Miroslav Šedivý 22e35dd525 server: reject cross-origin WebSocket handshakes when CORS is empty. ...

With an empty server.cors, AllowOrigin accepted every Origin, so a hostile
page could open an authenticated WebSocket using the SameSite=None session
cookie. Now only same-origin, listed origins, or '*' are accepted.

Discovered by Yves Soete of Blacksight LLC.

2026-10-28 17:11:31 +01:00

..

api

Remove legacy mode.

2026-10-16 20:23:56 +02:00

capture

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00

config

server: reject cross-origin WebSocket handshakes when CORS is empty.

2026-10-28 17:11:31 +01:00

desktop

refactor: standardize constant names and improve goroutine handling across multiple files.

2026-04-08 15:16:47 +02:00

http

server: reject cross-origin WebSocket handshakes when CORS is empty.

2026-10-28 17:11:31 +01:00

member

oauth: ignore email when provider reports email_verified=false.

2026-10-28 17:05:56 +01:00

plugins

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00

session

Remove legacy mode.

2026-10-16 20:23:56 +02:00

webrtc

Remove legacy mode.

2026-10-16 20:23:56 +02:00

websocket

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00