[PR #1469] [MERGED] CORS fixes #2963

New issue

Closed

opened 2026-03-03 09:09:08 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 09:09:08 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/1469
Author: @jjlin
Created: 3/7/2021
Status: ✅ Merged
Merged: 3/15/2021
Merged by: @dani-garcia

Base: master ← Head: cors

📝 Commits (2)

7d0e234 CORS fixes
d93c344 Merge branch 'master' into cors

📊 Changes

1 file changed (+14 additions, -8 deletions)

View changed files

📝 src/util.rs (+14 -8)

📄 Description

The Safari extension apparently now uses the origin file:// and expects
that to be returned (see bitwarden/browser#1311, bitwarden/server#800).
The Access-Control-Allow-Origin header was reflecting the value of the
Origin header without checking whether the origin was actually allowed.
This effectively allows any origin to interact with the server, which
defeats the purpose of CORS.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/1469 **Author:** [@jjlin](https://github.com/jjlin) **Created:** 3/7/2021 **Status:** ✅ Merged **Merged:** 3/15/2021 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `master` ← **Head:** `cors` --- ### 📝 Commits (2) - [`7d0e234`](https://github.com/dani-garcia/vaultwarden/commit/7d0e234b34c830eae63a713177f4bea310a8ae2d) CORS fixes - [`d93c344`](https://github.com/dani-garcia/vaultwarden/commit/d93c3441767cf7bccb77487a630aaf3d20793ac1) Merge branch 'master' into cors ### 📊 Changes **1 file changed** (+14 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `src/util.rs` (+14 -8) </details> ### 📄 Description * The Safari extension apparently now uses the origin `file://` and expects that to be returned (see bitwarden/browser#1311, bitwarden/server#800). * The `Access-Control-Allow-Origin` header was reflecting the value of the `Origin` header without checking whether the origin was actually allowed. This effectively allows any origin to interact with the server, which defeats the purpose of CORS. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>