Skip to content

Conversation

@svenzik
Copy link
Contributor

@svenzik svenzik commented May 30, 2025

WE2-967

  • Replace http with https when origin is loopback
  • Remove prefix __Host- from cookie key, when using http as that requires https connection

Signed-off-by: Sven Mitt [email protected]

@svenzik svenzik force-pushed the WE2-967-allow-http branch from a9ab5dd to 3d24ee2 Compare June 9, 2025 07:23
@mrts mrts force-pushed the WE2-967-allow-http branch from 481f3f3 to c6c03fd Compare June 13, 2025 08:47
if (StringUtils.endsWith(localOrigin, "/")) {
throw new IllegalArgumentException("Configuration parameter local-origin cannot end with '/': " + localOrigin);
}
if (StringUtils.startsWith(localOrigin, "http:")) {
Copy link
Member

@mrts mrts Nov 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel uneasy about doing this so directly, folks may start copy-pasting this into their code without thinking.

Can we perhaps use a special profile enable-http and add thorough comments to make it absolutely clear that this should not be used in production? Or am I too paranoid, do we want to assume abusing the loopback address is impossible?

@mrts mrts force-pushed the WE2-967-allow-http branch from 0f9d6ab to 8c34c66 Compare November 13, 2025 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants