fix: remove use of Clear-Site-Data
We used Clear-Site-Data to cushion transition period for local gateway exposed at http://localhost while we were still figuring out security-related details. In the final implementation subdomain gateways are not tied to a hostname explicitly, which removes the risk of cookies leaking, removing the need for the header. Turns out it causes issues for Firefox users, so let's just remove it. Closes https://github.com/ipfs-shipyard/ipfs-companion/issues/977
Marcin Rataj committed
Jan 29, 2021 at 22:08 UTC
d61ae2bcb48be6067acaaa9c0d1c51483f891b0b
3 files changed
-17
core/corehttp/hostname.go
-9
@@ -97,15 +97,6 @@ func HostnameOption() ServeOption {
97
return
98
}
99
if newURL != "" {
100
- // Just to be sure single Origin can't be abused in
101
- // web browsers that ignored the redirect for some
102
- // reason, Clear-Site-Data header clears browsing
103
- // data (cookies, storage etc) associated with
104
- // hostname's root Origin
105
- // Note: we can't use "*" due to bug in Chromium:
106
- // https://bugs.chromium.org/p/chromium/issues/detail?id=898503
107
- w.Header().Set("Clear-Site-Data", "\"cookies\", \"storage\"")
108
-
100
// Set "Location" header with redirect destination.
101
// It is ignored by curl in default mode, but will
102
// be respected by user agents that follow
docs/config.md
-1
@@ -653,7 +653,6 @@ between content roots.
653
}
654
}
655
```
656
-<!-- **(not implemented yet)** due to the lack of Origin isolation, cookies and storage on `Paths` will be disabled by [Clear-Site-Data](https://github.com/ipfs/in-web-browsers/issues/157) header -->
656
657
Default: `false`
658
test/sharness/t0114-gateway-subdomains.sh
-7
@@ -181,13 +181,6 @@ test_localhost_gateway_response_should_contain \
181
"http://localhost:$GWAY_PORT/ipfs/$DIR_CID/" \
182
"Location: http://$DIR_CID.ipfs.localhost:$GWAY_PORT/"
183
184
-# Responses to the root domain of subdomain gateway hostname should Clear-Site-Data
185
-# https://github.com/ipfs/go-ipfs/issues/6975#issuecomment-597472477
186
-test_localhost_gateway_response_should_contain \
187
- "request for localhost/ipfs/{CIDv1} returns Clear-Site-Data header to purge Origin cookies and storage" \
188
- "http://localhost:$GWAY_PORT/ipfs/$CIDv1" \
189
- 'Clear-Site-Data: \"cookies\", \"storage\"'
190
-
184
# We return body with HTTP 301 so existing cli scripts that use path-based
185
# gateway do not break (curl doesn't auto-redirect without passing -L; wget
186
# does not span across hostnames by default)