Skip to content

v0.63.0

Choose a tag to compare

View all tags
@adamdecaf adamdecaf released this 10 Aug 14:50
· 11 commits to master since this release
v0.63.0
980aa65

What's Changed

HTTP — CORS origin allowlist (breaking for credentialed browser clients)

Require explicit Origins for credentialed CORS responses

  • SetAccessControlAllowHeaders (and therefore AddCORSHandler / Wrap) previously reflected any https:// Origin with Access-Control-Allow-Credentials: true (and allowed Cookie / X-User-Id). That allowed arbitrary HTTPS sites to make credentialed cross-origin calls.
  • Origins must now be listed in MOOV_CORS_ALLOW_ORIGINS (comma-separated exact Origins), e.g. https://moov.io,https://dashboard.moov.io.
  • Loopback HTTP origins remain allowed for local development: http://localhost, http://localhost:<port>, http://127.0.0.1, http://127.0.0.1:<port>.
  • Unlisted Origins receive no Access-Control-Allow-Origin / credentials headers.
  • Allowed responses also set Vary: Origin.

Reusable API for services

  • Services that already call AddCORSHandler, SetAccessControlAllowHeaders, or Wrap pick this up by bumping moov-io/base — no local CORS forks required.
  • SetCORSAllowedOrigins([]string) — programmatic / config-driven allowlist (safe concurrent with request handlers).
  • OriginAllowedForCORS(origin string) bool — shared check for custom handlers (e.g. go-kit ServerAfter).
  • ResetCORSAllowlistForTest() — test helper to reload from env between cases.
  • Const CORSAllowedOriginsEnv (MOOV_CORS_ALLOW_ORIGINS).

Deploy / upgrade notes

Before (≤ v0.62.x) After (v0.63.0)
Any https://… Origin got ACAO + credentials Only allowlisted Origins (plus loopback HTTP)
Env not required for browser CORS Set MOOV_CORS_ALLOW_ORIGINS wherever credentialed browser calls are expected
Server-to-server / non-browser clients Unaffected (CORS is browser-enforced)

Example:

MOOV_CORS_ALLOW_ORIGINS=https://moov.io,https://dashboard.moov.io

Dependencies

  • fix(deps): update module github.com/rickar/cal/v2 to v2.1.29 (#510)

Full Changelog: v0.62.1...v0.63.0

Assets 2
Loading