Fixes the insecure default from the audit: with WEBHOOKER_ENVIRONMENT unset the process ran as dev, and dev sends Access-Control-Allow-Origin: * on every route, authenticated pages included. The default is now prod; dev must be set explicitly.
Per the narrowing on the issue, dev no longer affects cookie security or CSRF strictness — those follow the request transport since an earlier change — so CORS is the only behaviour the setting still governs, and flipping the default turns it off for an operator who forgets the variable.
Changes:
resolveEnvironment defaults to prod; its comment says dev must be set explicitly.
README configuration table and the environment section state the new default; the Quick Start make dev still works without the variable (nothing in the UI needs CORS).
Tests cover the default (prod) and the explicit dev.
Other environment readers are unchanged: the CORS middleware still keys on dev, and the TRUSTED_PROXIES startup warning still fires in every environment when the list is empty — it never depended on the setting. Comments and one CSRF test that justified themselves by the old dev default were corrected to match; no behaviour there changed.
Disclosure: the linter surfaces a pre-existing gomodguard deprecation warning (linter newer than its config); out of scope and untouched.
Fixes the insecure default from the audit: with WEBHOOKER_ENVIRONMENT unset the process ran as `dev`, and `dev` sends `Access-Control-Allow-Origin: *` on every route, authenticated pages included. The default is now `prod`; `dev` must be set explicitly.
Per the narrowing on the issue, `dev` no longer affects cookie security or CSRF strictness — those follow the request transport since an earlier change — so CORS is the only behaviour the setting still governs, and flipping the default turns it off for an operator who forgets the variable.
Changes:
- `resolveEnvironment` defaults to `prod`; its comment says `dev` must be set explicitly.
- README configuration table and the environment section state the new default; the Quick Start `make dev` still works without the variable (nothing in the UI needs CORS).
- Tests cover the default (`prod`) and the explicit `dev`.
Other environment readers are unchanged: the CORS middleware still keys on `dev`, and the `TRUSTED_PROXIES` startup warning still fires in every environment when the list is empty — it never depended on the setting. Comments and one CSRF test that justified themselves by the old `dev` default were corrected to match; no behaviour there changed.
Disclosure: the linter surfaces a pre-existing `gomodguard` deprecation warning (linter newer than its config); out of scope and untouched.
closes https://git.eeqj.de/sneak/webhooker/issues/307
Model: opus-4-8
An unset WEBHOOKER_ENVIRONMENT now resolves to prod rather than dev, so
an operator who forgets the variable is not silently permissive. The
only behaviour dev still changes is the CORS middleware, which answers
every origin with Access-Control-Allow-Origin: *; that is now off
unless dev is set explicitly. Cookie Secure and CSRF strictness are
decided per request from the transport and are unaffected.
Updated resolveEnvironment and its comment, the README configuration
table and prose, and tests covering the default and the explicit dev.
Comments that justified behaviour by the old dev default (the
TRUSTED_PROXIES warning, a CSRF test) were corrected; that warning
still fires in every environment when TRUSTED_PROXIES is empty.
Model: opus-4-8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes the insecure default from the audit: with WEBHOOKER_ENVIRONMENT unset the process ran as
dev, anddevsendsAccess-Control-Allow-Origin: *on every route, authenticated pages included. The default is nowprod;devmust be set explicitly.Per the narrowing on the issue,
devno longer affects cookie security or CSRF strictness — those follow the request transport since an earlier change — so CORS is the only behaviour the setting still governs, and flipping the default turns it off for an operator who forgets the variable.Changes:
resolveEnvironmentdefaults toprod; its comment saysdevmust be set explicitly.make devstill works without the variable (nothing in the UI needs CORS).prod) and the explicitdev.Other environment readers are unchanged: the CORS middleware still keys on
dev, and theTRUSTED_PROXIESstartup warning still fires in every environment when the list is empty — it never depended on the setting. Comments and one CSRF test that justified themselves by the olddevdefault were corrected to match; no behaviour there changed.Disclosure: the linter surfaces a pre-existing
gomodguarddeprecation warning (linter newer than its config); out of scope and untouched.closes #307
Model: opus-4-8
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.