Needed fix for corsProxy (server operators must read)
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 30/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, node.js
Research direction
Start by locating the corsProxy implementation and its request-handling tests; the issue names no files or tests. Verify behavior for missing or unauthorized Origin values and for downstream responses without RDF content types. Done means those cases return 400 or similar, while allowed RDF responses continue to work.
Written by the indexing model from the issue text.
Description
Action required
If you are an NSS server operator, please check that your settings use the default "corsProxy": false.
If you have a public facing server with "corsProxy": true, please change it to "corsProxy": false until the suggested fix below is deployed.
Fix
The CORS proxy needs to be changed as follows:
- If no
Originfield present in the HTTP request, respond with a400or similar. - If the
Originvalue in the request is not the server's configured domain (podhost.example) or a direct subdomain thereof (alice.podhost.example), respond with400or similar. - If, after satistying the above two conditions, the response received from the downstream server does not indicate an RDF content type in its headers (such as Turtle, HTML, etc.), respond with
400.- In particular, images, videos, PDFs etc. must result in a
400. - The connection to the downstream server can and should be closed prematurely if the content type is not RDF.
- In particular, images, videos, PDFs etc. must result in a
- Dominant language
- JavaScript
- Stars
- 1.8k
- Forks
- 308
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nodeSolidServer/node-solid-server
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
nodeSolidServer/node-solid-server#1848 · 2 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nodeSolidServer/node-solid-server#1841 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nodeSolidServer/node-solid-server#1147 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
nodeSolidServer/node-solid-server#1867 ·
-
Difficulty 5/5 Over a week Newbie friendliness 45/100
nodeSolidServer/node-solid-server#1853 ·
All issues in nodeSolidServer/node-solid-server
Similar issues
-
ai-observability bug team/ai-observability
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
AllTheMods/ATM-10-L#19 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
SignalK/n2k-signalk#345 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
JuliaPluto/PlutoPlotly.jl#72 ·