Miroslav Šedivý 22e35dd525 server: reject cross-origin WebSocket handshakes when CORS is empty. ...

With an empty server.cors, AllowOrigin accepted every Origin, so a hostile
page could open an authenticated WebSocket using the SameSite=None session
cookie. Now only same-origin, listed origins, or '*' are accepted.

Discovered by Yves Soete of Blacksight LLC.

2026-10-28 17:11:31 +01:00

..

batch.go

refactor: replace custom array search utility with slices.Contains for improved readability and performance.

2026-08-04 12:49:38 +02:00

debug.go

Upgrade go dependencies (#644)

2026-04-25 15:20:43 +02:00

logger.go

Upgrade go dependencies (#644)

2026-04-25 15:20:43 +02:00

manager_test.go

server: reject cross-origin WebSocket handshakes when CORS is empty.

2026-10-28 17:11:31 +01:00

manager.go

server: reject cross-origin WebSocket handshakes when CORS is empty.

2026-10-28 17:11:31 +01:00

router.go

Upgrade go dependencies (#644)

2026-04-25 15:20:43 +02:00