go-pkgz / rest / 32197183823

97%

master: 97%

Build Type

Pull #52

github

Committed by paskal

Commit Message

feat: add CorsUnsafeAnyOriginWithCredentials opt-in

Rejecting "*" with credentials stays the default, but it no longer removes the
capability. A service that has to accept credentialed requests from arbitrary
third-party origins, an embeddable widget being the obvious case, can ask for
origin reflection by name, and the name and doc comment say what it costs.

Pull Request Pull Request #52: Reject wildcard CORS origin when credentials are enabled

Coverage Stats

7 of 7 new or added lines in 1 file covered. (100.0%)

7 existing lines in 2 files now uncovered.

1502 of 1547 relevant lines covered (97.09%)

48.61 hits per line