Isso 0.13.2 CORS Failures

[leadplasticmold]

I have isso installed via pip, running as a daemon on my webserver. Everything worked nice. However, after upgrading to 13.2 all CORS requests are denied and comments are no longer served. isso is being hosted on comments.mysite.com, and is being displayed on mysite.com. the script on mysite.com looks as follows:

<script data-isso="https://comments.mysite.com/" src="https://comments.mysite.com/js/embed.min.js"
data-isso-css="false"
data-isso-avatar="false"
data-isso-sorting="newest"
data-isso-vote="false"
></script> 

My isso.cfg looks as follows:

# Isso configuration file
# vim: set filetype=dosini

[general]

# file location to the SQLite3 database, highly recommended to change this
# location to a non-temporary location!
dbpath = /home/protected/isso/comments.db

# required to dispatch multiple websites, not used otherwise.
name =

# Your website(s). If Isso is unable to connect to at least one site, you'll
# get a warning during startup and comments are most likely non-functional.
#
# You'll need at least one host/website to run Isso. This is due to security
# reasons: Isso uses CORS_ to embed comments and to restrict comments only to
# your website, you have to "whitelist" your website(s).
#
# I recommend the first value to be a non-SSL website that is used as fallback
# if Firefox users (and only those) supress their HTTP referer completely:
#
host = https://www.mysite.com/ 


# time range that allows users to edit/remove their own comments.
# It supports years, weeks, days, hours, minutes, seconds.
# 3h45m12s equals to 3 hours, 45 minutes and 12 seconds.
max-age = 15m

# Select notification backend for new comments. Currently, only SMTP is
# available.
# Select notification backend(s) for new comments, separated by comma.
# Available backends:
#
# stdout
#     Log to standard output. Default, if none selected.
# smtp
#     Send notifications via SMTP on new comments with activation (if
#     moderated) and deletion links.
notify = smtp

# Allow users to request E-mail notifications for replies to their post.
# WARNING: It is highly recommended to also turn on moderation when enabling
# this setting, as Isso can otherwise be easily exploited for sending spam.
reply-notifications=false

# Log console messages to file instead of standard output.
log-file = /home/protected/isso/isso.log

# adds property "gravatar_image" to json response when true
# will automatically build md5 hash by email and use "gravatar_url" to build
# the url to the gravatar image
gravatar = false

# default url for gravatar. {} is where the hash will be placed
# `s=55` results in height and width of 55px.
# for other options, see http://en.gravatar.com/site/implement/images/
gravatar-url = https://www.gravatar.com/avatar/{}?d=identicon&s=55

# enable the "/latest" endpoint, that serves comment for multiple posts (not
# needing to previously know the posts URIs)
latest-enabled = false

[admin]
enabled = true

# Admin access password
password = Redacted

[moderation]
# enable comment moderation queue. This option only affects new comments.
# Comments in modertion queue are not visible to other users until you activate
# them.
enabled = true

# with moderation enabled, automatically approve new comments by an
# author if they've had comments approved within the last 6 months
# Note: No verification is done on the email addresses entered by commenters.
# This means that if someone is able to guess correctly the email address used
# by a previously approved author, they will be able to have their new comment
# auto-approved. For this reason, we recommend that you also activate SMTP
# notification if you activate this option, so that you will see
# auto-approved comments as they get posted.
approve-if-email-previously-approved = false

# remove unprocessed comments in moderation queue after given time.
purge-after = 30d


[server]
# interface to listen on. Isso supports TCP/IP and unix domain sockets: UNIX
# domain socket listen = unix:///tmp/isso.sock TCP/IP listen =
# http:///localhost:1234/
#
# When gevent is available, it is automatically used for http:// Currently,
# gevent can not handle http requests on unix domain socket (see #295 and #299
# for details).  Does not apply for uWSGI.
listen = http://localhost:8080

# public URL that Isso is accessed from by end users. Should always be a
# http:// or https:// absolute address. If left blank, automatic detection is
# attempted.
public-endpoint =

# reload application, when the source code has changed. Useful for development.
# Only works with the internal webserver.
reload = false

# show 10 most time consuming function in Isso after each request. Do not use
# in production.
profile = false

# an optional list of reverse proxies IPs behind which you have deployed
# your Isso web service (e.g. `127.0.0.1`).
# This allow for proper remote address resolution based on a
# `X-Forwarded-For` HTTP header, which is important for the mechanism
# forbiding several comment votes coming from the same subnet.
trusted-proxies =

# Override Set-Cookie header SameSite value.
# Needed for setups where isso is not hosted on the same domain, e.g. called
# from example.org and hosted under comments.example.org.
# By default, isso will set SameSite=None when served over https and
# SameSite=Lax when served over http.
# See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
# and https://github.com/isso-comments/isso/issues/682
# Accepted values: None, Lax, Strict
samesite = None


[smtp]
# Isso can notify you on new comments via SMTP. In the email notification, you
# also can moderate (=activate or delete) comments.

# self-explanatory, optional
username = email@mysite.com

# self-explanatory (yes, plain text, create a dedicated account for
# notifications), optional.
password = Redacted

# SMTP server
host = smtp.email.com

# SMTP port
port = 587

# use a secure connection to the server, possible values: none, starttls or
# ssl. Note, that there is no easy way for Python 2.7 and 3.3 to implement
# certification validation and thus the connection is vulnerable to
# Man-in-the-Middle attacks. You should definitely use a dedicated SMTP account
# for Isso in that case.
security = starttls

# recipient address, e.g. your email address
to = email@email.com

# sender address, e.g. "Foo Bar" <isso@example.tld>
from = email@mysite.com

# specify a timeout in seconds for blocking operations like the
# connection attempt.
timeout = 10


[guard]
# Enable basic spam protection features, e.g. rate-limit per IP address (/24
# for IPv4, /48 for IPv6).

# enable guard, recommended in production. Not useful for debugging purposes.
enabled = true

# limit to N new comments per minute.
ratelimit = 9

# how many comments directly to the thread (prevent a simple while true; do
# curl ...; done.
direct-reply = 3

# allow commenters to reply to their own comments when they could still edit
# the comment. After the editing timeframe is gone, commenters can reply to
# their own comments anyways. Do not forget to configure the client.
reply-to-self = false

# force commenters to enter a value into the author field. No validation is
# performed on the provided value.  Do not forget to configure the client
# accordingly.
require-author = false

# require the commenter to enter an email address (note: no validation is
# done on the provided address). Do not forget to configure the client.
require-email = false


[markup]
# Customize markup and sanitized HTML. Currently, only Markdown (via Misaka) is
# supported, but new languages are relatively easy to add.

# Misaka-specific Markdown extensions, all extensions can be used here,
# separated by comma, either by their name or by EXT_<extension>.
# Careful: Misaka 1.0 used "snake_case", but 2.0 needs "dashed-case"!
# Explanation of extensions: https://flask-misaka.readthedocs.io/en/latest/#options
options = autolink, fenced-code, no-intra-emphasis, strikethrough, superscript

# Misaka-specific HTML rendering flags, all html rendering flags can be used
# here, separated by comma, either by their name or as HTML_<flag>.
# Per Misaka's defaults, no flags are set.
flags =

# Additional HTML tags to allow in the generated output, comma-separated. By
# default, only a, blockquote, br, code, del, em, h1, h2, h3, h4, h5, h6, hr,
# ins, li, ol, p, pre, strong, table, tbody, td, th, thead and ul are allowed.
allowed-elements =

# Additional HTML attributes (independent from elements) to allow in the
# generated output, comma-separated. By default, only align and href are
# allowed.
allowed-attributes =


[hash]
# Customize used hash functions to hide the actual email addresses from
# commenters but still be able to generate an identicon.


# A salt is used to protect against rainbow tables. Isso does not make use of
# pepper (yet). The default value has been in use since the release of Isso and
# generates the same identicons for same addresses across installations.
salt = Redacted

# Hash algorithm to use -- either from Python's hashlib or PBKDF2 (a
# computational expensive hash function).
#
# The actual identifier for PBKDF2 is pbkdf2:1000:6:sha1, which means 1000
# iterations, 6 bytes to generate and SHA1 as pseudo-random family used for key
# strengthening. Arguments have to be in that order, but can be reduced to
# pbkdf2:4096 for example to override the iterations only.
algorithm = Redacted


[rss]
# Provide an Atom feed for each comment thread for users to subscribe to.

# The base URL of pages is needed to build the Atom feed. By appending
# the URI, we should get the complete URL to use to access the page
# with the comments. When empty, Atom feeds are disabled.
base =

# Limit the number of elements to return for each thread.
limit = 100

Any idea why upgrading would cause requests to be denied?

[leadplasticmold]

@jelmer I saw you changed this from an issue to a discussion. Do you have some insight into this? I'd really like to update to the latest version, but a cors issue arising on update without any change to my config is preventing it...