mastodon

Commit Graph

Author	SHA1	Message	Date
Emelia Smith	e1b7382ea6	Add userinfo oauth endpoint (#32548 )	2 months ago
Claire	ee55d20fd5	Allow `POST /oauth/revoke` through CORS (#31743 )	4 months ago
Matt Jankowski	9a3d047f3e	Run `bin/rails app:update` with Rails 7.1 (#27522 )	1 year ago
Wladimir Palant	23f8e93c64	Fixes #23135 - Allow cross origin request for /nodeinfo/2.0 API (#27413 )	1 year ago
Matt Jankowski	56c0babc0b	Fix rubocop `Layout/ArgumentAlignment` cop (#26060 )	1 year ago
Nick Schonning	1d557305d2	Enable Rubocop Style/FrozenStringLiteralComment (#23793 )	1 year ago
ThibG	3f12c07ff5	Use same CORS policy for /@:username and /users/:username (#9485 ) Fixes #8189 rack-cors being called before the application router, it does not follow the redirection, and we need a separate rule for /users/:username.	6 years ago
Ben Lubar	13e049d772	Allow cross-origin requests to /.well-known/* URLs. (#9083 ) Right now, this includes three endpoints: host-meta, webfinger, and change-password. host-meta and webfinger are publicly available and do not use any authentication. Nothing bad can be done by accessing them in a user's browser. change-password being CORS-enabled will only reveal the URL it redirects to (which is /auth/edit) but not anything about the actual /auth/edit page, because it does not have CORS enabled. The documentation for hosting an instance on a different domain should also be updated to point out that Access-Control-Allow-Origin: * should be set at a minimum for the /.well-known/host-meta redirect to allow browser-based non-proxied instance discovery.	6 years ago
Yamagishi Kazutoshi	50529cbceb	Upgrade Rails to version 5.2.0 (#5898 )	7 years ago

9 Commits (65cea8f89f7c6453e6709f834a39b4552a330743)