-
Notifications
You must be signed in to change notification settings - Fork 187
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Refactor http headers #2666
Refactor http headers #2666
Conversation
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
Ugh... the sonarcloud analysis failed because of the duplication of the new code. But this is just boilerplate code in the flagset and server commands.... Maybe we should exclude those files from the analysis? Anyways...this PR is still good to go. |
@wkloucek, any idea why this is happening?
|
It is probably related to #2631. But it was green back then so something must have changed. |
It can't find the assets... But they should be there because they have been generated... Looks flaky |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Just the question about if we really need CORS for the debug servers
@@ -51,7 +52,12 @@ func NewService(opts ...Option) *http.Server { | |||
chimiddleware.RealIP, | |||
chimiddleware.RequestID, | |||
middleware.NoCache, | |||
middleware.Cors, | |||
middleware.Cors( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
do we actually need CORS for the debug service?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was asking that myself. I don't know.
How are the debug servers supposed to be used?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since the debug service had the CORS middleware before I'll just merge this PR and if we want to remove it we can do it in another PR.
Only legacy browsers are still supporting this header. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection#browser_compatibility.
SonarCloud Quality Gate failed. |
Description
I updated some http headers and refactored the CORS middleware. The CORS options are now configurable.
Also I removed the CORS middleware, where it isn't necessary.
Related Issue
Motivation and Context
These changes clean up some technical debt.
Types of changes
Checklist: