go-pkgz / rest / 32197356726

97%

push

github

Reject wildcard CORS origin when credentials are enabled (#52)

* fix!: reject wildcard CORS origin when credentials are enabled

Previously, CORS(CorsAllowCredentials(true)) kept the default "*" origin list
and reflected any request Origin back together with
Access-Control-Allow-Credentials: true, which lets any site read
cookie-authenticated responses. The config doc already claimed the combination
was not allowed.

CORS now panics at construction when "*" is among the allowed origins and
credentials are on. This is a breaking change for callers relying on the old
behaviour, who have to enumerate their origins instead.

* docs: document the CORS credentials restriction

* feat: add CorsUnsafeAnyOriginWithCredentials opt-in

Rejecting "*" with credentials stays the default, but it no longer removes the
capability. A service that has to accept credentialed requests from arbitrary
third-party origins, an embeddable widget being the obvious case, can ask for
origin reflection by name, and the name and doc comment say what it costs.

7 of 7 new or added lines in 1 file covered. (100.0%)

1529 of 1569 relevant lines covered (97.45%)

48.68 hits per line