameters would be comma-separated lists of domains (possibly also wildcard domains) that are allowed to send requests to Envelope.
api_referer_list
should be a required parameterpublic_referer_list
should default toapi_referer_list