Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CORS access controls not applied for non-GET requests to the tracker #16380

Closed
fmarier opened this issue Sep 4, 2020 · 1 comment
Closed

CORS access controls not applied for non-GET requests to the tracker #16380

fmarier opened this issue Sep 4, 2020 · 1 comment
Labels
not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it.

Comments

@fmarier
Copy link

fmarier commented Sep 4, 2020

Matomo has a configuration option to restrict CORS requests to specific domains and that's correctly implemented in the CORSHandler in the case of GET requests. However, some additional code overrides the CORSHandler in the case of non-GET requests.

Unless there is a reason for bypassing the CORSHandler, it would be safer to treat all HTTP methods the same.
@tsteur
Copy link
Member

tsteur commented Sep 4, 2020

Note: This is in the tracker context only. I'll also post the same comment in the PR just in case someone reads it.

@fmarier If we removed this then POST tracking requests wouldn't work anymore and always fallback to GET.

See eg
image

This is currently their on purpose and because not really any information can be retrieved from this it shouldn't be any problem.

@tsteur tsteur closed this as completed Sep 6, 2020
@tsteur tsteur added not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it. labels Sep 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@fmarier @tsteur