Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

if assume_secure_protocol is enabled make sure to use https in CORS #10480

Closed
wants to merge 1 commit into from
Closed

if assume_secure_protocol is enabled make sure to use https in CORS #10480

wants to merge 1 commit into from

Conversation

tsteur
Copy link
Member

@tsteur tsteur commented Sep 7, 2016

I have actually not tested this but seen it as a potential problem in a case where CORS is needed.

@tsteur
if assume_secure_protocol is enabled make sure to use https in allow …
cd15dfc 
…origin

Eg if website is accessed with https, then a proxy sends to Piwik with http we need to make sure to allow https.
@tsteur tsteur added the Needs Review PRs that need a code review label Sep 7, 2016
@tsteur tsteur added this to the 2.16.3 milestone Sep 7, 2016
@tsteur
Copy link
Member Author

tsteur commented Sep 8, 2016

Actually, I'm closing this one again. Because we cannot assume that the cors_domains are using a proxy and that the setting should be applied to these domains.

@tsteur tsteur closed this Sep 8, 2016
@tsteur tsteur deleted the assume_secure_cors branch September 8, 2016 21:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Needs Review PRs that need a code review
Projects
None yet
Milestone
2.16.3
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@tsteur