Skip to content

v1.63.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Aug 15:19
· 25 commits to master since this release
v1.63.0
e65734f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Security — CORS origin allowlist via moov-io/base v0.63.0

Bump github.com/moov-io/base to v0.63.0.

Credentialed CORS no longer reflects arbitrary https:// Origins with Access-Control-Allow-Credentials: true. Existing AddCORSHandler / SetAccessControlAllowHeaders / Wrap call sites now honor base's shared allowlist.

Deploy / upgrade

  • Set MOOV_CORS_ALLOW_ORIGINS to a comma-separated list of exact browser Origins where credentialed cross-origin calls are expected (e.g. https://moov.io,https://dashboard.moov.io).
  • Loopback HTTP origins remain allowed for local development (http://localhost[:port], http://127.0.0.1[:port]).
  • Server-to-server / non-browser clients are unaffected (CORS is browser-enforced).
  • Unlisted Origins receive no Access-Control-Allow-Origin / credentials headers.

Thanks to @SashaMIT for the CORS allowlist work.

Full Changelog: v1.62.1...v1.63.0

Assets 8
Loading