Miroslav Šedivý 22e35dd525 server: reject cross-origin WebSocket handshakes when CORS is empty. ...

With an empty server.cors, AllowOrigin accepted every Origin, so a hostile
page could open an authenticated WebSocket using the SameSite=None session
cookie. Now only same-origin, listed origins, or '*' are accepted.

Discovered by Yves Soete of Blacksight LLC.

2026-10-28 17:11:31 +01:00

..

api

change API index page.

2025-03-22 17:52:56 +01:00

configuration

server: reject cross-origin WebSocket handshakes when CORS is empty.

2026-10-28 17:11:31 +01:00

customization

feat(browsers): update persistent data policies for Firefox-based browsers.

2026-08-07 21:24:49 +02:00

developer-guide

Update Go version to 1.26.

2026-10-20 10:34:54 +02:00

hardware-acceleration

add API reference.

2025-02-18 22:44:48 +01:00

installation

Add example Docker Compose configurations for Neko (#684)

2026-09-27 17:13:20 +02:00

migration-from-v2

refactor: v3 config options take precedence over v2 deprecated.

2026-10-16 20:34:40 +02:00

faq.md

update docs with more deeplinking.

2025-03-26 22:46:11 +01:00

introduction.md

fix links on webpage.

2025-03-22 23:02:57 +01:00

quick-start.md

Fix typo in quick-start guide for local network setup (#533)

2025-05-16 07:52:54 +02:00

release-notes.md

docs: update release notes for v3.2.0 with new features, fixes, and changes.

2026-10-16 00:06:27 +02:00

reverse-proxy-setup.md

docs: fix Apache websocket rewrite for /api/ws (#717)

2026-10-16 21:43:34 +02:00

roadmap.md

fix links on webpage.

2025-03-22 23:02:57 +01:00

troubleshooting.md

docs: add warning about using localhost for NEKO_WEBRTC_NAT1TO1 and common WebRTC connection errors. (#672)

2026-07-31 15:01:03 +02:00