Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Private Network Access support in CORSMiddleware #2621

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

dm1sh
Copy link

@dm1sh dm1sh commented Jun 16, 2024

Summary

Chromium-based browsers now enforce requests from websites in public network to localhost or private network endpoints and from private to localhost to "ask for permission" from server with OPTIONS pre-flight request. See more in their blog post. It is also applied to navigation fetches (e.g. iframes, popups): blog post

For it I added allow_private_network field in CORSMiddleware constructor as discussed in #2509. Also, I renamed former preflight_response to cors_preflight_response to add pna_preflight_response method to support pre-flight request in no-cors mode. Tests were also updated to cover new functionality.

I invite other contributors and maintainers to work on this pull request to be merged in future. Google is going to enforce various restrictions in their platform, so our instruments must be ready to deal with it!

Checklist

  • I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.

Copy link
Member

@Kludex Kludex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any reason why you ignore the access-control-request-method on the pna logic?

Also... Do we need this separation on pna and cors? The logic is very similar.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants