Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Access-Control-Allow-Origin wrong value in case of not authorized Origin #127

Closed
zekth opened this issue Apr 28, 2021 · 2 comments 路 Fixed by #128
Closed

Access-Control-Allow-Origin wrong value in case of not authorized Origin #127

zekth opened this issue Apr 28, 2021 · 2 comments 路 Fixed by #128

Comments

@zekth
Copy link
Member

zekth commented Apr 28, 2021 •
edited

馃悰 Bug Report

In the case of a non validated request the Access-Control-Allow-Origin is set to false as mentionned in #124 . Which is not RFC compliant, also the use of null is not the best as said in https://w3c.github.io/webappsec-cors-for-developers/#avoid-returning-access-control-allow-origin-null . Would be better to not return the CORS header in the case a non validation. What do you think @mcollina ?

RFC: https://tools.ietf.org/html/rfc6454#section-7.1
@mcollina
Copy link
Member

Let's go with it! PR?

@zekth
Copy link
Member Author

zekth commented Apr 28, 2021

I'll work on it

@zekth zekth mentioned this issue Apr 28, 2021
Merged
@zyrouge zyrouge mentioned this issue Apr 29, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: do no write header in case of non validation fastify/fastify-cors
2 participants
@mcollina @zekth