Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

CORS should be disabled by default

Description

CORS is not necessary for ReST access by the mobile client, it should only be enabled by site administrators who know what they're doing. Right now it's enabled in all cases, but it could expose us to various cross-site-scripting attacks.

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Show:

Benjamin Reed March 30, 2015 at 4:56 PM

Fixed in foundation, cherry-picked to 15.0.2.

Fixed

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Priority

PagerDuty

Created March 30, 2015 at 4:47 PM
Updated March 30, 2015 at 8:55 PM
Resolved March 30, 2015 at 4:56 PM