dovenest

← Back to log@ d4bdfb0

fix passkey origin check

AuthorKonata <konata@posteo.jp>
Date
Commitd4bdfb0eb0c659cc27551a48f3bfbd0266339ff1
Parent1bc2078
2 files changed, 4 insertions(+), 2 deletions(-)
▾Mserver/src/api/mod.rs
+3-1@ d4bdfb0@ master
@@ -198,8 +198,10 @@ pub fn router(state: Arc<AppState>) -> Router {
"x-frame-options".parse().unwrap(),
HeaderValue::from_static("DENY"),
))
// Not `no-referrer`: that makes browsers send `Origin: null` on
// same-origin POSTs, which breaks the passkey origin check.
.layer(SetResponseHeaderLayer::overriding(
"referrer-policy".parse().unwrap(),
HeaderValue::from_static("no-referrer"),
HeaderValue::from_static("same-origin"),
))
}
▾Mserver/tests/api_spa.rs
+1-1@ d4bdfb0@ master
@@ -52,7 +52,7 @@ async fn spa_fallback_and_api_guards() {
Some("nosniff")
);
assert_eq!(r.header("x-frame-options").as_deref(), Some("DENY"));
assert_eq!(r.header("referrer-policy").as_deref(), Some("no-referrer"));
assert_eq!(r.header("referrer-policy").as_deref(), Some("same-origin"));
// A known asset is served with the right type.
let r = c.get("/app.css").await;