Support contact does not set CORS headers #865

New issue

Open

opened 2025-06-23 23:09:31 +00:00 by Jade · 2 comments

Jade commented

2025-06-23 23:09:31 +00:00

Owner

No description provided.

Jade added the

Bug

label 2025-06-23 23:09:31 +00:00

nex added the

Matrix/Client

label 2025-06-24 01:27:49 +00:00

nex commented

2025-06-24 01:28:01 +00:00

Owner

@Jade could you attach some context?

Jade commented

2025-06-24 01:59:02 +00:00

Author

Owner

Well known support contact endpoint (and apparently all of the matrix endpoints) don't have the appropriate CORS headers set to allow browser JS clients to read them. Instead this is done by the reverse proxy config, which is different per user.
My reverse proxy config through some accident or another sets the cors for matrix.ellis.link but not for the ellis.link well known files.
What should be happening is that continuity itself should be setting the CORS headers, but only on endpoints where it makes sense (i.e. client endpoints). This would fix this little bug and future proof for if we end up doing something more complicated in the web UI. (Note we would need CSRF protection for that anyway, CORS prevents reads not writes).

I had a little look at fixing this this evening, and likely this requires some changes to ruwuma. It could be hacked over the top of it, but the ideal situation would have the CORS information in the route definitions

Well known support contact endpoint (and apparently all of the matrix endpoints) don't have the appropriate CORS headers set to allow browser JS clients to read them. Instead this is done by the reverse proxy config, which is different per user. My reverse proxy config through some accident or another sets the cors for matrix.ellis.link but not for the ellis.link well known files. What should be happening is that continuity itself should be setting the CORS headers, but only on endpoints where it makes sense (i.e. client endpoints). This would fix this little bug and future proof for if we end up doing something more complicated in the web UI. (Note we would need CSRF protection for that anyway, CORS prevents reads not writes). I had a little look at fixing this this evening, and likely this requires some changes to ruwuma. It could be hacked over the top of it, but the ideal situation would have the CORS information in the route definitions

❤️ 1

Jade changed title from ~~Support contact do not set CORS headers~~ to Support contact does not set CORS headers

2025-06-24 22:42:38 +00:00

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: continuwuation/continuwuity#865

No description provided.

Rows
Columns