Migrations/neko
1
0
Fork 0
mirror of https://github.com/m1k1o/neko.git synced 2026-11-03 08:21:50 -06:00
Code Issues Packages Projects Releases Wiki Activity

server: reject cross-origin WebSocket handshakes when CORS is empty.

Browse Source 
With an empty server.cors, AllowOrigin accepted every Origin, so a hostile
page could open an authenticated WebSocket using the SameSite=None session
cookie. Now only same-origin, listed origins, or '*' are accepted.

Discovered by Yves Soete of Blacksight LLC.
This commit is contained in:
Miroslav Šedivý
2026-10-28 17:11:31 +01:00
parent 23d8a2718e
commit 22e35dd525
4 changed files with 34 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webpage/docs/configuration/help.txt
+1 -1
View File
@@ -43,7 +43,7 @@
--plugins.required if true, neko will exit if there is an error when loading a plugin
--server.bind string address/port/socket to serve neko (default "127.0.0.1:8080")
--server.cert string path to the SSL cert used to secure the neko server
--server.cors strings list of allowed origins for CORS, if empty CORS is disabled, if '*' is present all origins are allowed
--server.cors strings list of allowed origins for CORS and WebSocket connections, if empty only same-origin WebSocket connections are accepted, if '*' is present all origins are allowed
--server.key string path to the SSL key used to secure the neko server
--server.metrics enable prometheus metrics available at /metrics (default true)
--server.path_prefix string path prefix for HTTP requests (default "/")