Migrations/neko - neko - Nextia Gitea: Git repos for nextia infra

Migrations/neko

Fork 0

mirror of https://github.com/m1k1o/neko.git synced 2026-11-03 00:11:48 -06:00

Commit Graph

Author	SHA1	Message	Date
Miroslav Šedivý	22e35dd525	server: reject cross-origin WebSocket handshakes when CORS is empty. With an empty server.cors, AllowOrigin accepted every Origin, so a hostile page could open an authenticated WebSocket using the SameSite=None session cookie. Now only same-origin, listed origins, or '*' are accepted. Discovered by Yves Soete of Blacksight LLC.	2026-10-28 17:11:31 +01:00
Seungwon Lee	bdd0428a60	websocket: allow internal originless dial (#710 )	2026-09-30 18:29:55 +02:00
@刘羡鱼	dae23a90b5	feat(auth): add OIDC-only member authentication (#686 ) * feat(auth): add OIDC member authentication * docs(auth): document OIDC member login * fix(auth): address OAuth review feedback * refactor(auth): move OAuth flow into member provider	2026-09-24 00:15:46 +02:00

Author

SHA1

Message

Date

Miroslav Šedivý

22e35dd525

server: reject cross-origin WebSocket handshakes when CORS is empty.

With an empty server.cors, AllowOrigin accepted every Origin, so a hostile
page could open an authenticated WebSocket using the SameSite=None session
cookie. Now only same-origin, listed origins, or '*' are accepted.

Discovered by Yves Soete of Blacksight LLC.

2026-10-28 17:11:31 +01:00

Seungwon Lee

bdd0428a60

websocket: allow internal originless dial (#710 )

2026-09-30 18:29:55 +02:00

@刘羡鱼

dae23a90b5

feat(auth): add OIDC-only member authentication (#686 )

* feat(auth): add OIDC member authentication

* docs(auth): document OIDC member login

* fix(auth): address OAuth review feedback

* refactor(auth): move OAuth flow into member provider

2026-09-24 00:15:46 +02:00

3 Commits