Privacy-Oriented Origin Policy

• Fixed an issue with the relaxed mode that was causing it to ignore more requests than it was meant to.
• Flipped the default state of the option to exclude root domain matches to enabled.

1.4.1

Partially addresses a non-critical vulnerability: requests to loopback/private addresses should be ignored. See #21

Privacy-Oriented Origin Policy

1.4.1b2

Update manifest.json

Privacy-Oriented Origin Policy

1.4.1b

Fixes a non-critical vulnerability: requests to loopback/private addresses should be ignored. See #21

Privacy-Oriented Origin Policy

• more console info (see #20)
• updated public suffixes for the Exclude root domain matches option, and improved the getRoot function.
• various minor optimizations.

Privacy-Oriented Origin Policy

• more console info (see #20)
• updated public suffixes for the Exclude root domain matches option, and improved the getRoot function.
• various minor optimizations.

Privacy-Oriented Origin Policy

• fixed non-preflight requests using the OPTIONS method not being ignored

Privacy-Oriented Origin Policy

• fixed the debug message of the referer spoofing feature
• OPTIONS requests are processed just like GET requests now when Access-Control-Request-Method: GET

Privacy-Oriented Origin Policy

Note: jumped straight to release 1.3.0b2 because Mozilla was returning a 404 every time I tried to download the signed XPI for 1.3.0b.

• fixed the debug message of the referer spoofing feature
• OPTIONS requests are processed just like GET requests now when Access-Control-Request-Method: GET

Privacy-Oriented Origin Policy

• minor bugfix: the cross-origin Referer spoofing feature was not sending the full URL, which is not ideal because it doesn't match the behavior of network.http.referer.spoofSource, and raises entropy unnecessarily.